# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-15 19:26:49 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:49762: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.66.120.237
country_id: 6252001
description:
2025-11-15 19:27:09 dovecot_login authenticator failed for ([209.66.120.237]) [209.66.120.237]:51025: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.127.134.185
country_id: 6252001
description:
[2025-11-15 19:30:27 +0530] info [whostmgrd] 99.127.134.185 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 15 19:36:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<bq8VnqJD1pOLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.104.186
country_id: 3469034
description:
Nov 15 19:39:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=187.120.104.186, lip=66.85.158.91, TLS, session=<62o1qKJDLd27eGi6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.107
country_id: 3469034
description:
Nov 15 19:39:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=186.209.248.107, lip=66.85.158.91, TLS, session=<nEBfqaJDpM+60fhr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.20.66.206
country_id: 783754
description:
Nov 15 19:40:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=84.20.66.206, lip=66.85.158.91, TLS, session=<vFnmrKJDiolUFELO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 88.214.16.44
country_id: 783754
description:
Nov 15 19:40:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=88.214.16.44, lip=66.85.158.91, TLS, session=<8PrXq6JDS55Y1hAs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 15 19:48:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ZLmbyqJDW/8t4/6c>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.208.7
country_id: 6252001
description:
Nov 15 19:51:54 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.208.7, lip=66.85.158.91, session=<BtD81aJD5pGYINAH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.7
country_id: 6252001
description:
Nov 15 19:51:53 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.208.7, lip=66.85.158.91, session=<K47r1aJDfJGYINAH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.161.60.110
country_id: 6252001
description:
Nov 15 19:56:48 host2 sshd[781567]: Disconnected from invalid user siva 192.161.60.110 port 33122 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.161.60.110
country_id: 6252001
description:
Nov 15 20:01:42 host2 sshd[784374]: Disconnected from invalid user ganesh 192.161.60.110 port 37878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2025-11-15 20:03:03 dovecot_login authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:55328: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 20:03:50 host2 sshd[786175]: Disconnected from invalid user user 2.57.121.25 port 20562 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.130.187
country_id: 690791
description:
Nov 15 20:03:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=37.221.130.187, lip=66.85.158.91, TLS, session=<DK8AAKNDAJMl3YK7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-15 20:03:31 dovecot_login authenticator failed for ([152.52.218.233]) [182.78.79.134]:44922: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.100.202
country_id: 798544
description:
Nov 15 20:03:33 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=85.202.100.202, lip=66.85.158.91, TLS, session=<ZFKi/qJD/tRVymTK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.161.60.110
country_id: 6252001
description:
Nov 15 20:05:41 host2 sshd[787337]: Disconnected from invalid user it 192.161.60.110 port 47920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.161.60.110
country_id: 6252001
description:
Nov 15 20:09:39 host2 sshd[789300]: Disconnected from invalid user zhangyue 192.161.60.110 port 57958 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 15 20:11:59 host2 sshd[790642]: Disconnecting authenticating user root 5.187.97.40 port 40185: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 15 20:11:59 host2 sshd[790642]: error: maximum authentication attempts exceeded for root from 5.187.97.40 port 40185 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.187.97.40
country_id: 3579143
description:
Nov 15 20:12:06 host2 sshd[790732]: Disconnecting invalid user admin 5.187.97.40 port 40869: Too many authentication failures [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.163.10
country_id: 6252001
description:
Nov 15 20:12:12 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.154.163.10, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<gXOgHqNDcoWlmqMK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 15 20:13:19 host2 sshd[791388]: Disconnected from invalid user cosmo 27.112.78.245 port 60792 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.190
country_id: 6252001
description:
Nov 15 20:16:49 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=147.185.132.190, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<8CceL6NDl8STuYS+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.190
country_id: 6252001
description:
Nov 15 20:17:46 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.190, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<Pap/MqNDjPiTuYS+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 15 20:18:49 host2 sshd[794413]: Disconnected from invalid user alpha 27.112.78.245 port 33878 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.190
country_id: 6252001
description:
Nov 15 20:21:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.190, lip=66.85.158.91, TLS, session=<4cXSP6NDCveTuYS+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 15 20:21:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.92, session=<WvdvPqND/MyUccE7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 15 20:22:57 host2 sshd[796701]: Disconnected from invalid user fin 27.112.78.245 port 49340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.83.88.249
country_id: 6252001
description:
2025-11-15 20:28:44 dovecot_plain authenticator failed for ec2-54-83-88-249.compute-1.amazonaws.com (EC2AMAZ-H0DP7I4.ec2.internal) [54.83.88.249]:65065: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Nov 15 20:28:57 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1FiBWqNDdTdAPsUC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Nov 15 20:29:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Z+iTW6ND+hpAPsUC>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 20:30:43 host2 sshd[801449]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 20:31:57 host2 sshd[801997]: Disconnected from invalid user  2.57.121.112 port 62311 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.82.155.51
country_id: 3077311
description:
Nov 15 20:38:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=80.82.155.51, lip=66.85.158.91, TLS, session=<vMz3eqNDeaZQUpsz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.232.225.93
country_id: 597427
description:
Nov 15 20:38:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=94.232.225.93, lip=66.85.158.91, TLS, session=<zySifKNDD4Re6OFd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 20:38:13 host2 sshd[805683]: Disconnected from invalid user admin 2.57.121.112 port 62577 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 20:40:48 host2 sshd[807810]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.164.35.116
country_id: 2328926
description:
2025-11-15 20:41:17 dovecot_login authenticator failed for ([102.164.35.116]) [102.164.35.116]:50340: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.209.236
country_id: 3175395
description:
Nov 15 20:42:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=94.198.209.236, lip=66.85.158.91, TLS, session=<E94Fi6NDCpRextHs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.45
country_id: 3469034
description:
Nov 15 20:43:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=186.209.246.45, lip=66.85.158.91, TLS, session=<bw4ljKNDL5C60fYt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-11-15 20:43:53 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:57812: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-11-15 20:44:12 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:32826: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov 15 20:46:21 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=<0kW4mKNDihZBMRRE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.40
country_id: 6252001
description:
Nov 15 20:52:23 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=162.216.150.40, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<zbNLrqNDvcWi2JYo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.40
country_id: 6252001
description:
Nov 15 20:53:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.40, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LzyLsaNDvPmi2JYo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.40
country_id: 6252001
description:
Nov 15 20:54:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.150.40, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<bOwotaND7Pei2JYo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.83.88.249
country_id: 6252001
description:
2025-11-15 20:56:57 dovecot_plain authenticator failed for ec2-54-83-88-249.compute-1.amazonaws.com (EC2AMAZ-H0DP7I4.ec2.internal) [54.83.88.249]:59392: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.40
country_id: 6252001
description:
Nov 15 21:00:32 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.40, lip=66.85.158.92, TLS, session=<TUJ9y6ND3uai2JYo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.135.152
country_id: 1733045
description:
Nov 15 21:01:20 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=47.250.135.152, lip=66.85.158.92, TLS, session=<+rFWzqNDvpEv+oeY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.40
country_id: 6252001
description:
Nov 15 21:01:44 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.40, lip=66.85.158.92, TLS, session=<xBjDz6NDeuqi2JYo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.250.135.152
country_id: 1733045
description:
Nov 15 21:03:50 host2 dovecot[3661788]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=47.250.135.152, lip=66.85.158.92, TLS handshaking, session=<w/Y816NDuJEv+oeY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 15 21:05:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS: read(size=704) failed: Connection reset by peer, session=<iMXt26ND8MNChJmO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.147.171.11
country_id: 1210997
description:
Nov 15 21:05:42 host2 sshd[824275]: Disconnected from invalid user runner 58.147.171.11 port 61160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.147.171.11
country_id: 1210997
description:
Nov 15 21:07:39 host2 sshd[825262]: Disconnected from invalid user neil 58.147.171.11 port 35998 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.147.171.11
country_id: 1210997
description:
Nov 15 21:09:29 host2 sshd[826255]: Disconnected from invalid user admin 58.147.171.11 port 10810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.147.171.11
country_id: 1210997
description:
Nov 15 21:15:15 host2 sshd[830678]: Disconnected from invalid user transfer 58.147.171.11 port 48290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-11-15 21:18:43 dovecot_login authenticator failed for ([213.32.253.235]) [213.32.253.235]:32894: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-11-15 21:18:25 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br (189-44-180-233.customer.tdatabrasil.net.br) [201.61.40.117]:56014: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.35.224.226
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.35.224.226 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.136.148.103
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 64.136.148.103 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.155.67.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.155.67.206 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.142.223.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 40.142.223.251 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.169.127.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.169.127.181 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.218.6.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.218.6.111 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.143.214.32
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.143.214.32 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.169.44.243
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.169.44.243 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.115.82.79
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.115.82.79 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.230.226.105
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.230.226.105 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 209.225.102.114
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 209.225.102.114 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.94.174.65
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.94.174.65 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.40.181.202
country_id: 798549
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 89.40.181.202 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.124.119
country_id: 2802361
description:
Nov 15 21:29:25 host2 pure-ftpd[840450]: (?@34.140.124.119) [INFO] New connection from 34.140.124.119


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.83.88.249
country_id: 6252001
description:
2025-11-15 21:31:28 dovecot_plain authenticator failed for ec2-54-83-88-249.compute-1.amazonaws.com (EC2AMAZ-H0DP7I4.ec2.internal) [54.83.88.249]:52345: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.136.113.72
country_id: 2264397
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 193.136.113.72 - careers@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.197
country_id: 6252001
description:
Nov 15 21:37:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.197, lip=66.85.158.92, session=<qUzhTaRDq2NBMQHF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Nov 15 21:37:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.192, lip=66.85.158.92, TLS: Connection closed, session=<WxurTqRDpudBMQHA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-15 21:38:54 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:59950: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-15 21:38:47 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:39803: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.84
country_id: 831053
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 37.35.67.84 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 21:41:20 host2 sshd[849135]: Disconnected from invalid user admin 2.57.121.112 port 41268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Nov 15 21:42:12 host2 sshd[849862]: Disconnected from invalid user talia 72.240.125.133 port 51626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Nov 15 21:45:37 host2 sshd[852222]: Disconnected from invalid user wang 72.240.125.133 port 50830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.47
country_id: 1733045
description:
2025-11-15 21:47:18 dovecot_login authenticator failed for ([49.124.153.47]) [49.124.153.47]:49834: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-15 21:47:43 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:39009: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 15 21:48:23 host2 sshd[853963]: Disconnected from invalid user test 104.168.56.59 port 44586 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.240.125.133
country_id: 6252001
description:
Nov 15 21:49:20 host2 sshd[854603]: Disconnected from invalid user gerald 72.240.125.133 port 60476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 15 21:49:34 host2 sshd[854808]: Disconnected from invalid user gerald 104.168.56.59 port 54356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 15 21:51:58 host2 sshd[856968]: Disconnected from invalid user muhamed 104.168.56.59 port 42636 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.174
country_id: 3865483
description:
Nov 15 21:52:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.181.101.174, lip=66.85.158.91, TLS, session=<RB3bgqRDRJu+tWWu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.234.125.28
country_id: 798544
description:
Nov 15 21:52:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=84.234.125.28, lip=66.85.158.91, TLS, session=<8/8ShKRD8YlU6n0c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Nov 15 21:52:58 host2 sshd[862007]: Disconnected from invalid user test 72.240.125.133 port 41866 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.56.59
country_id: 6252001
description:
Nov 15 21:53:08 host2 sshd[863281]: Disconnected from invalid user vncuser 104.168.56.59 port 34882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.240.125.133
country_id: 6252001
description:
Nov 15 21:55:36 host2 sshd[872115]: Disconnected from invalid user vncuser 72.240.125.133 port 48290 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.24.211.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.24.211.154 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.132.83.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.132.83.51 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.86.131.240
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.86.131.240 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.156.104.15
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.156.104.15 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.161.177.240
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 67.161.177.240 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.207.210.186
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.207.210.186 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.84.72.104
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.84.72.104 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Nov 15 21:58:51 host2 sshd[873730]: Disconnected from invalid user abcd 137.184.30.179 port 40384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-11-15 22:02:05 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:43273: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2025-11-15 22:01:43 dovecot_login authenticator failed for (aes-static-217.70.22.125.airtel.in) [27.123.101.146]:49118: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Nov 15 22:02:24 host2 sshd[875846]: Disconnected from invalid user testmail 137.184.30.179 port 44802 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.30.179
country_id: 6252001
description:
Nov 15 22:03:35 host2 sshd[876748]: Disconnected from invalid user david 137.184.30.179 port 37644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Nov 15 22:04:46 host2 sshd[877376]: Disconnected from invalid user bot2 137.184.30.179 port 39066 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 15 22:06:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, session=<uhnXuKRDIOm4aYtF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 15 22:07:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, TLS: Connection closed, session=<CwGruaRDSPa4aYtF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-15 22:08:03 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54801: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Nov 15 22:08:38 host2 sshd[880325]: Disconnected from invalid user ftpuser 137.184.30.179 port 35844 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 22:09:46 host2 sshd[880918]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 15 22:09:22 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<FqigwaRDGv4t4/6c>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.66
country_id: 831053
description:
[2025-11-15 22:11:22 +0530] info [cpaneld] 37.35.67.66 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-11-15 22:12:20 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:57886: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 22:18:16 host2 sshd[886071]: Disconnected from invalid user ubnt 2.57.121.112 port 61885 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 22:19:45 host2 sshd[886747]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Nov 15 22:19:51 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CGsZ56RDhu9KUi8D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Nov 15 22:20:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, TLS handshaking: Connection closed, session=<LOZ86KRDnrRKUi8D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 22:23:27 host2 sshd[889093]: Disconnected from invalid user user 2.57.121.25 port 33271 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 22:23:48 host2 sshd[889227]: Disconnected from invalid user ubnt 2.57.121.112 port 62513 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.94.63
country_id: 1269750
description:
Nov 15 22:24:54 host2 sshd[889805]: Invalid user cloudtourssrilan_travel from 139.59.94.63 port 34658


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-11-15 22:26:07 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:39954: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-15 22:26:14 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:33784: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.204
country_id: 6252001
description:
Nov 15 22:31:36 host2 pure-ftpd[893981]: (?@198.235.24.204) [INFO] New connection from 198.235.24.204


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov 15 22:32:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WPqFFaVDIoJAPpyY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Nov 15 22:33:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.152, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2xXEFqVDusJAPpyY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov 15 22:40:28 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, session=<DF/bMKVDCAjCpRCl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 15 23:04:16 host2 sshd[913301]: Disconnected from invalid user admin 2.57.121.112 port 21743 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.86
country_id: 2635167
description:
Nov 15 23:04:29 host2 pure-ftpd[913391]: (?@185.247.137.86) [INFO] New connection from 185.247.137.86


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.141.27.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.141.27.202 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.130.100.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.130.100.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.144.59.4
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 35.144.59.4 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2025-11-15 23:08:27 dovecot_login authenticator failed for (aes-static-217.70.22.125.airtel.in) [27.123.101.146]:47128: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.30.127.82
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.30.127.82 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.32.184.9
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.32.184.9 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.85
country_id: 3996063
description:
2025-11-15 23:08:07 dovecot_login authenticator failed for (201.172.88.85-clientes-izzi.mx) [201.172.88.85]:57760: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.103
country_id: 3017382
description:
Nov 15 23:12:43 host2 pure-ftpd[918416]: (?@91.196.152.103) [INFO] New connection from 91.196.152.103


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 15 23:16:05 host2 sshd[920431]: Disconnected from invalid user hossein 82.65.43.136 port 54420 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.192.10.162
country_id: 1269750
description:
Nov 15 23:17:41 host2 sshd[921311]: Disconnected from invalid user www 20.192.10.162 port 38350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 15 23:20:44 host2 sshd[923105]: Disconnected from invalid user jkkim 82.65.43.136 port 55160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.192.10.162
country_id: 1269750
description:
Nov 15 23:20:50 host2 sshd[923144]: Disconnected from invalid user ftp_user 20.192.10.162 port 37924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 15 23:22:12 host2 sshd[924193]: Disconnected from invalid user fs 152.32.191.75 port 32888 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 15 23:23:32 host2 sshd[925043]: Disconnected from invalid user test1234 152.32.191.75 port 53464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 15 23:24:05 host2 sshd[925319]: Disconnected from invalid user ftpuser 82.65.43.136 port 55706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-15 23:24:48 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (mulaing) [81.225.30.107]:46656: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.65.43.136
country_id: 3017382
description:
Nov 15 23:26:25 host2 sshd[926763]: Disconnected from invalid user ubuntu 82.65.43.136 port 56080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.191.75
country_id: 1819730
description:
Nov 15 23:26:42 host2 sshd[926900]: Disconnected from invalid user administrator 152.32.191.75 port 52192 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.105.1.252
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.105.1.252 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.134.17.119
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 74.134.17.119 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.56.77.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 108.56.77.93 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.147.210.144
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 132.147.210.144 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.75.102.209
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.75.102.209 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.209.168.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.209.168.251 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.221.36.6
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.221.36.6 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.181.117.224
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.181.117.224 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.223.242.204
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.223.242.204 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.56.123.249
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.56.123.249 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.253.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.253.214 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Nov 15 23:37:04 host2 sshd[932581]: Disconnected from invalid user didi 8.243.64.226 port 56474 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.106.96.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 149.106.96.28 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.60
country_id: 3017382
description:
2025-11-15 23:37:27 dovecot_plain authenticator failed for ([10.17.18.51]) [191.101.31.60]:37563: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Nov 15 23:39:08 host2 sshd[933861]: Disconnected from invalid user asad 8.243.64.226 port 59840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.243.64.226
country_id: 3686110
description:
Nov 15 23:41:06 host2 sshd[935197]: Disconnected from invalid user discord 8.243.64.226 port 37940 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.212.105
country_id: 2921044
description:
Nov 15 23:44:06 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.59.212.105, lip=66.85.158.92, session=<FAFrFKZDZ3KLO9Rp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Nov 15 23:43:46 host2 sshd[936539]: Disconnected from invalid user int 8.243.64.226 port 37768 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.212.105
country_id: 2921044
description:
Nov 15 23:44:07 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.59.212.105, lip=66.85.158.92, session=<+5eBFKZDZT+LO9Rp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.122.8
country_id: 2921044
description:
Nov 15 23:44:09 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.232.122.8, lip=66.85.158.92, session=<4EOUFKZDHpal6HoI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.64.226
country_id: 3686110
description:
Nov 15 23:45:10 host2 sshd[937836]: Disconnected from invalid user dbseller 8.243.64.226 port 35638 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 15 23:47:55 host2 sshd[939508]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-11-15 23:48:39 dovecot_login authenticator failed for (nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:40654: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-11-15 23:48:54 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:32829: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.182.90.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.182.90.51 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.10.186.37
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.10.186.37 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.84.47.218
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.84.47.218 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.185.21.43
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 65.185.21.43 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.30.121.46
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.30.121.46 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 8.17.60.146
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 8.17.60.146 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.146.67.162
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 206.146.67.162 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 15 23:59:38 host2 sshd[946736]: Disconnected from invalid user user 2.57.121.25 port 18441 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 00:02:29 host2 sshd[948457]: Disconnected from invalid user admin 2.57.121.112 port 61947 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.109.17
country_id: 6252001
description:
Nov 16 00:03:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.33.109.17, lip=66.85.158.91, session=<GsZ+WqZDnMUtIW0R>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.166.31
country_id: 2635167
description:
Nov 16 00:11:45 host2 sshd[954786]: Disconnected from invalid user system 138.68.166.31 port 57010 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 16 00:13:38 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1P0MfqZDi/4t4/6c>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.166.31
country_id: 2635167
description:
Nov 16 00:17:01 host2 sshd[959149]: Disconnected from invalid user rocco 138.68.166.31 port 55536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.166.31
country_id: 2635167
description:
Nov 16 00:18:08 host2 sshd[960079]: Disconnected from invalid user vpn 138.68.166.31 port 55242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.0.4
country_id: 3469034
description:
Nov 16 00:20:38 host2 sshd[961914]: Disconnected from invalid user btest 170.80.0.4 port 52829 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.33.160.20
country_id: 3175395
description:
Nov 16 00:21:20 host2 sshd[962232]: Disconnected from invalid user localhost 84.33.160.20 port 51684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.0.229
country_id: 690791
description:
Nov 16 00:21:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=176.103.0.229, lip=66.85.158.91, TLS, session=<1hq3mKZDtsqwZwDl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.65
country_id: 953987
description:
Nov 16 00:21:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.60.65, lip=66.85.158.91, TLS, session=<liPimaZDDtRmgTxB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.80.0.4
country_id: 3469034
description:
Nov 16 00:24:05 host2 sshd[963499]: Disconnected from invalid user user01 170.80.0.4 port 57241 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 00:25:27 host2 sshd[964416]: Disconnected from invalid user admin 2.57.121.112 port 63556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.144.138
country_id: 6252001
description:
Nov 16 00:26:26 host2 sshd[965027]: Disconnected from invalid user localhost 146.190.144.138 port 38616 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.232
country_id: 6252001
description:
Nov 16 00:29:50 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.232, lip=66.85.158.92, TLS, session=<AYv1t6ZDIuhHBobo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.144.138
country_id: 6252001
description:
Nov 16 00:30:27 host2 sshd[967372]: Disconnected from invalid user test 146.190.144.138 port 42894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.53.220.26
country_id: 1605651
description:
Nov 16 00:31:00 host2 sshd[967602]: Disconnected from invalid user spectrum 182.53.220.26 port 54844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.53.220.26
country_id: 1605651
description:
Nov 16 00:35:03 host2 sshd[969645]: Disconnected from invalid user vikash 182.53.220.26 port 57126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.53.220.26
country_id: 1605651
description:
Nov 16 00:36:22 host2 sshd[970530]: Disconnected from invalid user mirco 182.53.220.26 port 56754 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.238.49
country_id: 2921044
description:
Nov 16 00:36:47 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=164.90.238.49, lip=66.85.158.91, TLS, session=<pPrO0KZDwiykWu4x>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.53.220.26
country_id: 1605651
description:
Nov 16 00:37:40 host2 sshd[971121]: Disconnected from invalid user user1 182.53.220.26 port 50298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.144.138
country_id: 6252001
description:
Nov 16 00:38:17 host2 sshd[971562]: Disconnected from invalid user teamspeak 146.190.144.138 port 51846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.144.138
country_id: 6252001
description:
Nov 16 00:42:13 host2 sshd[973813]: Disconnected from invalid user rocketmq 146.190.144.138 port 35932 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.144.138
country_id: 6252001
description:
Nov 16 00:44:10 host2 sshd[974803]: Disconnected from invalid user liuhao 146.190.144.138 port 42274 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.236.189.117
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.236.189.117 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.160.176.149
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.160.176.149 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.93.210.114
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.93.210.114 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.10.11.45
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 24.10.11.45 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.46.219.194
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.46.219.194 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.136.7.81
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.136.7.81 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.181.25.155
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 69.181.25.155 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.11
country_id: 1512440
description:
Nov 16 00:51:26 host2 sshd[979235]: Disconnected from invalid user szy 194.107.115.11 port 35544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.75
country_id: 3175395
description:
Nov 16 00:54:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=217.26.179.75, lip=66.85.158.91, TLS, session=<1w1aDadDcODZGrNL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.11
country_id: 1512440
description:
Nov 16 00:53:12 host2 sshd[980083]: Disconnected from invalid user vivek 194.107.115.11 port 12016 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.20.66.206
country_id: 783754
description:
Nov 16 00:53:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=84.20.66.206, lip=66.85.158.91, TLS, session=<78tNDKdDo41UFELO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.11
country_id: 1512440
description:
Nov 16 00:56:25 host2 sshd[982681]: Disconnected from invalid user test 194.107.115.11 port 19336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-16 00:57:00 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:56928: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.199.98
country_id: 2077456
description:
2025-11-16 00:57:15 dovecot_login authenticator failed for 111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:60354: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-16 00:57:34 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:44404: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.11
country_id: 1512440
description:
Nov 16 01:02:38 host2 sshd[986097]: Disconnected from invalid user leo 194.107.115.11 port 33944 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.58.242
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.151.58.242 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.187.191.54
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.187.191.54 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.215.59.203
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.215.59.203 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.104.186.124
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.104.186.124 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.246.34.61
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.246.34.61 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.44.9.172
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.44.9.172 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.74.13
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.32.74.13 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 01:08:33 host2 sshd[989530]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.98.99.149
country_id: 3077311
description:
Nov 16 01:15:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=176.98.99.149, lip=66.85.158.91, TLS, session=<SE/8WKdD4pKwYmOV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.117.178.90
country_id: 2510769
description:
Nov 16 01:15:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=91.117.178.90, lip=66.85.158.91, TLS, session=<B1QWWqdDeqdbdbJa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 01:23:26 host2 sshd[998199]: Disconnected from invalid user shannon 62.60.131.157 port 15129 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 01:25:08 host2 sshd[999598]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Nov 16 01:32:33 host2 sshd[1003997]: Disconnected from invalid user beth 123.58.213.127 port 50012 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 01:34:56 host2 sshd[1005075]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.127
country_id: 1819730
description:
Nov 16 01:36:48 host2 sshd[1006272]: Disconnected from invalid user backupuser 123.58.213.127 port 47630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 01:39:31 host2 sshd[1007520]: Disconnected from invalid user shannon 62.60.131.157 port 15018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Nov 16 01:39:47 host2 sshd[1007705]: Disconnected from invalid user marek 123.58.213.127 port 35388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.127
country_id: 1819730
description:
Nov 16 01:44:13 host2 sshd[1010169]: Disconnected from invalid user devel 123.58.213.127 port 35468 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.240.121.215
country_id: 2802361
description:
Nov 16 01:45:56 host2 pure-ftpd[1011646]: (?@35.240.121.215) [INFO] New connection from 35.240.121.215


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 01:48:10 host2 sshd[1013112]: Disconnected from invalid user  2.57.121.112 port 62182 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2025-11-16 01:48:55 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:60244: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-11-16 01:48:19 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:45396: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.87.107.195
country_id: 1269750
description:
Nov 16 01:52:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.87.107.195, lip=66.85.158.91, TLS, session=<vbLp3qdDsZtnV2vD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.43
country_id: 2300660
description:
Nov 16 01:52:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=41.139.47.43, lip=66.85.158.91, TLS, session=<RWMq4KdDxN0piy8r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.198.7
country_id: 2264397
description:
Nov 16 01:59:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.226.198.7, lip=66.85.158.92, TLS, session=<Jx7f96dDHaO54sYH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.226.198.7
country_id: 2264397
description:
Nov 16 01:59:02 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.226.198.7, lip=66.85.158.92, TLS, session=<wA739qdDWbm54sYH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.198.4
country_id: 2264397
description:
Nov 16 01:59:05 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.226.198.4, lip=66.85.158.92, TLS, session=<2zAl96dDkIa54sYE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.198.6
country_id: 2264397
description:
Nov 16 01:59:06 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.226.198.6, lip=66.85.158.92, TLS, session=<0Pc296dDqaO54sYG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.226.198.5
country_id: 2264397
description:
Nov 16 01:59:10 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.226.198.5, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<tEt296dDJ6u54sYF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-16 02:06:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49297: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.190.31
country_id: 1819730
description:
Nov 16 02:10:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.190.31, lip=66.85.158.91, session=<kFmwHqhDLOGYIL4f>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-16 02:11:21 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:35177: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.13.91.157
country_id: 3077311
description:
Nov 16 02:13:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=85.13.91.157, lip=66.85.158.91, TLS, session=<J6jxKqhDsL5VDVud>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.120
country_id: 798544
description:
Nov 16 02:14:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=91.228.33.120, lip=66.85.158.91, TLS, session=<LCf6K6hDLt5b5CF4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 16 02:17:48 host2 sshd[1031591]: Disconnected from invalid user material 79.61.112.234 port 44270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 16 02:23:10 host2 sshd[1034646]: Disconnected from invalid user rdp 79.61.112.234 port 34340 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 16 02:24:23 host2 sshd[1035274]: Disconnected from invalid user steam 79.61.112.234 port 34514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 16 02:26:41 host2 sshd[1036984]: Disconnected from invalid user iptv 79.61.112.234 port 34854 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.58.209.243
country_id: 1819730
description:
Nov 16 02:30:09 host2 pure-ftpd[1039094]: (?@123.58.209.243) [INFO] New connection from 123.58.209.243


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Nov 16 02:33:11 host2 sshd[1040912]: Disconnected from invalid user opsadmin 20.123.120.169 port 34786 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.35.67.75
country_id: 831053
description:
[2025-11-16 02:35:25 +0530] info [cpaneld] 37.35.67.75 - dragon "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.120.169
country_id: 2963597
description:
Nov 16 02:35:44 host2 sshd[1042485]: Disconnected from invalid user rancid 20.123.120.169 port 50252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.120.169
country_id: 2963597
description:
Nov 16 02:38:29 host2 sshd[1044258]: Disconnected from invalid user gautam 20.123.120.169 port 58558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-11-16 02:38:39 dovecot_plain authenticator failed for (molie) [46.10.210.68]:43112: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-11-16 02:40:50 +0530] info [whostmgrd] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-11-16 02:43:00 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (fretted) [68.38.201.238]:33954: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.251.104
country_id: 298795
description:
2025-11-16 02:43:02 dovecot_plain authenticator failed for (procculams) [5.11.251.104]:58839: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2025-11-16 02:51:05 dovecot_plain authenticator failed for ool-457e901e.dyn.optonline.net (pated) [69.126.144.30]:59613: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.95.200.219
country_id: 798544
description:
Nov 16 02:55:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=109.95.200.219, lip=66.85.158.91, TLS, session=<MSKEv6hDLMttX8jb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 02:56:06 host2 sshd[1055923]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.171.78.39
country_id: 3686110
description:
Nov 16 02:55:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=190.171.78.39, lip=66.85.158.91, TLS, session=<QAOqwKhDuca+q04n>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 03:01:50 host2 sshd[1059716]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 03:04:47 host2 sshd[1062071]: Disconnected from invalid user admin 2.57.121.112 port 44519 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 03:11:35 host2 sshd[1067082]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.90.56.89
country_id: 6252001
description:
2025-11-16 03:18:46 dovecot_login authenticator failed for h89.56.90.75.dynamic.ip.windstream.net [75.90.56.89]:33036: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-11-16 03:19:08 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (sitic) [73.176.157.57]:47468: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.64.207.52
country_id: 6252001
description:
2025-11-16 03:19:41 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:34288: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.231.89.218
country_id: 2077456
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 103.231.89.218 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.141.145
country_id: 2661886
description:
2025-11-16 03:26:23 dovecot_login authenticator failed for 95.209.141.145.bredband.tre.se [95.209.141.145]:42918: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-16 03:26:38 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:38001: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 03:31:23 host2 sshd[1080534]: Disconnected from invalid user deasia 62.60.131.157 port 13206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Nov 16 03:34:41 host2 sshd[1082386]: Disconnected from invalid user dev 202.165.22.246 port 45884 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.81.18.103
country_id: 2921044
description:
Nov 16 03:35:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=206.81.18.103, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<44VvUalDfZ7OURJn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.238.49
country_id: 2921044
description:
Nov 16 03:36:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.90.238.49, lip=66.85.158.91, TLS handshaking: Connection closed, session=<kKKJU6lDqDOkWu4x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.131.12
country_id: 690791
description:
Nov 16 03:37:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=37.221.131.12, lip=66.85.158.91, TLS, session=<hOVVVKlD3YQl3YMM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.249.37.25
country_id: 3469034
description:
Nov 16 03:37:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<jagath.peiris>, method=PLAIN, rip=167.249.37.25, lip=66.85.158.91, TLS, session=<RwgkVqlDbNen+SUZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Nov 16 03:41:24 host2 sshd[1086851]: Disconnected from invalid user admin 202.165.22.246 port 33266 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.22.246
country_id: 1733045
description:
Nov 16 03:42:46 host2 sshd[1087504]: Disconnected from invalid user username 202.165.22.246 port 34452 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.177
country_id: 6252001
description:
Nov 16 03:43:22 host2 pure-ftpd[1087849]: (?@147.185.132.177) [INFO] New connection from 147.185.132.177


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.5
country_id: 3175395
description:
Nov 16 03:43:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=217.26.179.5, lip=66.85.158.91, TLS, session=<bYhMbKlDdZ3ZGrMF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.79
country_id: 3469034
description:
Nov 16 03:44:04 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=177.44.71.79, lip=66.85.158.91, TLS, session=<Qd52balDLtSxLEdP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Nov 16 03:44:06 host2 sshd[1088260]: Disconnected from invalid user kn 202.165.22.246 port 35636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Nov 16 03:45:28 host2 sshd[1089797]: Disconnected from invalid user user1 202.165.22.246 port 36822 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.25.213
country_id: 2921044
description:
Nov 16 03:49:50 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.22.25.213, lip=66.85.158.92, TLS, session=<ZI0/g6lD5BKlFhnV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-11-16 03:55:31 dovecot_plain authenticator failed for 2.135.31.74.dynamic.telecom.kz (threcia) [2.135.31.74]:51786: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.83
country_id: 6252001
description:
Nov 16 03:57:44 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.83, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hZR1n6lDotLN0h9T>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-11-16 04:00:03 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:35141: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.29.40
country_id: 290557
description:
2025-11-16 04:00:25 dovecot_login authenticator failed for ([91.74.29.40]) [91.74.29.40]:51110: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-11-16 04:00:35 dovecot_plain authenticator failed for (bruen) [94.206.93.90]:34212: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Nov 16 04:05:08 host2 sshd[1105835]: Disconnected from invalid user share 128.1.132.137 port 53314 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 16 04:05:11 host2 pure-ftpd[1105894]: (?@45.227.254.156) [INFO] New connection from 45.227.254.156


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 16 04:07:34 host2 sshd[1108070]: Disconnected from invalid user a 159.223.8.81 port 45246 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.132.137
country_id: 1819730
description:
Nov 16 04:10:31 host2 sshd[1110825]: Disconnected from invalid user vpn 128.1.132.137 port 56994 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.201.204
country_id: 6251999
description:
Nov 16 04:10:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=128.203.201.204, lip=66.85.158.92, session=<XNMnzqlDgImAy8nM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 16 04:10:49 host2 sshd[1111073]: Disconnected from invalid user diego 159.223.8.81 port 48312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Nov 16 04:11:44 host2 sshd[1112146]: Disconnected from invalid user admin 128.1.132.137 port 50612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 16 04:15:07 host2 sshd[1115878]: Disconnected from invalid user vipin 159.223.8.81 port 40858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 16 04:18:14 host2 sshd[1119372]: Disconnected from invalid user share 159.223.8.81 port 35842 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.58
country_id: 6252001
description:
Nov 16 04:20:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.58, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<eCJQ76lDpNfG6xg6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 16 04:19:18 host2 sshd[1120464]: Disconnected from invalid user andrey 159.223.8.81 port 49088 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.15
country_id: 1733045
description:
2025-11-16 04:20:37 dovecot_login authenticator failed for ([49.124.153.15]) [49.124.153.15]:53230: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.12.240.184
country_id: 6252001
description:
Nov 16 04:27:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.12.240.184, lip=66.85.158.91, session=<PYtpCqpDgqsUDPC4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.84
country_id: 6252001
description:
Nov 16 04:28:42 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.84, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<D/I2DqpDJoOH7X5U>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 16 04:32:19 host2 sshd[1135527]: Disconnected from invalid user singh 152.32.218.244 port 47406 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.200.53
country_id: 2921044
description:
Nov 16 04:33:34 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.92.200.53, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<HaabH6pDF9OkXMg1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.69.80.240
country_id: 3175395
description:
Nov 16 04:33:43 host2 sshd[1137294]: Disconnected from invalid user singh 151.69.80.240 port 55462 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.184.19
country_id: 2921044
description:
Nov 16 04:34:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.90.184.19, lip=66.85.158.92, TLS handshaking: Connection closed, session=<lpm2IapDbiGkWrgT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.174.248
country_id: 6252001
description:
Nov 16 04:35:02 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.124.174.248, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ssjfJKpDluIofK74>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.57
country_id: 3469034
description:
Nov 16 04:36:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.44.71.57, lip=66.85.158.91, TLS, session=<C9RJKqpD48KxLEc5>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.69.80.240
country_id: 3175395
description:
Nov 16 04:37:46 host2 sshd[1139666]: Disconnected from invalid user nodejs 151.69.80.240 port 54094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.65.4
country_id: 1269750
description:
Nov 16 04:37:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=103.58.65.4, lip=66.85.158.91, TLS, session=<AEGPK6pDop5nOkEE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 16 04:37:38 host2 sshd[1139608]: Disconnected from invalid user k8s 152.32.218.244 port 45780 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 04:38:22 host2 sshd[1140001]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 16 04:40:16 host2 sshd[1141074]: Disconnected from invalid user dev 152.32.218.244 port 44460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.69.80.240
country_id: 3175395
description:
Nov 16 04:40:33 host2 sshd[1141312]: Disconnected from invalid user user 151.69.80.240 port 38804 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.244
country_id: 1880251
description:
Nov 16 04:42:44 host2 sshd[1142574]: Disconnected from invalid user rmartinez 152.32.218.244 port 43150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.101.178
country_id: 6252001
description:
Nov 16 04:44:04 host2 sshd[1143348]: Disconnected from invalid user tester 104.168.101.178 port 52532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.101.178
country_id: 6252001
description:
Nov 16 04:45:33 host2 sshd[1144973]: Disconnected from invalid user fns 104.168.101.178 port 56448 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.101.178
country_id: 6252001
description:
Nov 16 04:46:57 host2 sshd[1145748]: Disconnected from invalid user cma 104.168.101.178 port 53120 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 04:48:08 host2 sshd[1146364]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 04:58:13 host2 sshd[1152424]: Disconnected from invalid user hadoop 147.182.173.108 port 45400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.22
country_id: 3175395
description:
Nov 16 04:59:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=217.26.178.22, lip=66.85.158.91, TLS, session=<OfQ6e6pDX+TZGrIW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.122
country_id: 953987
description:
Nov 16 04:59:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.129.51.122, lip=66.85.158.91, TLS, session=<xE6IfKpD/uFmgTN6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:02:48 host2 sshd[1155855]: Disconnected from invalid user pool 147.182.173.108 port 52090 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:03:55 host2 sshd[1156990]: Disconnected from invalid user psn 147.182.173.108 port 36670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:07:11 host2 sshd[1159228]: Disconnected from invalid user ubuntu 147.182.173.108 port 44496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.170.82
country_id: 3469034
description:
Nov 16 05:08:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.130.170.82, lip=66.85.158.91, TLS, session=<KdF1mqpDeuOxgqpS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Nov 16 05:08:16 host2 sshd[1159964]: Disconnected from invalid user botuser 147.182.173.108 port 44646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.205.89
country_id: 3175395
description:
Nov 16 05:08:33 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=109.70.205.89, lip=66.85.158.91, TLS, session=<kvCmm6pDCZ9tRs1Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.226.88.121
country_id: 2661886
description:
2025-11-16 05:11:36 dovecot_plain authenticator failed for 81-226-88-121-no600.tbcn.telia.com (storoed) [81.226.88.121]:47256: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:12:30 host2 sshd[1162526]: Disconnected from invalid user pool 45.78.198.115 port 44470 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:15:11 host2 sshd[1164068]: Disconnected from invalid user botuser 45.78.198.115 port 47708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-11-16 05:16:10 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:39155: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.143
country_id: 732800
description:
Nov 16 05:16:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.255.212.143, lip=66.85.158.91, TLS, session=<1WmluKpDR+G5/9SP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.173
country_id: 3175395
description:
Nov 16 05:16:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=185.197.9.173, lip=66.85.158.91, TLS, session=<deW/uapDBb+5xQmt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-11-16 05:16:24 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:43765: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:20:23 host2 sshd[1167164]: Disconnected from invalid user gmodserver 45.78.198.115 port 47210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-16 05:23:25 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (kagial) [73.195.211.98]:47856: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 05:30:21 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:46918: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.115
country_id: 1880251
description:
Nov 16 05:30:55 host2 sshd[1173667]: Disconnected from invalid user ubuntu 45.78.198.115 port 57298 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 05:34:05 host2 sshd[1175572]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.148
country_id: 1269750
description:
Nov 16 05:37:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=103.51.223.148, lip=66.85.158.91, TLS, session=<E4DAAqtDeM9nM9+U>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.223
country_id: 3865483
description:
Nov 16 05:37:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=190.181.97.223, lip=66.85.158.91, TLS, session=<cJr9A6tDer2+tWHf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2025-11-16 05:41:13 +0530] info [cpaneld] 38.35.225.197 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2025-11-16 05:41:47 dovecot_login authenticator failed for (nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:45292: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.90
country_id: 1269750
description:
2025-11-16 05:42:05 dovecot_login authenticator failed for ([125.19.175.128]) [27.123.112.90]:35596: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-11-16 05:42:20 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:45848: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.115
country_id: 6252001
description:
Nov 16 05:46:28 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.115, lip=66.85.158.91, session=<4cJdJKtDkPqs7ORz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 05:48:13 host2 sshd[1184318]: Disconnected from invalid user trisha 62.60.131.157 port 48593 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-16 05:48:20 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56177: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.250.168
country_id: 2921044
description:
Nov 16 05:51:34 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.248.250.168, lip=66.85.158.92, TLS, session=<Q1uVNqtDUKxo+Pqo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.199
country_id: 3469034
description:
Nov 16 06:00:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<training@v-deploy.com>, method=PLAIN, rip=177.44.96.199, lip=66.85.158.91, TLS, session=<4tvSVatD79GxLGDH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.51
country_id: 953987
description:
Nov 16 06:01:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<training>, method=PLAIN, rip=102.129.54.51, lip=66.85.158.91, TLS, session=<jMWHV6tDn4hmgTYz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 06:01:19 host2 sshd[1192448]: Disconnected from invalid user trisha 62.60.131.157 port 7664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2025-11-16 06:11:56 dovecot_login authenticator failed for (179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:43281: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.46
country_id: 3175395
description:
Nov 16 06:13:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.197.9.46, lip=66.85.158.91, TLS, session=<UpH7hKtDH9m5xQku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.110
country_id: 3175395
description:
Nov 16 06:14:05 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=217.26.179.110, lip=66.85.158.91, TLS, session=<7OsahqtDOsbZGrNu>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 06:14:59 host2 sshd[1201992]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:16:39 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:37159: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.189
country_id: 6252001
description:
Nov 16 06:19:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.189, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<pToFm6tDl8eTuYS9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:21:52 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:13224: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 06:24:46 host2 sshd[1207713]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:26:37 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:21096: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
country_id: 6252001
description:
2025-11-16 06:30:50 dovecot_login authenticator failed for wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:59090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:31:42 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:45311: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-16 06:31:52 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:60558: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-16 06:31:37 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:45181: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.33.75
country_id: 953987
description:
Nov 16 06:34:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.33.75, lip=66.85.158.91, TLS, session=<8LqIz6tDdopmQCFL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.213.126
country_id: 798544
description:
Nov 16 06:34:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=91.246.213.126, lip=66.85.158.91, TLS, session=<xf/D0KtDHdpb9tV+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-16 06:36:47 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:47283: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 06:40:44 host2 sshd[1218636]: Disconnected from invalid user user 2.57.121.25 port 28803 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:42:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<D0Z57KtDfJUDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:42:26 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<Io9+7KtDipUDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:45:13 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<WKt59qtDtuADiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:45:22 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<gbQC96tDZI0DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-16 06:46:23 dovecot_plain authenticator failed for (somatonsit) [102.53.15.17]:35734: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:47:11 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<2Fd6/atDCqkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 16 06:49:22 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<QUdRBaxDAKwDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 06:50:19 host2 sshd[1225617]: Disconnected from invalid user user 2.57.121.25 port 32625 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 06:51:15 host2 sshd[1226169]: Disconnected from invalid user admin 2.57.121.112 port 62195 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-16 06:51:31 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:35167: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-16 06:51:56 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:43515: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 06:56:24 host2 sshd[1230470]: Disconnected from invalid user admin 2.57.121.112 port 58890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 06:57:12 host2 sshd[1230986]: Disconnected from invalid user admin 2.57.121.112 port 62047 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:02:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<MXsuNKxDhq4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:04:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<ktl9PKxDXJIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:06:26 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<exJZQqxDtKgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:07:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<uWYRRqxDFs4DgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:07:46 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<rYUXR6xD9oEDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 16 07:09:24 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<0gTtTKxDyIUDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.3
country_id: 1269750
description:
Nov 16 07:12:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=103.51.223.3, lip=66.85.158.91, TLS, session=<n+ukVqxDUpBnM98D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.52.52
country_id: 3469034
description:
Nov 16 07:12:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=170.82.52.52, lip=66.85.158.91, TLS, session=<KC3tV6xDPtmqUjQ0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.184.226.126
country_id: 3865483
description:
Nov 16 07:13:03 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.184.226.126, lip=66.85.158.91, TLS, session=<eoDdWKxD4uS+uOJ+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.40
country_id: 1269750
description:
Nov 16 07:13:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=45.118.34.40, lip=66.85.158.91, TLS, session=<SUghWqxDTIEtdiIo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:15:58 host2 sshd[1242468]: Disconnected from invalid user ventas05 83.168.78.153 port 40250 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.151
country_id: 3865483
description:
Nov 16 07:16:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=190.181.101.151, lip=66.85.158.91, TLS, session=<RNNkY6xDppq+tWWX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.85
country_id: 2510769
description:
Nov 16 07:16:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.214.138.85, lip=66.85.158.91, TLS, session=<CWiVZKxDF8251opV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:19:50 host2 sshd[1244621]: Disconnected from invalid user joshua 83.168.78.153 port 44754 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:21:03 host2 sshd[1245466]: Disconnected from invalid user lee 83.168.78.153 port 44268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.78.153
country_id: 798544
description:
Nov 16 07:23:30 host2 sshd[1246843]: Disconnected from invalid user admin 83.168.78.153 port 54360 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov 16 07:23:31 host2 pure-ftpd[1246874]: (?@66.132.153.127) [INFO] New connection from 66.132.153.127


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:26:14 host2 sshd[1248549]: Disconnected from invalid user rolando 150.230.211.198 port 35150 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.103
country_id: 6252001
description:
Nov 16 07:31:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.103, lip=66.85.158.91, TLS, session=<UWVQnaxDYu7N0h9n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-16 07:36:10 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:40254: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-16 07:36:24 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:39607: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:42:34 host2 sshd[1256276]: Disconnected from invalid user no-reply 150.230.211.198 port 40928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Nov 16 07:43:56 host2 sshd[1257008]: Disconnected from invalid user action 196.188.120.232 port 58896 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.66
country_id: 6252001
description:
Nov 16 07:44:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.66, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fQe6y6xDz8uTuYRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 07:44:57 host2 sshd[1258055]: Disconnected from invalid user newuser 41.33.225.154 port 10055 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.34
country_id: 6251999
description:
Nov 16 07:44:25 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.34, lip=66.85.158.92, session=<JFEoyqxDqspWNh8i>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:46:35 host2 sshd[1259051]: Disconnected from invalid user marina 150.230.211.198 port 50598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Nov 16 07:46:48 host2 sshd[1259155]: Disconnected from invalid user rstudio 196.188.120.232 port 33290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.230.211.198
country_id: 1861060
description:
Nov 16 07:48:38 host2 sshd[1260069]: Disconnected from invalid user sysadmin 150.230.211.198 port 51788 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 07:51:58 host2 sshd[1262065]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.188.120.232
country_id: 337996
description:
Nov 16 07:52:04 host2 sshd[1262137]: Disconnected from invalid user terraria 196.188.120.232 port 53008 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Nov 16 07:51:53 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, session=<Hgzf5KxDNsA2rEyT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov 16 07:53:50 host2 pure-ftpd[1263050]: (?@66.132.153.127) [INFO] New connection from 66.132.153.127


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 07:59:36 host2 sshd[1267281]: Disconnected from invalid user sanjay 41.33.225.154 port 39529 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 08:01:47 host2 sshd[1268667]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 08:04:59 host2 sshd[1271267]: Disconnected from invalid user snq 41.33.225.154 port 9605 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.33.225.154
country_id: 357994
description:
Nov 16 08:08:37 host2 sshd[1273842]: Disconnected from invalid user pierre 41.33.225.154 port 33328 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-16 08:10:05 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:46626: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-11-16 08:09:16 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:33264: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.195
country_id: 3175395
description:
Nov 16 08:16:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=171.22.235.195, lip=66.85.158.91, TLS, session=<73UuOq1DA+KrFuvD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.216.251
country_id: 99237
description:
Nov 16 08:16:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=65.20.216.251, lip=66.85.158.91, TLS, session=<vo1MO61Du+RBFNj7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.233.177.188
country_id: 6252001
description:
2025-11-16 08:19:42 dovecot_login authenticator failed for (188.177.233.68.naturalwireless.com) [68.233.177.188]:59140: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-11-16 08:20:06 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:63804: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.234
country_id: 1880251
description:
Nov 16 08:25:08 host2 sshd[1284796]: Disconnected from invalid user bitcoin 45.78.206.234 port 40582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-11-16 08:26:39 dovecot_plain authenticator failed for (legratobs) [2.55.122.202]:60416: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.204.217.146
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 151.204.217.146 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.49
country_id: 6252001
description:
Nov 16 08:30:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.49, lip=66.85.158.92, TLS, session=<mP28b61DYPDG6xgx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 08:32:55 host2 sshd[1288990]: Disconnected from invalid user  2.57.121.112 port 61478 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.222.160.62
country_id: 1880251
description:
Nov 16 08:33:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=8.222.160.62, lip=66.85.158.91, session=<MlRbeK1DhFMI3qA+>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 16 08:33:44 host2 sshd[1289385]: Disconnected from invalid user git 89.97.218.142 port 49454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 16 08:34:50 host2 sshd[1289879]: Disconnected from invalid user victor 89.97.218.142 port 49476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.97.218.142
country_id: 3175395
description:
Nov 16 08:36:53 host2 sshd[1291301]: Disconnected from invalid user piyush 89.97.218.142 port 49508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.10
country_id: 6252001
description:
Nov 16 08:38:45 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=162.216.150.10, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<gw9zjK1Dn8qi2JYK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.10
country_id: 6252001
description:
Nov 16 08:39:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.10, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<TJ7Cj61DJOui2JYK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.108
country_id: 6252001
description:
Nov 16 08:41:43 host2 pure-ftpd[1294023]: (?@64.62.156.108) [INFO] New connection from 64.62.156.108


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.10
country_id: 6252001
description:
Nov 16 08:43:48 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.10, lip=66.85.158.92, TLS, session=<2NuLnq1DVOyi2JYK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 16 08:56:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<m/BbzK1Dts42xDDo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.165
country_id: 6252001
description:
Nov 16 08:57:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.165, lip=66.85.158.91, TLS, session=<gQR2z61DHPLG6xil>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.12
country_id: 6252001
description:
Nov 16 08:57:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.12, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Roe60K1DlNWTuYQM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-11-16 08:58:25 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:58305: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.234
country_id: 1880251
description:
Nov 16 08:58:29 host2 sshd[1304381]: Disconnected from invalid user git 45.78.206.234 port 44522 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 16 09:00:43 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.92, session=<FRgJ261D/Mc2xDDo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.194
country_id: 6252001
description:
Nov 16 09:02:34 host2 pure-ftpd[1306472]: (?@198.235.24.194) [INFO] New connection from 198.235.24.194


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov 16 09:09:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, TLS, session=<gOZg+a1D6IwD7a3c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-16 09:09:19 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:53416: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-16 09:09:26 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:47496: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 16 09:11:55 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=51.159.234.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<w+IaA65DlJczn+p2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-11-16 09:11:34 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:61578: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.159.234.118
country_id: 2750405
description:
Nov 16 09:11:55 host2 pure-ftpd[1312057]: (?@51.159.234.118) [INFO] New connection from 51.159.234.118


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.32.20
country_id: 798544
description:
Nov 16 09:15:13 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=91.228.32.20, lip=66.85.158.91, TLS, session=<9KvxDa5DbOFb5CAU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.54
country_id: 798544
description:
Nov 16 09:15:31 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=178.216.29.54, lip=66.85.158.91, TLS, session=<CYn5Dq5Dt8qy2B02>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2a01:239:213:1900::1
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 2a01:239:213:1900::1 - yashiholdingscom "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdingscom (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.247.137
country_id: 933860
description:
Nov 16 09:23:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=41.76.247.137, lip=66.85.158.91, TLS, session=<0MClKa5DOdspTPeJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.154.205.93
country_id: 2510769
description:
Nov 16 09:23:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.154.205.93, lip=66.85.158.91, TLS, session=<vkfUKq5D5M65ms1d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-16 09:27:05 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59336: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.88
country_id: 3175395
description:
Nov 16 09:34:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.124.182.88, lip=66.85.158.91, TLS, session=<BrHNUq5D6KS5fLZY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.59
country_id: 3175395
description:
Nov 16 09:34:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=185.208.189.59, lip=66.85.158.91, TLS, session=<oVroU65DvcS50L07>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-11-16 09:42:41 dovecot_login authenticator failed for ([182.75.152.97]) [27.123.111.110]:35772: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.149.125.227
country_id: 2328926
description:
2025-11-16 09:43:00 dovecot_login authenticator failed for ([197.149.125.227]) [197.149.125.227]:33310: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.215.115.239
country_id: 6252001
description:
[2025-11-16 09:44:53 +0530] info [whostmgrd] 32.215.115.239 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.34.132.221
country_id: 2802361
description:
Nov 16 09:45:39 host2 pure-ftpd[1328734]: (?@34.34.132.221) [INFO] New connection from 34.34.132.221


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.34.132.221
country_id: 2802361
description:
Nov 16 09:47:03 host2 pure-ftpd[1329259]: (?@34.34.132.221) [INFO] New connection from 34.34.132.221


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.7.22
country_id: 1880251
description:
2025-11-16 09:48:54 dovecot_login authenticator failed for bb121-7-7-22.singnet.com.sg [121.7.7.22]:60550: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-11-16 09:49:12 dovecot_login authenticator failed for (14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:55213: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.189
country_id: 1668284
description:
Nov 16 09:50:46 host2 sshd[1330969]: Disconnected from invalid user webuser 103.52.115.189 port 38958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Nov 16 09:51:20 host2 sshd[1331246]: Disconnected from invalid user ymoreno 20.127.224.153 port 53610 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-16 09:54:03 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:37842: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Nov 16 09:54:08 host2 sshd[1332651]: Disconnected from invalid user app 45.78.230.106 port 47748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-16 09:54:17 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:32846: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.249.95
country_id: 798544
description:
Nov 16 09:54:52 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=109.125.249.95, lip=66.85.158.91, TLS, session=<A4y6m65DpaFtfflf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.189
country_id: 1668284
description:
Nov 16 09:55:00 host2 sshd[1333329]: Disconnected from invalid user dci 103.52.115.189 port 46424 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.40
country_id: 3469034
description:
Nov 16 09:55:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris>, method=PLAIN, rip=190.89.137.40, lip=66.85.158.91, TLS, session=<qzh/na5DK8C+WYko>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Nov 16 09:55:56 host2 sshd[1333988]: Disconnected from invalid user cardano 20.127.224.153 port 55698 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.189
country_id: 1668284
description:
Nov 16 09:57:54 host2 sshd[1334692]: Disconnected from invalid user cardano 103.52.115.189 port 40378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.189
country_id: 1668284
description:
Nov 16 09:59:16 host2 sshd[1335461]: Disconnected from invalid user debian 103.52.115.189 port 39748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.127.224.153
country_id: 6252001
description:
Nov 16 09:59:40 host2 sshd[1335556]: Disconnected from invalid user andre 20.127.224.153 port 39620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.127.224.153
country_id: 6252001
description:
Nov 16 10:08:48 host2 sshd[1339950]: Disconnected from invalid user app 20.127.224.153 port 49692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 10:09:22 host2 sshd[1340373]: Disconnected from invalid user user 2.57.121.25 port 33363 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Nov 16 10:09:52 host2 sshd[1340645]: Disconnected from invalid user admin 38.137.11.10 port 8182 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Nov 16 10:15:40 host2 sshd[1343763]: Disconnected from invalid user sara 38.137.11.10 port 11228 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.144.150
country_id: 1269750
description:
2025-11-16 10:16:34 dovecot_login authenticator failed for ([152.52.118.1]) [122.185.144.150]:58784: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-16 10:16:52 dovecot_login authenticator failed for ([158.181.132.86]) [158.181.132.86]:35239: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Nov 16 10:18:52 host2 sshd[1345160]: Disconnected from invalid user sara 45.78.230.106 port 43020 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.240
country_id: 6252001
description:
Nov 16 10:28:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.240, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<dfjnFK9DxMTG6xjw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.231
country_id: 953987
description:
Nov 16 10:30:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=102.129.54.231, lip=66.85.158.91, TLS, session=<+2hqG69DFelmgTbn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.139.5
country_id: 690791
description:
Nov 16 10:30:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=37.221.139.5, lip=66.85.158.91, TLS, session=<fjOlHK9DMZsl3YsF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.106
country_id: 1880251
description:
Nov 16 10:32:01 host2 sshd[1352216]: Disconnected from invalid user user 45.78.230.106 port 47392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.106
country_id: 1880251
description:
Nov 16 10:40:07 host2 sshd[1356028]: Disconnected from invalid user erpnext 45.78.230.106 port 60804 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.108
country_id: 6252001
description:
Nov 16 10:46:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.108, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kFFVVK9DMdTG6xhs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.148
country_id: 953987
description:
Nov 16 10:50:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.47.148, lip=66.85.158.91, TLS, session=<yaXvY69DlaxmQC+U>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.203
country_id: 3175395
description:
Nov 16 10:51:17 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=185.15.171.203, lip=66.85.158.91, TLS, session=<2xlDZa9DD5q5D6vL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.176
country_id: 2635167
description:
Nov 16 10:51:39 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.176, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<FDjFZ69DT9wjy9Ow>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.176
country_id: 2635167
description:
Nov 16 10:52:09 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.211.176, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<mZSQaa9DmPcjy9Ow>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.176
country_id: 2635167
description:
Nov 16 10:53:11 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=35.203.211.176, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<Vho9ba9DUvAjy9Ow>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.176
country_id: 2635167
description:
Nov 16 10:59:39 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.176, lip=66.85.158.91, TLS, session=<g6JmhK9DtOgjy9Ow>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.176
country_id: 2635167
description:
Nov 16 11:00:56 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.176, lip=66.85.158.91, TLS, session=<B1P1iK9Dpusjy9Ow>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Nov 16 11:02:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.91, TLS: Connection closed, session=<l9Atj69D6I5ChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:33:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1Qqm+69D4sADg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:33:10 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<TRxE/K9DSJYDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:34:09 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<yfzH/69DNoIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:35:52 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<KWrfBbBDDogDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:37:08 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<VUdxCrBDJKgDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:38:07 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<En31DbBDdrkDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.134.131
country_id: 1269750
description:
Nov 16 11:38:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.59.134.131, lip=66.85.158.91, TLS, session=<+yX9DrBDU8dnO4aD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.239.148.142
country_id: 3996063
description:
Nov 16 11:39:02 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=170.239.148.142, lip=66.85.158.91, TLS, session=<5xY+ELBDb8Wq75SO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:39:47 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1aTiE7BDcJEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:40:28 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ClVVFrBDsMwDg9cm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.66
country_id: 6252001
description:
Nov 16 11:41:32 host2 pure-ftpd[1386995]: (?@216.218.206.66) [INFO] New connection from 216.218.206.66


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.108
country_id: 298795
description:
Nov 16 11:41:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=45.67.155.108, lip=66.85.158.91, TLS, session=<JSrFGbBDf9wtQ5ts>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:41:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<mCRNG7BDPKYDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.25
country_id: 3175395
description:
Nov 16 11:42:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.208.189.25, lip=66.85.158.91, TLS, session=<8FndGrBDK8O50L0Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 11:42:49 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<U0DFHrBDbpIDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 11:55:56 host2 sshd[1394958]: Disconnected from invalid user yusuf 2.57.121.112 port 61331 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 12:01:50 host2 sshd[1397609]: Disconnected from invalid user yusuf 2.57.121.112 port 63124 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.105
country_id: 6252001
description:
Nov 16 12:26:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.105, lip=66.85.158.91, session=<YQQbu7BDVOPN0h9p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.2.199
country_id: 953987
description:
Nov 16 12:26:37 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.66.2.199, lip=66.85.158.91, TLS, session=<O1courBDX7hmQgLH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.66.114.45
country_id: 1269750
description:
Nov 16 12:26:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=103.66.114.45, lip=66.85.158.91, TLS, session=<+iF6u7BDG4tnQnIt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.47.228.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 73.47.228.111 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.122
country_id: 1819730
description:
Nov 16 12:45:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.122, lip=66.85.158.92, session=<P5wf/bBDgtEtjpp6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.208.138.112
country_id: 2750405
description:
Nov 16 12:48:10 host2 pure-ftpd[1419075]: (?@87.208.138.112) [INFO] New connection from 87.208.138.112


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Nov 16 12:50:43 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.62, lip=66.85.158.91, TLS: Connection closed, session=<SL+VEbFDcDmnXpI+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov 16 12:54:40 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.91, session=<K+a0H7FDSr4D7a3c>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.230.48
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.150.230.48 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 13:05:20 host2 sshd[1428445]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 13:08:03 host2 sshd[1429632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 13:08:33 host2 sshd[1429849]: Disconnected from invalid user joana 62.60.131.157 port 18641 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.52.100
country_id: 953987
description:
Nov 16 13:10:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=102.129.52.100, lip=66.85.158.91, TLS, session=<Xz7cWLFDiaZmgTRk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.246.170.102
country_id: 1269750
description:
Nov 16 13:11:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=103.246.170.102, lip=66.85.158.91, TLS, session=<IgAcWrFDXYNn9qpm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-16 13:12:46 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63559: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.234
country_id: 6252001
description:
Nov 16 13:15:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.234, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<xfY8abFD08LG6xjq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-16 13:28:46 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:41338: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-16 13:29:00 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:36059: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 13:32:06 host2 sshd[1440755]: Disconnected from invalid user user 2.57.121.25 port 24843 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Nov 16 13:36:14 host2 sshd[1442698]: Disconnected from invalid user user 209.141.33.240 port 57794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Nov 16 13:37:20 host2 sshd[1443177]: Disconnected from invalid user vivek 35.200.237.19 port 1106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 16 13:36:45 host2 sshd[1442915]: Disconnected from invalid user test1 132.145.213.106 port 51212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.43.167
country_id: 2750405
description:
Nov 16 13:36:57 host2 sshd[1442989]: Disconnected from invalid user dev 167.172.43.167 port 33906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.102.104.110
country_id: 617790
description:
Nov 16 13:37:19 host2 sshd[1443170]: Disconnected from invalid user god 194.102.104.110 port 46696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.214.205
country_id: 6252001
description:
Nov 16 13:37:36 host2 sshd[1443286]: Disconnected from invalid user test1 192.227.214.205 port 41344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.155.3
country_id: 6252001
description:
Nov 16 13:38:08 host2 sshd[1443530]: Disconnected from invalid user deployer 107.172.155.3 port 37142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Nov 16 13:37:45 host2 sshd[1443359]: Disconnected from invalid user dev 20.185.243.158 port 41278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Nov 16 13:38:55 host2 sshd[1443864]: Disconnected from invalid user jai 64.227.176.54 port 41724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Nov 16 13:39:02 host2 sshd[1443989]: Disconnected from invalid user test1 34.58.124.191 port 39642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.78.171.114
country_id: 1269750
description:
Nov 16 13:39:06 host2 sshd[1444011]: Disconnected from invalid user znc 103.78.171.114 port 36440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 16 13:39:21 host2 sshd[1444120]: Disconnected from invalid user user1 50.232.189.209 port 57492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Nov 16 13:38:32 host2 sshd[1443665]: Disconnected from invalid user test1 117.216.143.31 port 56240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.226.156
country_id: 1269750
description:
Nov 16 13:39:17 host2 sshd[1444084]: Disconnected from invalid user cmm 167.71.226.156 port 40924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.99.171.3
country_id: 6251999
description:
Nov 16 13:38:53 host2 sshd[1443860]: Disconnected from invalid user moein 50.99.171.3 port 55134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Nov 16 13:38:29 host2 sshd[1443647]: Disconnected from invalid user r00t 85.185.120.213 port 53572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.0.78
country_id: 6252001
description:
Nov 16 13:39:51 host2 sshd[1444340]: Disconnected from invalid user testuser 64.225.0.78 port 60824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Nov 16 13:40:05 host2 sshd[1444611]: Disconnected from invalid user god 102.211.152.138 port 42158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Nov 16 13:39:33 host2 sshd[1444199]: Disconnected from invalid user user1 103.49.238.251 port 50648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.117.131
country_id: 6252001
description:
Nov 16 13:39:37 host2 sshd[1444223]: Disconnected from invalid user test1 104.168.117.131 port 39430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 16 13:40:02 host2 sshd[1444419]: Disconnected from invalid user xx 103.52.115.25 port 58312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.171
country_id: 130758
description:
Nov 16 13:39:56 host2 sshd[1444363]: Disconnected from invalid user ftpusr 185.50.38.171 port 55676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.37.230
country_id: 1880251
description:
Nov 16 13:40:08 host2 sshd[1444629]: Disconnected from invalid user postgres 159.223.37.230 port 34200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.136.125
country_id: 1168579
description:
Nov 16 13:40:19 host2 sshd[1444768]: Disconnected from invalid user vivek 116.71.136.125 port 48996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.54.114
country_id: 953987
description:
Nov 16 13:40:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.129.54.114, lip=66.85.158.91, TLS, session=<34wlwrFDq7hmgTZy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.20.111.2
country_id: 2921044
description:
Nov 16 13:40:10 host2 sshd[1444662]: Disconnected from invalid user user1 46.20.111.2 port 35782 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 16 13:41:09 host2 sshd[1445517]: Disconnected from invalid user testuser 132.145.213.106 port 36094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Nov 16 13:40:28 host2 sshd[1444960]: Disconnected from invalid user ftpusr 20.185.243.158 port 52282 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.159.85.31
country_id: 3469034
description:
Nov 16 13:40:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=201.159.85.31, lip=66.85.158.91, TLS, session=<Qy9mw7FD5aXJn1Uf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.218.138
country_id: 130758
description:
Nov 16 13:40:43 host2 sshd[1445200]: Disconnected from invalid user postgres 62.60.218.138 port 41104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.144.176.83
country_id: 6252001
description:
Nov 16 13:40:58 host2 sshd[1445387]: Disconnected from invalid user r00t 198.144.176.83 port 39296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov 16 13:41:20 host2 sshd[1445633]: Disconnected from invalid user testuser 20.102.116.25 port 46884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.102.104.110
country_id: 617790
description:
Nov 16 13:40:48 host2 sshd[1445247]: Disconnected from invalid user deployer 194.102.104.110 port 41624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.174
country_id: 1819730
description:
Nov 16 13:40:42 host2 sshd[1445191]: Disconnected from invalid user testuser 103.243.26.174 port 60280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.116.160.35
country_id: 130758
description:
Nov 16 13:40:54 host2 sshd[1445339]: Disconnected from invalid user postgres 185.116.160.35 port 39220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.229.250
country_id: 1880251
description:
Nov 16 13:42:27 host2 sshd[1446332]: Disconnected from invalid user xx 139.59.229.250 port 47354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Nov 16 13:41:40 host2 sshd[1445813]: Disconnected from invalid user u2 104.223.85.124 port 54296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 16 13:41:44 host2 sshd[1445845]: Disconnected from invalid user hb 164.92.106.89 port 36318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.74.239.125
country_id: 1643084
description:
Nov 16 13:42:00 host2 sshd[1446035]: Disconnected from invalid user chromeuser 202.74.239.125 port 60062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.17
country_id: 130758
description:
Nov 16 13:42:08 host2 sshd[1446159]: Disconnected from invalid user postgres 185.213.164.17 port 43970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.118.142.216
country_id: 3686110
description:
Nov 16 13:42:17 host2 sshd[1446251]: Disconnected from invalid user damian 186.118.142.216 port 34634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.231.101
country_id: 1880251
description:
Nov 16 13:41:53 host2 sshd[1445967]: Disconnected from invalid user ftpusr 152.42.231.101 port 58108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.164.73.248
country_id: 130758
description:
Nov 16 13:42:25 host2 sshd[1446316]: Disconnected from invalid user test1 185.164.73.248 port 35944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.174.243
country_id: 1269750
description:
Nov 16 13:42:02 host2 sshd[1446114]: Disconnected from invalid user chromeuser 64.227.174.243 port 46602 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.20.111.2
country_id: 2921044
description:
Nov 16 13:43:07 host2 sshd[1446742]: Disconnected from invalid user intelbras 46.20.111.2 port 40470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Nov 16 13:43:07 host2 sshd[1446751]: Disconnected from invalid user god 138.68.104.233 port 56870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.42.207.17
country_id: 3175395
description:
Nov 16 13:43:25 host2 sshd[1446884]: Disconnected from invalid user znc 2.42.207.17 port 41550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.199.117.9
country_id: 6252001
description:
Nov 16 13:42:32 host2 sshd[1446397]: Disconnected from invalid user hb 24.199.117.9 port 46508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.176
country_id: 1643084
description:
Nov 16 13:42:37 host2 sshd[1446426]: Disconnected from invalid user postgres 103.189.235.176 port 37412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.184.18.162
country_id: 130758
description:
Nov 16 13:42:50 host2 sshd[1446527]: Disconnected from invalid user dev 94.184.18.162 port 18256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.70.59
country_id: 6252001
description:
Nov 16 13:42:59 host2 sshd[1446618]: Disconnected from invalid user god 107.175.70.59 port 59868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.155.89
country_id: 337996
description:
Nov 16 13:43:11 host2 sshd[1446783]: Disconnected from invalid user postgres 196.189.155.89 port 37748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.128.196.243
country_id: 130758
description:
Nov 16 13:42:52 host2 sshd[1446546]: Disconnected from invalid user user 95.128.196.243 port 51556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Nov 16 13:43:13 host2 sshd[1446794]: Disconnected from invalid user fivem 157.10.252.119 port 49320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.160.144
country_id: 1269750
description:
Nov 16 13:43:27 host2 sshd[1446917]: Disconnected from invalid user hb 64.227.160.144 port 44226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.188.221
country_id: 1269750
description:
Nov 16 13:42:29 host2 sshd[1446340]: Disconnected from invalid user emo 165.232.188.221 port 52518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.32.198
country_id: 6251999
description:
Nov 16 13:42:56 host2 sshd[1446608]: Disconnected from invalid user branch 165.227.32.198 port 39104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.250.16.220
country_id: 6252001
description:
Nov 16 13:43:04 host2 sshd[1446724]: Disconnected from invalid user hb 52.250.16.220 port 58310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.172.100.188
country_id: 6252001
description:
Nov 16 13:43:23 host2 sshd[1446880]: Disconnected from invalid user testuser 144.172.100.188 port 49456 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 16 13:43:09 host2 sshd[1446756]: Disconnected from invalid user xx 125.21.53.232 port 45126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.91.254
country_id: 1269750
description:
Nov 16 13:43:19 host2 sshd[1446852]: Disconnected from invalid user jayanthi 139.59.91.254 port 60896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Nov 16 13:43:42 host2 sshd[1447083]: Disconnected from invalid user znc 40.117.97.0 port 37396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Nov 16 13:44:04 host2 sshd[1447344]: Disconnected from invalid user jai 103.193.176.131 port 58080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.129.56
country_id: 1269750
description:
Nov 16 13:44:14 host2 sshd[1447634]: Disconnected from invalid user flavia 64.227.129.56 port 58712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.126.7.35
country_id: 130758
description:
Nov 16 13:43:32 host2 sshd[1446984]: Disconnected from invalid user jayanthi 185.126.7.35 port 57340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 16 13:44:11 host2 sshd[1447484]: Disconnected from invalid user test1 185.158.23.150 port 29165 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.165.179
country_id: 1880251
description:
Nov 16 13:43:53 host2 sshd[1447161]: Disconnected from invalid user branch 152.42.165.179 port 55738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.152.40
country_id: 6252001
description:
Nov 16 13:44:23 host2 sshd[1448046]: Disconnected from invalid user znc 178.128.152.40 port 37382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.102.104.110
country_id: 617790
description:
Nov 16 13:45:25 host2 sshd[1448906]: Disconnected from invalid user cmm 194.102.104.110 port 36614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Nov 16 13:44:30 host2 sshd[1448143]: Disconnected from invalid user testuser 209.141.33.240 port 59736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.152.191.132
country_id: 130758
description:
Nov 16 13:44:45 host2 sshd[1448267]: Disconnected from invalid user test1 37.152.191.132 port 37284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.139.191.44
country_id: 130758
description:
Nov 16 13:44:54 host2 sshd[1448378]: Disconnected from invalid user branch 94.139.191.44 port 55274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Nov 16 13:45:07 host2 sshd[1448680]: Disconnected from invalid user u2 209.141.47.217 port 34770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.81.208.35
country_id: 6252001
description:
Nov 16 13:45:26 host2 sshd[1448917]: Disconnected from invalid user test1 192.81.208.35 port 34244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.74.239.125
country_id: 1643084
description:
Nov 16 13:44:48 host2 sshd[1448315]: Disconnected from invalid user damian 202.74.239.125 port 45418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.91.254
country_id: 1269750
description:
Nov 16 13:44:29 host2 sshd[1448116]: Disconnected from invalid user postgres 139.59.91.254 port 49800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.61.221.48
country_id: 290557
description:
Nov 16 13:44:42 host2 sshd[1448248]: Disconnected from invalid user cmm 179.61.221.48 port 59202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 16 13:45:03 host2 sshd[1448548]: Disconnected from invalid user postgres 185.158.23.150 port 52811 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Nov 16 13:44:35 host2 sshd[1448195]: Disconnected from invalid user vivek 157.10.252.119 port 46356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.217.189
country_id: 1269750
description:
Nov 16 13:45:55 host2 sshd[1449307]: Disconnected from invalid user moein 103.183.217.189 port 58644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Nov 16 13:46:05 host2 sshd[1449546]: Disconnected from invalid user fivem 103.193.176.131 port 58186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.155.91.167
country_id: 6252001
description:
Nov 16 13:46:09 host2 sshd[1449598]: Disconnected from invalid user user 192.155.91.167 port 57376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Nov 16 13:46:09 host2 sshd[1449593]: Disconnected from invalid user user 159.89.161.111 port 32904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.152.40
country_id: 6252001
description:
Nov 16 13:45:28 host2 sshd[1448933]: Disconnected from invalid user postgres 178.128.152.40 port 35522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.55.216
country_id: 1880251
description:
Nov 16 13:45:56 host2 sshd[1449329]: Disconnected from invalid user god 178.128.55.216 port 40396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-16 13:46:23 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:38723: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.199.193.167
country_id: 6252001
description:
Nov 16 13:45:35 host2 sshd[1449169]: Disconnected from invalid user r00t 134.199.193.167 port 58640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.37.90
country_id: 6252001
description:
Nov 16 13:45:59 host2 sshd[1449403]: Disconnected from invalid user branch 23.95.37.90 port 52584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 16 13:45:44 host2 sshd[1449223]: Disconnected from invalid user postgres 125.21.53.232 port 45022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Nov 16 13:46:03 host2 sshd[1449470]: Disconnected from invalid user admin 103.49.239.184 port 45636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.126.7.35
country_id: 130758
description:
Nov 16 13:45:36 host2 sshd[1449161]: Disconnected from invalid user dev 185.126.7.35 port 57250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.231
country_id: 130758
description:
Nov 16 13:45:50 host2 sshd[1449264]: Disconnected from invalid user cmm 185.50.38.231 port 40724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.91.254
country_id: 1269750
description:
Nov 16 13:45:39 host2 sshd[1449192]: Disconnected from invalid user testuser 139.59.91.254 port 41088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov 16 13:46:18 host2 sshd[1449721]: Disconnected from invalid user jayanthi 20.102.116.25 port 54432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.32.198
country_id: 6251999
description:
Nov 16 13:46:03 host2 sshd[1449534]: Disconnected from invalid user deployer 165.227.32.198 port 50722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.51
country_id: 1643084
description:
Nov 16 13:46:04 host2 sshd[1449537]: Disconnected from invalid user chromeuser 103.49.238.51 port 59968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.206.109
country_id: 6251999
description:
Nov 16 13:46:21 host2 sshd[1449800]: Disconnected from invalid user ftpusr 51.222.206.109 port 38778 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.232
country_id: 2186224
description:
2025-11-16 13:46:43 dovecot_login authenticator failed for ([121.73.163.232]) [121.73.163.232]:58084: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov 16 13:46:51 host2 sshd[1450121]: Disconnected from invalid user u2 146.190.111.235 port 49566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Nov 16 13:47:21 host2 sshd[1450576]: Disconnected from invalid user moein 104.223.85.124 port 42430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 16 13:46:43 host2 sshd[1450050]: Disconnected from invalid user cmm 185.158.23.150 port 46774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.185.243.158
country_id: 6252001
description:
Nov 16 13:47:07 host2 sshd[1450390]: Disconnected from invalid user r00t 20.185.243.158 port 47706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.91.254
country_id: 1269750
description:
Nov 16 13:46:47 host2 sshd[1450071]: Disconnected from invalid user user 139.59.91.254 port 40152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.199.193.167
country_id: 6252001
description:
Nov 16 13:46:40 host2 sshd[1450031]: Disconnected from invalid user znc 134.199.193.167 port 45754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.28
country_id: 3469034
description:
Nov 16 13:47:22 host2 sshd[1450579]: Disconnected from invalid user znc 102.211.152.28 port 57398 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Nov 16 13:47:30 host2 sshd[1450640]: Disconnected from invalid user r00t 185.158.23.150 port 48118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.200.45.164
country_id: 6252001
description:
Nov 16 13:47:44 host2 sshd[1450906]: Disconnected from invalid user test 198.200.45.164 port 36402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Nov 16 13:47:35 host2 sshd[1450749]: Disconnected from invalid user test1 59.97.205.137 port 30757 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.70.59
country_id: 6252001
description:
Nov 16 13:47:51 host2 sshd[1451015]: Disconnected from invalid user testuser 107.175.70.59 port 44412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.172.100.188
country_id: 6252001
description:
Nov 16 13:47:35 host2 sshd[1450770]: Disconnected from invalid user postgres 144.172.100.188 port 42822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.89.161.111
country_id: 1269750
description:
Nov 16 13:48:23 host2 sshd[1451395]: Disconnected from invalid user test1 159.89.161.111 port 44254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.183.233
country_id: 6252001
description:
Nov 16 13:47:28 host2 sshd[1450629]: Disconnected from invalid user postgres 159.223.183.233 port 54358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 16 13:49:16 host2 sshd[1452085]: Disconnected from invalid user testuser 103.52.115.25 port 35702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 16 13:49:17 host2 sshd[1452090]: Disconnected from invalid user cmm 125.21.53.232 port 39144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.164.73.248
country_id: 130758
description:
Nov 16 13:48:47 host2 sshd[1451710]: Disconnected from invalid user user 185.164.73.248 port 43542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.134.24
country_id: 1269750
description:
Nov 16 13:48:34 host2 sshd[1451572]: Disconnected from invalid user postgres 64.227.134.24 port 58544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Nov 16 13:48:52 host2 sshd[1451781]: Disconnected from invalid user postgres 138.68.104.233 port 35282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.41.223
country_id: 1880251
description:
Nov 16 13:49:13 host2 sshd[1452065]: Disconnected from invalid user postgres 157.230.41.223 port 57734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.152.174.44
country_id: 130758
description:
Nov 16 13:48:45 host2 sshd[1451671]: Disconnected from invalid user testuser 37.152.174.44 port 47436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Nov 16 13:48:46 host2 sshd[1451685]: Disconnected from invalid user test1 85.185.120.213 port 43244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.113
country_id: 2328926
description:
Nov 16 13:48:33 host2 sshd[1451568]: Disconnected from invalid user dev 154.113.10.113 port 60488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.58.36
country_id: 1880251
description:
Nov 16 13:48:57 host2 sshd[1451851]: Disconnected from invalid user postgres 178.128.58.36 port 51520 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.44.227
country_id: 2635167
description:
Nov 16 13:49:21 host2 sshd[1452149]: Disconnected from invalid user u2 64.227.44.227 port 45746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Nov 16 13:48:42 host2 sshd[1451649]: Disconnected from invalid user odoo 27.112.78.170 port 58676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Nov 16 13:48:28 host2 sshd[1451442]: Disconnected from invalid user admin 34.93.128.179 port 45122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 16 13:49:07 host2 sshd[1452014]: Disconnected from invalid user flavia 50.232.189.209 port 35006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.139.157
country_id: 1269750
description:
Nov 16 13:50:04 host2 sshd[1452892]: Disconnected from invalid user admin 64.227.139.157 port 40208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.116.160.35
country_id: 130758
description:
Nov 16 13:50:23 host2 sshd[1453237]: Disconnected from invalid user znc 185.116.160.35 port 38400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.188.240.152
country_id: 1269750
description:
Nov 16 13:50:15 host2 sshd[1453137]: Disconnected from invalid user ftpusr 4.188.240.152 port 49194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Nov 16 13:50:07 host2 sshd[1452970]: Disconnected from invalid user odoo 64.227.176.54 port 34290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.185.120.213
country_id: 130758
description:
Nov 16 13:49:51 host2 sshd[1452607]: Disconnected from invalid user postgres 85.185.120.213 port 46928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.62.58
country_id: 1819730
description:
Nov 16 13:49:27 host2 sshd[1452224]: Disconnected from invalid user intelbras 20.255.62.58 port 35310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Nov 16 13:49:36 host2 sshd[1452370]: Disconnected from invalid user dev 103.224.247.23 port 36862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.160.144
country_id: 1269750
description:
Nov 16 13:49:39 host2 sshd[1452411]: Disconnected from invalid user admin 64.227.160.144 port 53948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.141
country_id: 953987
description:
Nov 16 13:50:17 host2 sshd[1453155]: Disconnected from invalid user ftpusr 102.210.149.141 port 45520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.58.124.191
country_id: 6252001
description:
Nov 16 13:50:46 host2 sshd[1453619]: Disconnected from invalid user znc 34.58.124.191 port 44296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.113.10.113
country_id: 2328926
description:
Nov 16 13:51:16 host2 sshd[1454151]: Disconnected from invalid user cmm 154.113.10.113 port 37274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.117.150
country_id: 1819730
description:
Nov 16 13:50:44 host2 sshd[1453602]: Disconnected from invalid user postgres 185.216.117.150 port 41494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.50.38.171
country_id: 130758
description:
Nov 16 13:51:17 host2 sshd[1454156]: Disconnected from invalid user test1 185.50.38.171 port 58386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.39.95.92
country_id: 1512440
description:
Nov 16 13:51:23 host2 sshd[1454236]: Disconnected from invalid user postgres 89.39.95.92 port 41700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.74.239.125
country_id: 1643084
description:
Nov 16 13:50:34 host2 sshd[1453508]: Disconnected from invalid user jai 202.74.239.125 port 41340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.202
country_id: 1269750
description:
Nov 16 13:50:33 host2 sshd[1453502]: Disconnected from invalid user user 40.81.224.202 port 46153 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.30.41.231
country_id: 1819730
description:
Nov 16 13:50:56 host2 sshd[1453756]: Disconnected from invalid user user 103.30.41.231 port 36992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.184.18.162
country_id: 130758
description:
Nov 16 13:51:05 host2 sshd[1453968]: Disconnected from invalid user testuser 94.184.18.162 port 19058 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.213.23
country_id: 6251999
description:
Nov 16 13:50:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.213.23, lip=66.85.158.92, session=<xg3M57FDeKWUcdUX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.159
country_id: 6252001
description:
Nov 16 13:51:07 host2 sshd[1454037]: Disconnected from invalid user postgres 199.195.251.159 port 52060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.62
country_id: 1643084
description:
Nov 16 13:52:03 host2 sshd[1454702]: Disconnected from invalid user testuser 103.59.94.62 port 33696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.253.214.172
country_id: 6252001
description:
Nov 16 13:52:17 host2 sshd[1454986]: Disconnected from invalid user user1 20.253.214.172 port 59686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Nov 16 13:52:22 host2 sshd[1455027]: Disconnected from invalid user user1 27.112.78.170 port 45838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.111.235
country_id: 1880251
description:
Nov 16 13:51:29 host2 sshd[1454279]: Disconnected from invalid user god 146.190.111.235 port 45720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Nov 16 13:52:24 host2 sshd[1455060]: Disconnected from invalid user testtest 203.150.162.250 port 37964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.244.142
country_id: 1269750
description:
Nov 16 13:51:36 host2 sshd[1454360]: Disconnected from invalid user user 40.81.244.142 port 54322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.55.216
country_id: 1880251
description:
Nov 16 13:52:11 host2 sshd[1454838]: Disconnected from invalid user znc 178.128.55.216 port 54178 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.126.7.35
country_id: 130758
description:
Nov 16 13:51:41 host2 sshd[1454428]: Disconnected from invalid user branch 185.126.7.35 port 50576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.226.156
country_id: 1269750
description:
Nov 16 13:51:47 host2 sshd[1454492]: Disconnected from invalid user postgres 167.71.226.156 port 49964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Nov 16 13:51:51 host2 sshd[1454556]: Disconnected from invalid user xx 195.158.4.216 port 59944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Nov 16 13:52:51 host2 sshd[1455362]: Disconnected from invalid user odoo 35.200.237.19 port 1139 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 16 13:53:23 host2 sshd[1455871]: Disconnected from invalid user postgres 157.245.49.180 port 59666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Nov 16 13:52:38 host2 sshd[1455234]: Disconnected from invalid user runner 50.232.189.209 port 33982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.26.174
country_id: 1819730
description:
Nov 16 13:52:56 host2 sshd[1455442]: Disconnected from invalid user branch 103.243.26.174 port 41126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.146
country_id: 1643084
description:
Nov 16 13:53:01 host2 sshd[1455521]: Disconnected from invalid user runner 103.76.120.146 port 37490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.30.41.231
country_id: 1819730
description:
Nov 16 13:53:13 host2 sshd[1455751]: Disconnected from invalid user cmm 103.30.41.231 port 39264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.7
country_id: 1880251
description:
Nov 16 13:53:21 host2 sshd[1455852]: Disconnected from invalid user abhinav 45.78.205.7 port 54680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.252.95.146
country_id: 1210997
description:
Nov 16 13:53:34 host2 sshd[1455979]: Disconnected from invalid user flavia 182.252.95.146 port 59804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.170
country_id: 1643084
description:
Nov 16 13:54:14 host2 sshd[1456777]: Disconnected from invalid user damian 27.112.78.170 port 44230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.141
country_id: 953987
description:
Nov 16 13:54:16 host2 sshd[1456838]: Disconnected from invalid user postgres 102.210.149.141 port 55222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Nov 16 13:54:19 host2 sshd[1456923]: Disconnected from invalid user jai 35.200.237.19 port 1118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.13.244.219
country_id: 3686110
description:
Nov 16 13:54:22 host2 sshd[1457009]: Disconnected from invalid user test 200.13.244.219 port 39796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Nov 16 13:53:49 host2 sshd[1456115]: Disconnected from invalid user jai 103.49.239.184 port 58894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Nov 16 13:54:28 host2 sshd[1457102]: Disconnected from invalid user hb 103.49.238.251 port 52926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Nov 16 13:54:05 host2 sshd[1456486]: Disconnected from invalid user odoo 128.199.168.119 port 51078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.210.167
country_id: 6251999
description:
Nov 16 13:53:36 host2 sshd[1455998]: Disconnected from invalid user testuser 158.69.210.167 port 58866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.129.56
country_id: 1269750
description:
Nov 16 13:53:28 host2 sshd[1455907]: Disconnected from invalid user admin 64.227.129.56 port 48434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.86.31
country_id: 6252001
description:
Nov 16 13:54:36 host2 sshd[1457205]: Disconnected from invalid user cmm 137.184.86.31 port 51222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.139.191.44
country_id: 130758
description:
Nov 16 13:55:11 host2 sshd[1457626]: Disconnected from invalid user cmm 94.139.191.44 port 56184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Nov 16 13:54:41 host2 sshd[1457248]: Disconnected from invalid user damian 203.150.162.250 port 52578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 16 13:55:18 host2 sshd[1457722]: Disconnected from invalid user u2 157.245.49.180 port 52996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.139.191.44
country_id: 130758
description:
Nov 16 13:56:24 host2 sshd[1458443]: Disconnected from invalid user testuser 94.139.191.44 port 56284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.82.237
country_id: 1269750
description:
Nov 16 13:55:42 host2 sshd[1457932]: Disconnected from invalid user znc 68.183.82.237 port 46490 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.38
country_id: 6252001
description:
Nov 16 13:55:43 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.38, lip=66.85.158.92, TLS, session=<tFgQ+rFDDvDN0h8m>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.155.91.167
country_id: 6252001
description:
Nov 16 13:56:42 host2 sshd[1458600]: Disconnected from invalid user testuser 192.155.91.167 port 40732 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.13.244.219
country_id: 3686110
description:
Nov 16 13:56:40 host2 sshd[1458584]: Disconnected from invalid user intelbras 200.13.244.219 port 47472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.183.138
country_id: 1880251
description:
Nov 16 13:56:57 host2 sshd[1458684]: Disconnected from invalid user testtest 128.199.183.138 port 51310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.214.205
country_id: 6252001
description:
Nov 16 13:57:31 host2 sshd[1458999]: Disconnected from invalid user moein 192.227.214.205 port 33948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.155.91.167
country_id: 6252001
description:
Nov 16 13:57:45 host2 sshd[1459182]: Disconnected from invalid user jayanthi 192.155.91.167 port 60490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.86.31
country_id: 6252001
description:
Nov 16 13:58:05 host2 sshd[1459398]: Disconnected from invalid user moein 137.184.86.31 port 49882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.226.156
country_id: 1269750
description:
Nov 16 13:57:49 host2 sshd[1459212]: Disconnected from invalid user u2 167.71.226.156 port 38700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.49.180
country_id: 1880251
description:
Nov 16 13:59:05 host2 sshd[1459861]: Disconnected from invalid user cmm 157.245.49.180 port 33828 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.190.242.142
country_id: 6251999
description:
Nov 16 13:58:27 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=146.190.242.142, lip=66.85.158.91, TLS, session=<v2rUA7JDgqySvvKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.58.36
country_id: 1880251
description:
Nov 16 13:58:34 host2 sshd[1459613]: Disconnected from invalid user moein 178.128.58.36 port 40768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.0.78
country_id: 6252001
description:
Nov 16 14:00:18 host2 sshd[1460779]: Disconnected from invalid user dev 64.225.0.78 port 35488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.7
country_id: 1880251
description:
Nov 16 14:00:17 host2 sshd[1460741]: Disconnected from invalid user student3 45.78.205.7 port 48552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 16 14:01:55 host2 sshd[1461695]: Disconnected from invalid user jjq 203.150.107.244 port 53282 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 14:03:18 host2 sshd[1462771]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.229.197.38
country_id: 3996063
description:
Nov 16 14:03:38 host2 sshd[1462978]: Disconnected from invalid user steam 177.229.197.38 port 46752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.0.78
country_id: 6252001
description:
Nov 16 14:03:58 host2 sshd[1463097]: Disconnected from invalid user u2 64.225.0.78 port 56936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Nov 16 14:04:58 host2 sshd[1463620]: Disconnected from invalid user librenms 177.229.197.38 port 57004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.94.211
country_id: 1880251
description:
2025-11-16 14:05:40 dovecot_login authenticator failed for ([223.25.94.211]) [223.25.94.211]:60723: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.30
country_id: 2186224
description:
2025-11-16 14:06:04 dovecot_login authenticator failed for ([121.73.168.30]) [121.73.168.30]:54966: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-16 14:06:23 dovecot_login authenticator failed for ([49.206.201.253]) [49.206.201.253]:56300: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.229.197.38
country_id: 3996063
description:
Nov 16 14:06:16 host2 sshd[1464560]: Disconnected from invalid user user 177.229.197.38 port 52490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 16 14:07:33 host2 sshd[1465255]: Disconnected from invalid user db2inst1 203.150.107.244 port 52038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.150.107.244
country_id: 1605651
description:
Nov 16 14:08:56 host2 sshd[1465887]: Disconnected from invalid user adminftp 203.150.107.244 port 51728 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.86.31
country_id: 6252001
description:
Nov 16 14:10:30 host2 sshd[1466880]: Disconnected from invalid user jayanthi 137.184.86.31 port 43018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.118.58
country_id: 6252001
description:
Nov 16 14:10:51 host2 sshd[1467144]: Disconnected from invalid user dev 159.203.118.58 port 45592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.39.95.92
country_id: 1512440
description:
Nov 16 14:12:43 host2 sshd[1468134]: Disconnected from invalid user cmm 89.39.95.92 port 38150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.7
country_id: 1880251
description:
Nov 16 14:13:48 host2 sshd[1468686]: Disconnected from invalid user light 45.78.205.7 port 51814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.118.58
country_id: 6252001
description:
Nov 16 14:14:51 host2 sshd[1469185]: Disconnected from invalid user digital 159.203.118.58 port 54184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.201
country_id: 1269750
description:
Nov 16 14:15:27 host2 sshd[1469603]: Disconnected from invalid user testuser 40.81.224.201 port 42493 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.160
country_id: 1269750
description:
Nov 16 14:16:54 host2 sshd[1470549]: Disconnected from invalid user r00t 40.81.224.160 port 29566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.203.118.58
country_id: 6252001
description:
Nov 16 14:16:56 host2 sshd[1470585]: Disconnected from invalid user centos 159.203.118.58 port 43362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.203
country_id: 1269750
description:
Nov 16 14:18:19 host2 sshd[1471279]: Disconnected from invalid user moein 40.81.224.203 port 58546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2025-11-16 14:18:42 dovecot_login authenticator failed for ([82.102.149.88]) [82.102.149.88]:51633: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2025-11-16 14:18:56 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:36973: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.203
country_id: 1269750
description:
Nov 16 14:19:46 host2 sshd[1471867]: Disconnected from invalid user deployer 40.81.224.203 port 51725 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.118.58
country_id: 6252001
description:
Nov 16 14:20:53 host2 sshd[1472571]: Disconnected from invalid user bigdata 159.203.118.58 port 54924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.81.224.160
country_id: 1269750
description:
Nov 16 14:22:45 host2 sshd[1473603]: Disconnected from invalid user dev 40.81.224.160 port 27054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.17.174
country_id: 2017370
description:
2025-11-16 14:27:01 dovecot_login authenticator failed for ([155.212.17.174]) [155.212.17.174]:57050: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-11-16 14:26:38 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:36424: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-16 14:28:05 dovecot_login authenticator failed for ([103.251.31.34]) [103.251.31.34]:56482: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.21
country_id: 1733045
description:
2025-11-16 14:28:22 dovecot_login authenticator failed for ([49.124.153.21]) [49.124.153.21]:37412: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.211
country_id: 6252001
description:
Nov 16 14:36:25 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.211, lip=66.85.158.92, session=<zcyVi7JDsPnG6xjT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-16 14:42:30 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:37910: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.38.133.146
country_id: 2750405
description:
2025-11-16 14:46:06 dovecot_login authenticator failed for (RZgI8DL) [84.38.133.146]:54153: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.38.133.146
country_id: 2750405
description:
2025-11-16 14:46:43 dovecot_login authenticator failed for (1ZGM6RJU) [84.38.133.146]:54166: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.21.238.137
country_id: 2782113
description:
Nov 16 14:48:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=185.21.238.137, lip=66.85.158.91, TLS, session=<P2LdtLJDTLq5Fe6J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.114
country_id: 3469034
description:
Nov 16 14:47:56 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=187.120.73.114, lip=66.85.158.91, TLS, session=<8rKds7JDyNm7eEly>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.49.152.114
country_id: 3996063
description:
Nov 16 15:17:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=38.49.152.114, lip=66.85.158.91, TLS, session=<0H3CG7NDp9AmMZhy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.144.246.132
country_id: 798544
description:
Nov 16 15:17:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.144.246.132, lip=66.85.158.91, TLS, session=<HVTQHLNDseS5kPaE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 15:18:08 host2 sshd[1505548]: Disconnected from invalid user admin 2.57.121.112 port 61776 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 15:23:52 host2 sshd[1508996]: Disconnected from invalid user admin 2.57.121.112 port 62185 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Nov 16 15:26:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.54, lip=66.85.158.91, TLS: Connection closed, session=<UE01PrNDhEWnXpI2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 15:37:52 host2 sshd[1517221]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 15:44:34 host2 sshd[1521706]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Nov 16 15:44:09 host2 sshd[1521133]: Disconnected from invalid user master 95.0.27.163 port 52132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2025-11-16 15:45:32 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:36066: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.7.83.131
country_id: 1269750
description:
2025-11-16 15:45:53 dovecot_login authenticator failed for ([1.7.83.131]) [1.7.83.131]:11004: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Nov 16 15:46:23 host2 sshd[1522694]: Disconnected from invalid user cacti 117.247.111.70 port 34603 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Nov 16 15:47:17 host2 sshd[1523114]: Disconnected from invalid user rustserver 95.0.27.163 port 56818 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.0.27.163
country_id: 298795
description:
Nov 16 15:48:33 host2 sshd[1523673]: Disconnected from invalid user sangoma 95.0.27.163 port 46290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Nov 16 15:49:31 host2 sshd[1524078]: Disconnected from invalid user venkatesh 117.247.111.70 port 55398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Nov 16 15:49:49 host2 sshd[1524207]: Disconnected from invalid user master 155.4.244.107 port 28473 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Nov 16 15:51:04 host2 sshd[1525094]: Disconnected from invalid user server 95.0.27.163 port 47110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Nov 16 15:52:24 host2 sshd[1525769]: Disconnected from invalid user ops 95.0.27.163 port 52186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Nov 16 15:52:36 host2 sshd[1525852]: Disconnected from invalid user sujan 117.247.111.70 port 18261 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.255.75.218
country_id: 1269750
description:
Nov 16 15:53:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.255.75.218, lip=66.85.158.91, TLS, session=<CdMInbNDBrtn/0va>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.158
country_id: 798544
description:
Nov 16 15:53:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=46.227.39.158, lip=66.85.158.91, TLS, session=<8qomnrNDdesu4yee>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Nov 16 15:54:22 host2 sshd[1527216]: Disconnected from invalid user user1 155.4.244.107 port 13034 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.247.111.70
country_id: 1269750
description:
Nov 16 15:55:36 host2 sshd[1528385]: Disconnected from invalid user larry 117.247.111.70 port 51794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.71
country_id: 3469034
description:
Nov 16 15:56:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.44.71.71, lip=66.85.158.91, TLS, session=<9NysqLNDrtuxLEdH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.62
country_id: 3175395
description:
Nov 16 15:56:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=185.208.106.62, lip=66.85.158.91, TLS, session=<7n/nqbNDXMW50Go+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Nov 16 15:57:23 host2 sshd[1529322]: Disconnected from invalid user hung 155.4.244.107 port 18892 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 15:58:47 host2 sshd[1530094]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov 16 15:59:24 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=</EVktLNDZtkDU5En>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Nov 16 16:00:52 host2 sshd[1531423]: Disconnected from invalid user librenms 155.4.244.107 port 4534 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.118.32.39
country_id: 6252001
description:
Nov 16 16:00:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.118.32.39, lip=66.85.158.91, TLS, session=<dYtit7NDmsEUdiAn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-16 16:03:13 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:48172: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.42
country_id: 6252001
description:
2025-11-16 16:06:52 dovecot_login authenticator failed for ([70.174.168.42]) [70.174.168.42]:45322: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-16 16:07:40 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:38016: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 16:31:00 host2 sshd[1549468]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 16 16:30:29 host2 sshd[1549244]: Disconnected from invalid user ict 157.230.85.50 port 39134 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.180.92
country_id: 6252001
description:
Nov 16 16:30:59 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.180.92, lip=66.85.158.92, TLS, session=<FsFTJbRD1sUofLRc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 16 16:32:50 host2 sshd[1550463]: Disconnected from invalid user rajesh 157.230.85.50 port 55238 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 16 16:35:15 host2 sshd[1551942]: Disconnected from invalid user devops 157.230.85.50 port 53320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 16 16:36:26 host2 sshd[1552672]: Disconnected from invalid user admin 157.230.85.50 port 56810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.85.50
country_id: 6252001
description:
Nov 16 16:38:44 host2 sshd[1553847]: Disconnected from invalid user reza 157.230.85.50 port 50844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.228.161.66
country_id: 1327865
description:
Nov 16 16:44:29 host2 sshd[1557679]: Disconnected from invalid user dtl 136.228.161.66 port 36340 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 16:47:58 host2 sshd[1559982]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-11-16 16:53:06 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:38669: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Nov 16 16:53:11 host2 sshd[1563269]: Disconnected from invalid user ict 107.173.10.98 port 1174 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-16 16:53:12 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:38318: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.10.98
country_id: 6252001
description:
Nov 16 16:59:15 host2 sshd[1567755]: Disconnected from invalid user devops 107.173.10.98 port 22132 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.53.36.10
country_id: 2510769
description:
Nov 16 17:04:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=195.53.36.10, lip=66.85.158.91, TLS, session=<3lytnLRDCofDNSQK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.42.182
country_id: 953987
description:
Nov 16 17:05:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.64.42.182, lip=66.85.158.91, TLS, session=<L4DRnbRDP4dmQCq2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.10.98
country_id: 6252001
description:
Nov 16 17:07:26 host2 sshd[1573047]: Disconnected from invalid user lord 107.173.10.98 port 34538 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-16 17:07:47 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56230: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.24
country_id: 1269750
description:
Nov 16 17:15:41 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=103.18.166.24, lip=66.85.158.91, TLS, session=<sNcHxLRDX7JnEqYY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.8
country_id: 3175395
description:
Nov 16 17:15:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=171.22.235.8, lip=66.85.158.91, TLS, session=<ZG7hwrRDutSrFusI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.133.146
country_id: 3865483
description:
Nov 16 17:22:54 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=190.122.133.146, lip=66.85.158.91, TLS, session=<JvHk3bRDWra+eoWS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.48.181.51
country_id: 719819
description:
Nov 16 17:23:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=178.48.181.51, lip=66.85.158.91, TLS, session=<FioT37RDXoeyMLUz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.6.200.134
country_id: 3469034
description:
Nov 16 17:24:58 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=45.6.200.134, lip=66.85.158.91, TLS, session=<DqtV5bRD+sUtBsiG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 17:25:07 host2 sshd[1585012]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.133.120
country_id: 1269750
description:
Nov 16 17:25:19 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=103.59.133.120, lip=66.85.158.91, TLS, session=<NjKD5rRDLNJnO4V4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:29:35 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<kPXp9rRDep8Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:33:05 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<05xsA7VD2ugDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-16 17:32:20 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:52048: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:33:13 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<0ZLdA7VD7KoDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:34:01 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<nS++BrVDXoEDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:34:07 host2 dovecot[3661788]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<W1kYB7VD/LQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:34:12 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<vVNqB7VD4qQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 16 17:36:24 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<WJA9D7VD8oEDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.204.77
country_id: 3175395
description:
Nov 16 17:36:36 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=109.70.204.77, lip=66.85.158.91, TLS, session=<6IP/DrVD7uJtRsxN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.51.154
country_id: 3175395
description:
Nov 16 17:36:18 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.77.51.154, lip=66.85.158.91, TLS, session=<cijzDbVDIOe5TTOa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.110.115.146
country_id: 3865483
description:
Nov 16 17:46:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=190.110.115.146, lip=66.85.158.91, TLS, session=<ObHIMLVD4au+bnOS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.55.139.72
country_id: 3469034
description:
Nov 16 17:45:44 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=201.55.139.72, lip=66.85.158.91, TLS, session=<Vu1fL7VD19fJN4tI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.27
country_id: 798544
description:
Nov 16 17:46:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=178.216.29.27, lip=66.85.158.91, TLS, session=<iQ30MrVD+Miy2B0b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.20.230.22
country_id: 3469034
description:
Nov 16 17:47:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=177.20.230.22, lip=66.85.158.91, TLS, session=</lBvNLVDDuuxFOYW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.241.243.20
country_id: 1269750
description:
Nov 16 17:48:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.241.243.20, lip=66.85.158.91, TLS, session=<9VkMOLVDl5dn8fMU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.28
country_id: 798544
description:
Nov 16 17:48:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 32 secs): user=<587hr>, method=PLAIN, rip=178.216.29.28, lip=66.85.158.91, TLS, session=<T8KWObVDZYmy2B0c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 16 17:49:09 host2 sshd[1602057]: Disconnected from invalid user eun 162.223.91.130 port 56600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 16 17:50:43 host2 sshd[1603586]: Disconnected from invalid user java 162.223.91.130 port 33690 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 16 17:53:08 host2 sshd[1605417]: Disconnected from invalid user leonardo 162.223.91.130 port 59380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.10.70.52
country_id: 3175395
description:
Nov 16 17:53:47 host2 sshd[1605752]: Disconnected from invalid user admin 151.10.70.52 port 45568 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-11-16 17:54:11 dovecot_login authenticator failed for (213-91-179-26.btc-net.bg) [213.91.179.26]:52150: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-11-16 17:54:48 dovecot_login authenticator failed for 203-128-10-138.braintel.net.pk [203.128.10.138]:59682: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 16 17:56:22 host2 sshd[1608570]: Disconnected from invalid user git 162.223.91.130 port 55550 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov 16 17:57:07 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, session=<q0RYWbVDdOADU5En>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.223.91.130
country_id: 6252001
description:
Nov 16 17:57:24 host2 sshd[1609514]: Disconnected from invalid user mahsa 162.223.91.130 port 54266 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.10.70.52
country_id: 3175395
description:
Nov 16 18:00:06 host2 sshd[1611914]: Disconnected from invalid user avinash 151.10.70.52 port 55836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.10.70.52
country_id: 3175395
description:
Nov 16 18:01:33 host2 sshd[1613362]: Disconnected from invalid user mahsa 151.10.70.52 port 58114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.197.188
country_id: 453733
description:
2025-11-16 18:04:35 dovecot_login authenticator failed for 188-197-29-85.dyn.estpak.ee [85.29.197.188]:47580: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-16 18:05:30 dovecot_login authenticator failed for ([189.56.191.126]) [189.44.133.238]:53714: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.179.108
country_id: 3175395
description:
Nov 16 18:07:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.68.179.108, lip=66.85.158.91, TLS, session=<MgoPfrVDZKq5RLNs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.106.87.120
country_id: 3469034
description:
Nov 16 18:07:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 32 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=179.106.87.120, lip=66.85.158.91, TLS, session=<OzUWfLVDQYazald4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.248.94
country_id: 3469034
description:
Nov 16 18:13:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=186.209.248.94, lip=66.85.158.91, TLS, session=<yaHSkbVD/6O60fhe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.31
country_id: 953987
description:
Nov 16 18:13:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.62.31, lip=66.85.158.91, TLS, session=<zFEbk7VD2tZmgT4f>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 16 18:14:45 host2 sshd[1624404]: Disconnected from invalid user ubuntu 147.50.227.142 port 37516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 16 18:16:26 host2 sshd[1625595]: Disconnected from invalid user hi 147.50.227.142 port 56544 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.36.252
country_id: 6290252
description:
Nov 16 18:17:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=109.207.36.252, lip=66.85.158.91, TLS, session=<i1IWobVD5sdtzyT8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 207.248.113.76
country_id: 3996063
description:
Nov 16 18:17:09 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=207.248.113.76, lip=66.85.158.91, TLS, session=<rbECoLVDFZ3P+HFM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 16 18:18:26 host2 sshd[1626757]: Disconnected from invalid user csgo 170.79.37.88 port 45162 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 16 18:18:57 host2 sshd[1627089]: Disconnected from invalid user ubuntu 170.79.37.88 port 36486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 16 18:19:34 host2 sshd[1627405]: Disconnected from invalid user cortega 147.50.227.142 port 35454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 16 18:19:46 host2 sshd[1627528]: Disconnected from invalid user hi 170.79.37.88 port 48460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.79.37.88
country_id: 3932488
description:
Nov 16 18:20:44 host2 sshd[1628207]: Disconnected from invalid user git 170.79.37.88 port 44602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 16 18:22:29 host2 sshd[1629175]: Disconnected from invalid user noel 147.50.227.142 port 55738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.227.142
country_id: 1605651
description:
Nov 16 18:24:00 host2 sshd[1630040]: Disconnected from invalid user user1 147.50.227.142 port 36894 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.168
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.168: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 18:25:56 host2 sshd[1631304]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.124.75
country_id: 2921044
description:
Nov 16 18:38:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=159.65.124.75, lip=66.85.158.91, TLS handshaking: Connection closed, session=<6VeF7LVD1mmfQXxL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 16 18:40:13 host2 sshd[1638730]: Disconnected from invalid user admin 45.78.200.2 port 52960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-16 18:44:45 dovecot_login authenticator failed for ([49.206.201.253]) [49.206.201.253]:45016: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-11-16 18:45:14 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:49684: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 18:47:53 host2 sshd[1643275]: Disconnected from invalid user frappe 2.57.121.112 port 61796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 18:50:25 host2 sshd[1644692]: Disconnected from invalid user admin 2.57.121.112 port 25015 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.220
country_id: 798544
description:
Nov 16 18:53:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=178.216.25.220, lip=66.85.158.91, TLS, session=<cXXxIrZD4tCy2Bnc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.138
country_id: 798544
description:
Nov 16 18:54:04 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=178.216.25.138, lip=66.85.158.91, TLS, session=<UDEPJLZDZoiy2BmK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2025-11-16 18:59:24 dovecot_login authenticator failed for 169.47.246.220.static.netvigator.com [220.246.47.169]:50953: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.158.224.90
country_id: 2658434
description:
2025-11-16 18:59:37 dovecot_login authenticator failed for ([194.158.224.90]) [194.158.224.90]:49992: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.173.39
country_id: 1512440
description:
2025-11-16 18:59:52 dovecot_login authenticator failed for ([45.92.173.39]) [45.92.173.39]:38614: 535 Incorrect authentication data (set_id=careers)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 31.59.174.50
country_id: 2750405
description:
Denial of Service (DoS) attack was discovered from 31.59.174.50: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.39
country_id: 1880251
description:
Nov 16 19:03:31 host2 sshd[1654060]: Disconnected from invalid user ubuntu 45.78.227.39 port 45238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.121.48.71
country_id: 2635167
description:
Nov 16 19:04:54 host2 sshd[1655019]: Disconnected from invalid user marek 85.121.48.71 port 60494 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 16 19:05:12 host2 sshd[1655340]: Disconnected from invalid user admin 45.78.200.2 port 41956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.121.48.71
country_id: 2635167
description:
Nov 16 19:06:05 host2 sshd[1656007]: Disconnected from invalid user danya 85.121.48.71 port 60596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 16 19:07:49 host2 sshd[1657152]: Disconnected from invalid user admin 45.78.200.2 port 57810 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.121.48.71
country_id: 2635167
description:
Nov 16 19:10:39 host2 sshd[1659297]: Disconnected from invalid user admin 85.121.48.71 port 60936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.105.30
country_id: 798544
description:
Nov 16 19:11:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=91.246.105.30, lip=66.85.158.91, TLS, session=<4V77Y7ZDAOlb9mke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-11-16 19:12:00 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:47336: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.135
country_id: 3469034
description:
Nov 16 19:17:01 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=186.209.251.135, lip=66.85.158.91, TLS, session=<ssgKdrZDkby60fuH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.5.160
country_id: 2300660
description:
Nov 16 19:17:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=41.139.5.160, lip=66.85.158.91, TLS, session=<7Zw8d7ZDt9spiwWg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Nov 16 19:18:26 host2 sshd[1663975]: Disconnected from invalid user nominatim 128.1.131.163 port 54570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Nov 16 19:19:44 host2 sshd[1664630]: Disconnected from invalid user sasaki 128.1.131.163 port 59212 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 19:20:15 host2 sshd[1665088]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.159.7
country_id: 2921044
description:
Nov 16 19:20:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.227.159.7, lip=66.85.158.92, TLS handshaking: Connection closed, session=<oLKsgrZDjoWl458H>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.253.22.237
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 64.253.22.237 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.131.163
country_id: 1819730
description:
Nov 16 19:23:35 host2 sshd[1666930]: Disconnected from invalid user wangziyun 128.1.131.163 port 56102 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.82.65.48
country_id: 2077456
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.82.65.48 - vdeployc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeployc (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 16 19:24:00 host2 sshd[1667112]: Invalid user lankaherbalsolutions from 152.32.201.11 port 63340


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.39.180
country_id: 6252001
description:
Nov 16 19:27:06 host2 sshd[1668998]: Disconnected from invalid user ubuntu 107.175.39.180 port 43598 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.123
country_id: 933860
description:
Nov 16 19:28:04 host2 sshd[1669578]: Disconnected from invalid user nmrsu 168.167.228.123 port 33076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.39.180
country_id: 6252001
description:
Nov 16 19:28:30 host2 sshd[1669767]: Disconnected from invalid user llm 107.175.39.180 port 52440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.39.180
country_id: 6252001
description:
Nov 16 19:29:48 host2 sshd[1670395]: Disconnected from invalid user diquest 107.175.39.180 port 48812 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.39.180
country_id: 6252001
description:
Nov 16 19:31:02 host2 sshd[1671198]: Disconnected from invalid user testing 107.175.39.180 port 40464 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.169
country_id: 2635167
description:
Nov 16 19:33:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.211.169, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<QtCDsbZDVtwjy9Op>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-11-16 19:34:20 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:46408: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Nov 16 19:34:22 host2 sshd[1673049]: Disconnected from invalid user newuser1 23.91.96.70 port 44414 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.169
country_id: 2635167
description:
Nov 16 19:34:25 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.211.169, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<InJVtbZD+vcjy9Op>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-11-16 19:34:36 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:48246: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.123
country_id: 933860
description:
Nov 16 19:35:45 host2 sshd[1673912]: Disconnected from invalid user es_user 168.167.228.123 port 33081 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.158.198
country_id: 690791
description:
Nov 16 19:38:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=37.221.158.198, lip=66.85.158.91, TLS, session=<8ZNyw7ZD35kl3Z7G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.113.255
country_id: 3057568
description:
Nov 16 19:38:57 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=91.226.113.255, lip=66.85.158.91, TLS, session=<E0uLxLZDO6Bb4nH/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 16 19:39:37 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, session=<wSbnx7ZDPuDPWvQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Nov 16 19:40:18 host2 sshd[1676563]: Disconnected from invalid user steam 23.91.96.70 port 56524 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.169
country_id: 2635167
description:
Nov 16 19:40:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.169, lip=66.85.158.92, TLS, session=</rZNzLZDpv0jy9Op>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.0.229
country_id: 690791
description:
Nov 16 19:40:54 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=176.103.0.229, lip=66.85.158.91, TLS, session=<7eaBy7ZDSsOwZwDl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.31
country_id: 690791
description:
Nov 16 19:41:12 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=194.44.140.31, lip=66.85.158.91, TLS, session=<53OdzLZDec/CLIwf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.91.96.70
country_id: 1819730
description:
Nov 16 19:42:20 host2 sshd[1677618]: Disconnected from invalid user administrador 23.91.96.70 port 51158 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.87
country_id: 6252001
description:
Nov 16 19:47:55 host2 pure-ftpd[1681101]: (?@195.184.76.87) [INFO] New connection from 195.184.76.87


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.146
country_id: 6252001
description:
Nov 16 19:47:55 host2 pure-ftpd[1681103]: (?@195.184.76.146) [INFO] New connection from 195.184.76.146


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 159.223.83.225
country_id: 1880251
description:
Nov 16 19:48:04 host2 pure-ftpd[1681247]: (?@159.223.83.225) [INFO] New connection from 159.223.83.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.6
country_id: 1733045
description:
2025-11-16 19:50:51 dovecot_login authenticator failed for ([49.124.151.6]) [49.124.151.6]:58584: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.64.225.224
country_id: 3017382
description:
2025-11-16 19:51:17 dovecot_login authenticator failed for 82-64-225-224.subs.proxad.net [82.64.225.224]:50830: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.64.118
country_id: 3996063
description:
2025-11-16 19:53:10 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:58184: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-11-16 19:53:31 dovecot_login authenticator failed for ([187.218.57.50]) [187.218.57.50]:3643: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.128.123
country_id: 2264397
description:
Nov 16 19:53:58 host2 pure-ftpd[1684752]: (?@45.156.128.123) [INFO] New connection from 45.156.128.123


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 16 20:08:55 host2 sshd[1695075]: Invalid user lankaherbalsolutions from 152.32.201.11 port 15358


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-16 20:15:40 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:47929: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-16 20:15:53 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:56788: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 16 20:17:21 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<J/reTrdDfJ3PWvQO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 20:17:51 host2 sshd[1700214]: Disconnected from invalid user user 2.57.121.25 port 54693 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 20:18:49 host2 sshd[1700706]: Disconnected from invalid user admin 2.57.121.112 port 27886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.221.149
country_id: 2077456
description:
2025-11-16 20:21:08 dovecot_login authenticator failed for ([120.157.221.149]) [120.157.221.149]:33772: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.22
country_id: 6252001
description:
Nov 16 20:21:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.133.22, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<84RsXLdD2NWTuYUW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 20:21:29 host2 sshd[1702377]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.22
country_id: 6252001
description:
Nov 16 20:21:24 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=147.185.133.22, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RgpYXbdDEvmTuYUW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.19
country_id: 1733045
description:
2025-11-16 20:22:14 dovecot_login authenticator failed for ([49.124.153.19]) [49.124.153.19]:36440: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 20:23:43 host2 sshd[1703415]: Disconnected from invalid user  2.57.121.112 port 62546 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.209.243
country_id: 1819730
description:
Nov 16 20:25:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=123.58.209.243, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ihU9ardD0u57OtHz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 16 20:25:22 host2 sshd[1704477]: Disconnected from invalid user alysha 62.60.131.157 port 33887 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.22
country_id: 6252001
description:
Nov 16 20:26:33 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.22, lip=66.85.158.91, TLS, session=<GrLBb7dD5PKTuYUW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 177.44.96.189
country_id: 3469034
description:
Nov 16 20:27:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=177.44.96.189, lip=66.85.158.91, session=<a5+ic7dDpcmxLGC9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.128
country_id: 3175395
description:
Nov 16 20:27:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=217.26.179.128, lip=66.85.158.91, TLS, session=<BV20c7dDMrzZGrOA>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.28.107.251
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 119.28.107.251 - vdeployc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user vdeployc (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.28.247
country_id: 2300660
description:
Nov 16 20:28:38 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 27 secs): user=<jagath.peiris>, method=PLAIN, rip=41.139.28.247, lip=66.85.158.91, TLS, session=<U8WZdbdDYrEpixz3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 20:29:38 host2 sshd[1706828]: Disconnected from invalid user  2.57.121.112 port 62523 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.0.191.8
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.0.191.8 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 204.111.239.143
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 204.111.239.143 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.35.239.153
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 76.35.239.153 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 16 20:34:31 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS: Connection closed, session=<YQxIjLdD2HtChJl7>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.237.136.15
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.237.136.15 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.213.178.141
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.213.178.141 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.5.55.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.5.55.206 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.250.137.126
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.250.137.126 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.178.81.97
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.178.81.97 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.154.151
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.154.151 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.42.173.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.42.173.206 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.80.137.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.80.137.26 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.8.248.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.8.248.181 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.119.180
country_id: 2215636
description:
Nov 16 20:40:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=169.239.119.180, lip=66.85.158.91, TLS, session=<OTcyn7dDDqGp73e0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.158.108
country_id: 690791
description:
Nov 16 20:40:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=37.221.158.108, lip=66.85.158.91, TLS, session=<AIZvoLdDB6kl3Z5s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 16 20:40:41 host2 sshd[1715737]: Disconnected from invalid user titus 38.47.92.86 port 47478 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 16 20:43:31 host2 sshd[1717804]: Disconnected from invalid user vtatis 38.47.92.86 port 45630 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.124.230.139
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 147.124.230.139 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Nov 16 20:48:20 host2 sshd[1721146]: Disconnected from invalid user jiel 38.47.92.86 port 43740 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.173.58.93
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.173.58.93 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.34.236.246
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 99.34.236.246 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.51.207.182
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.51.207.182 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.253.243.60
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 147.253.243.60 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.239.186.192
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.239.186.192 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.32.81.20
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 136.32.81.20 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 20:52:11 host2 sshd[1723648]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.139
country_id: 3175395
description:
Nov 16 20:52:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.139.180.139, lip=66.85.158.91, TLS, session=<aJ97y7dDkQm5i7SL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.69.35
country_id: 3469034
description:
Nov 16 20:52:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.72.69.35, lip=66.85.158.91, TLS, session=<Bn1OyrdD4KexSEUj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-11-16 20:54:39 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:51026: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.180.252.183
country_id: 6252001
description:
2025-11-16 20:54:48 dovecot_login authenticator failed for ([208.180.252.183]) [208.180.252.183]:35290: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.248.101.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 96.248.101.75 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.127.185.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.127.185.251 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.8.108.11
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 24.8.108.11 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.220.205.1
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.220.205.1 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.31.24
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.31.24 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.70.96.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.70.96.111 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.2.62.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.2.62.202 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.186
country_id: 2635167
description:
Nov 16 21:01:02 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.186, lip=66.85.158.91, TLS, session=<kc4Z67dDzde594m6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.17.154.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 47.17.154.29 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.135.15.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.135.15.89 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.37.107
country_id: 6252001
description:
[2025-11-16 21:02:43 +0530] info [whostmgrd] 47.150.37.107 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.163.136.87
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.163.136.87 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-16 21:02:50 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:56346: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.178.87.216
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.178.87.216 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.73.59.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.73.59.73 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-11-16 21:02:17 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:60326: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-11-16 21:02:37 dovecot_login authenticator failed for ([209.23.72.254]) [209.23.72.254]:49318: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.84.69.207
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.84.69.207 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:07:50 host2 sshd[1733861]: Disconnected from invalid user test 103.153.190.105 port 42591 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.28.129.102
country_id: 6252001
description:
[2025-11-16 21:08:18 +0530] info [cpaneld] 23.28.129.102 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.133.203.35
country_id: 6252001
description:
[2025-11-16 21:08:29 +0530] info [cpaneld] 72.133.203.35 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.22.70
country_id: 6252001
description:
[2025-11-16 21:08:33 +0530] info [whostmgrd] 67.188.22.70 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 148.74.84.235
country_id: 6252001
description:
[2025-11-16 21:08:44 +0530] info [cpaneld] 148.74.84.235 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.158.12.249
country_id: 6252001
description:
[2025-11-16 21:08:31 +0530] info [cpaneld] 47.158.12.249 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.23.212.106
country_id: 6252001
description:
[2025-11-16 21:08:41 +0530] info [cpaneld] 73.23.212.106 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.119.11
country_id: 6252001
description:
[2025-11-16 21:08:48 +0530] info [cpaneld] 143.105.119.11 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 16 21:12:00 host2 sshd[1736279]: Invalid user visionsolutionshospital from 154.219.110.64 port 52352


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 21:15:51 host2 sshd[1738362]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.251
country_id: 6252001
description:
Nov 16 21:21:18 host2 pure-ftpd[1741594]: (?@198.235.24.251) [INFO] New connection from 198.235.24.251


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Nov 16 21:24:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.91, session=<jg/VPbhDZCvY2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Nov 16 21:24:30 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.222, lip=66.85.158.91, TLS handshaking: Connection closed, session=<B+j7PrhDcnxAPpze>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:26:25 host2 sshd[1744638]: Disconnected from invalid user npm 103.153.190.105 port 38264 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.49.141.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.49.141.16 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.5.225.134
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.5.225.134 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.60.64.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.60.64.250 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.2.171.30
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.2.171.30 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 16 21:30:27 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, TLS, session=<r6pRVLhDcposyhQX>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.144.114.57
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.144.114.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.104.200.89
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 68.104.200.89 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.47.84.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.47.84.138 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.8.166.171
country_id: 3469034
description:
Nov 16 21:37:48 host2 sshd[1751593]: Disconnected from invalid user jhcho 177.8.166.171 port 57488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.8.166.171
country_id: 3469034
description:
Nov 16 21:39:37 host2 sshd[1752403]: Disconnected from invalid user test 177.8.166.171 port 39518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.243.82.123
country_id: 3625428
description:
Nov 16 21:40:44 host2 sshd[1753161]: Disconnected from invalid user dylan 201.243.82.123 port 58004 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.84
country_id: 1733045
description:
2025-11-16 21:40:45 dovecot_login authenticator failed for ([49.125.201.84]) [49.125.201.84]:43848: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-16 21:41:04 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:57336: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:40:08 host2 sshd[1752784]: Disconnected from invalid user tesoreria 103.153.190.105 port 59450 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.8.166.171
country_id: 3469034
description:
Nov 16 21:41:16 host2 sshd[1753472]: Disconnected from invalid user admin 177.8.166.171 port 33840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:44:42 host2 sshd[1756308]: Disconnected from invalid user me 103.153.190.105 port 42061 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.243.82.123
country_id: 3625428
description:
Nov 16 21:46:43 host2 sshd[1769818]: Disconnected from invalid user ubuntu 201.243.82.123 port 34498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:49:22 host2 sshd[1771539]: Disconnected from invalid user ubuntu 103.153.190.105 port 53625 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.243.82.123
country_id: 3625428
description:
Nov 16 21:50:38 host2 sshd[1772317]: Disconnected from invalid user ubuntu 201.243.82.123 port 36780 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.243.82.123
country_id: 3625428
description:
Nov 16 21:52:10 host2 sshd[1773079]: Disconnected from invalid user admin 201.243.82.123 port 37918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Nov 16 21:53:50 host2 sshd[1773883]: Disconnected from invalid user bit 103.153.190.105 port 33794 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.158
country_id: 1269750
description:
2025-11-16 21:54:26 dovecot_login authenticator failed for ([182.79.5.249]) [128.185.208.158]:42926: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.95.56.101
country_id: 1527747
description:
2025-11-16 21:54:42 dovecot_login authenticator failed for (77-95-56-101.elcat.kg) [77.95.56.101]:34468: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.83
country_id: 6252001
description:
Nov 16 21:58:55 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=199.45.155.83, lip=66.85.158.91, TLS: Connection closed, session=<l2IXurhDmvnHLZtT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.180
country_id: 6252001
description:
Nov 16 21:59:12 host2 pure-ftpd[1777677]: (?@198.235.24.180) [INFO] New connection from 198.235.24.180


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.73
country_id: 6252001
description:
Nov 16 22:11:10 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.73, lip=66.85.158.92, session=<C4Dp5bhD40JAPsVJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 16 22:11:12 host2 sshd[1785091]: Invalid user lankaherbalsolutions from 102.213.181.98 port 49794


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.195
country_id: 6252001
description:
Nov 16 22:11:21 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.195, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9kmW5rhDNddAPsXD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Nov 16 22:11:42 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<iJLU57hD7odAPsW2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.62
country_id: 6252001
description:
Nov 16 22:11:23 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.62, lip=66.85.158.92, TLS: Connection closed, session=<5B605rhDjIVAPsU+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 22:11:54 host2 sshd[1785464]: Disconnected from invalid user  2.57.121.112 port 61426 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 143.244.152.105
country_id: 6252001
description:
Nov 16 22:20:30 host2 pure-ftpd[1790603]: (?@143.244.152.105) [INFO] New connection from 143.244.152.105


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.204
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.204: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 22:30:22 host2 sshd[1798107]: Disconnected from invalid user admin 2.57.121.112 port 30008 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 22:36:40 host2 sshd[1801373]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.200
country_id: 6252001
description:
Nov 16 22:38:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.200, lip=66.85.158.91, session=<pNgQRrlD7RBAPpzI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 16 22:38:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.91, TLS: Connection closed, session=<XsniRrlDwKBAPpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.202.236
country_id: 6251999
description:
Nov 16 22:56:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.202.236, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<6N3ah7lDcu2Ay8rs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-16 23:00:16 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:58544: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.160.115.11
country_id: 6252001
description:
2025-11-16 23:01:19 dovecot_plain authenticator failed for ([10.4.14.86]) [209.160.115.11]:55948: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.0
country_id: 6252001
description:
Nov 16 23:01:15 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.193.0, lip=66.85.158.91, TLS handshaking: Connection closed, session=<M0wGmblD8pkUQcEA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Nov 16 23:06:40 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 33 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cedgrLlDLrNChJmH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 16 23:18:46 host2 sshd[1832162]: Disconnected from invalid user aa 146.190.154.85 port 33408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 16 23:20:09 host2 sshd[1833146]: Disconnected from invalid user builduser 146.190.154.85 port 55530 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.154.85
country_id: 6252001
description:
Nov 16 23:23:41 host2 sshd[1835360]: Disconnected from invalid user panel 146.190.154.85 port 40648 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 23:30:29 host2 sshd[1839976]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.163
country_id: 6252001
description:
Nov 16 23:31:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.163, lip=66.85.158.92, TLS, session=<vRzKA7pDGK0UQcGj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.91
country_id: 1733045
description:
Nov 16 23:32:36 host2 sshd[1841375]: Disconnected from invalid user deploy 103.159.132.91 port 56364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 16 23:33:31 host2 sshd[1841981]: Disconnected from invalid user user 2.57.121.25 port 36501 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.126
country_id: 6252001
description:
Nov 16 23:34:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.126, lip=66.85.158.92, TLS handshaking: Connection closed, session=</cpPDrpDy31BMQF+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.122
country_id: 6252001
description:
Nov 16 23:34:25 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.122, lip=66.85.158.92, TLS handshaking: Connection closed, session=<IBGfD7pDqP5BMQF6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov 16 23:35:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.92, TLS: Connection closed, session=<CUxkE7pDTAxChJl6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.91
country_id: 1733045
description:
Nov 16 23:35:46 host2 sshd[1843953]: Disconnected from invalid user rami 103.159.132.91 port 57758 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.159.132.91
country_id: 1733045
description:
Nov 16 23:37:19 host2 sshd[1845202]: Disconnected from invalid user landi 103.159.132.91 port 58460 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 16 23:37:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.163, lip=66.85.158.92, session=<pLo3GrpDT//CpRCj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.91
country_id: 1733045
description:
Nov 16 23:38:47 host2 sshd[1846389]: Disconnected from invalid user sanjay 103.159.132.91 port 59154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.159.132.91
country_id: 1733045
description:
Nov 16 23:40:13 host2 sshd[1847534]: Disconnected from invalid user sshuser 103.159.132.91 port 59852 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.26
country_id: 6252001
description:
Nov 16 23:42:35 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.26, lip=66.85.158.91, session=<5yPVLLpD4JSH7X0a>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov 16 23:45:47 host2 sshd[1852152]: Disconnected from invalid user sanjay 152.32.172.146 port 35564 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.128.205
country_id: 6252001
description:
Nov 16 23:45:58 host2 dovecot[3661788]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.128.205, lip=66.85.158.92, session=<THTzOLpDTq4tT4DN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Nov 16 23:46:55 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<mR5SPLpDNGtKUi8C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Nov 16 23:47:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.2, lip=66.85.158.92, TLS handshaking: Connection closed, session=<6eOYPbpD8jlKUi8C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov 16 23:49:25 host2 sshd[1854731]: Disconnected from invalid user stack 152.32.172.146 port 43020 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.119
country_id: 6252001
description:
Nov 16 23:50:32 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.119, lip=66.85.158.91, TLS: Connection closed, session=<7l9KSbpDDmhChJl3>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.146
country_id: 1819730
description:
Nov 16 23:50:50 host2 sshd[1855689]: Disconnected from invalid user lzj 152.32.172.146 port 60902 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 16 23:51:37 host2 sshd[1856116]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-16 23:52:39 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:48543: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 16 23:52:43 host2 sshd[1857185]: Disconnected from invalid user admin 2.57.121.112 port 41289 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-16 23:52:58 dovecot_login authenticator failed for ([125.23.229.142]) [125.19.248.170]:43194: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.210
country_id: 3686110
description:
Nov 16 23:53:00 host2 sshd[1857381]: Disconnected from invalid user pwserver 138.84.41.210 port 5691 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.146
country_id: 1819730
description:
Nov 16 23:53:19 host2 sshd[1857620]: Disconnected from invalid user dmp 152.32.172.146 port 54308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 16 23:53:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.91, session=<xS10U7pDRMeUccE7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 16 23:54:06 host2 sshd[1858282]: Disconnected from invalid user wanghao 158.178.141.16 port 10436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2025-11-16 23:55:07 dovecot_login authenticator failed for ([31.141.216.143]) [31.141.216.143]:53812: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Nov 16 23:55:16 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS: Connection closed, session=<D4MsWrpDIHtChJmH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 16 23:55:44 host2 sshd[1860303]: Disconnected from invalid user art1 51.77.149.244 port 45196 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-16 23:55:47 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:41332: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.135
country_id: 6252001
description:
Nov 16 23:55:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 2 secs): user=<>, rip=66.132.153.135, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<XpuoWrpDCDdChJmH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 16 23:57:58 host2 sshd[1861692]: Disconnected from invalid user testadmin 158.178.141.16 port 61972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 16 23:58:06 host2 sshd[1861811]: Disconnected from invalid user ftpuser 51.77.149.244 port 55454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 16 23:59:12 host2 sshd[1862529]: Disconnected from invalid user wanghao 51.77.149.244 port 44184 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.84.41.210
country_id: 3686110
description:
Nov 16 23:58:22 host2 sshd[1862060]: Disconnected from invalid user utente 138.84.41.210 port 7762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 16 23:59:26 host2 sshd[1862636]: Disconnected from invalid user synology 158.178.141.16 port 52868 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 17 00:00:13 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, session=<70jra7pDPKa4aYtF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 17 00:00:18 host2 sshd[1863548]: Disconnected from invalid user felix 51.77.149.244 port 44078 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 17 00:00:27 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.139.69, lip=66.85.158.92, TLS: Connection closed, session=<Mky4bLpDFHO4aYtF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 17 00:00:53 host2 sshd[1863974]: Disconnected from invalid user lighthouse 158.178.141.16 port 14182 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.137
country_id: 6252001
description:
Nov 17 00:01:59 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.137, lip=66.85.158.92, session=<tsw4crpDWrCH7X2J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 17 00:01:22 host2 sshd[1864377]: Disconnected from invalid user synology 51.77.149.244 port 51570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.100.203.79
country_id: 6252001
description:
Nov 17 00:02:47 host2 sshd[1865250]: Disconnected from invalid user ftpuser 38.100.203.79 port 42936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.210
country_id: 3686110
description:
Nov 17 00:03:21 host2 sshd[1866003]: Disconnected from invalid user stack 138.84.41.210 port 27358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 17 00:03:42 host2 sshd[1866271]: Disconnected from invalid user victor 158.178.141.16 port 60606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 17 00:03:34 host2 sshd[1866146]: Disconnected from invalid user jarservice 51.77.149.244 port 33274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.100.203.79
country_id: 6252001
description:
Nov 17 00:05:53 host2 sshd[1868182]: Disconnected from invalid user esuser 38.100.203.79 port 53894 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.77.149.244
country_id: 3017382
description:
Nov 17 00:05:38 host2 sshd[1867968]: Disconnected from invalid user testadmin 51.77.149.244 port 59312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 17 00:07:45 host2 sshd[1869285]: Disconnected from invalid user pc 158.178.141.16 port 39576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.210
country_id: 3686110
description:
Nov 17 00:08:27 host2 sshd[1869745]: Disconnected from invalid user test3 138.84.41.210 port 38638 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.178.141.16
country_id: 2077456
description:
Nov 17 00:09:10 host2 sshd[1870192]: Disconnected from invalid user harry 158.178.141.16 port 11572 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.165.90.3
country_id: 6252001
description:
Nov 17 00:10:29 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.165.90.3, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<QM6YkLpDXMo0pVoD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.83
country_id: 798544
description:
2025-11-17 00:11:30 dovecot_login authenticator failed for (Copy-of-VM-2022) [185.241.208.83]:62466: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.157.205.143
country_id: 3469034
description:
Nov 17 00:26:48 host2 sshd[1880943]: Disconnected from invalid user vishal 177.157.205.143 port 60740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.150.152.105
country_id: 6252001
description:
Nov 17 00:29:17 host2 sshd[1882628]: Disconnected from invalid user admin 23.150.152.105 port 55088 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 00:31:03 host2 sshd[1883954]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.150.152.105
country_id: 6252001
description:
Nov 17 00:31:59 host2 sshd[1884457]: Disconnected from invalid user admin 23.150.152.105 port 39956 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.14.28
country_id: 1668284
description:
Nov 17 00:32:53 host2 sshd[1885017]: Disconnected from invalid user admin 165.154.14.28 port 39684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.150.152.105
country_id: 6252001
description:
Nov 17 00:34:23 host2 sshd[1885881]: Disconnected from invalid user app 23.150.152.105 port 35722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.157.205.143
country_id: 3469034
description:
Nov 17 00:34:55 host2 sshd[1886148]: Disconnected from invalid user admin 177.157.205.143 port 38614 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.150.152.105
country_id: 6252001
description:
Nov 17 00:36:36 host2 sshd[1887354]: Disconnected from invalid user admin 23.150.152.105 port 59700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 17 00:36:56 host2 sshd[1887537]: Invalid user lankaherbalsolutions from 152.32.201.11 port 45162


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.14.28
country_id: 1668284
description:
Nov 17 00:37:59 host2 sshd[1888065]: Disconnected from invalid user osadmin 165.154.14.28 port 33884 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Nov 17 00:37:39 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=167.94.146.60, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pGnI8bpD8EKnXpI8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.157.205.143
country_id: 3469034
description:
Nov 17 00:39:28 host2 sshd[1888903]: Disconnected from invalid user sftpuser 177.157.205.143 port 49930 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.86.194
country_id: 2635167
description:
Nov 17 00:39:42 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.99.86.194, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pMkZ+bpDjI2nY1bC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.209.221.7
country_id: 1861060
description:
2025-11-17 00:55:25 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:52090: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.223
country_id: 6252001
description:
Nov 17 00:55:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.223, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<zfrdMrtDm9nN0h/f>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Nov 17 01:00:08 host2 sshd[1903860]: Disconnected from invalid user ljsoft 196.0.120.211 port 38470 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.130.219.52
country_id: 2017370
description:
[2025-11-17 01:01:50 +0530] info [cpaneld] 188.130.219.52 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.211
country_id: 226074
description:
Nov 17 01:04:22 host2 sshd[1907497]: Disconnected from invalid user amit 196.0.120.211 port 47758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Nov 17 01:06:02 host2 sshd[1908547]: Disconnected from invalid user dennis 196.0.120.211 port 47750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Nov 17 01:07:36 host2 sshd[1909279]: Disconnected from invalid user testuser 196.0.120.211 port 47748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-17 01:08:18 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:57492: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-11-17 01:08:34 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:40520: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.167.238.118
country_id: 1861060
description:
Nov 17 01:10:56 host2 sshd[1912132]: Disconnected from invalid user ubuntu 43.167.238.118 port 42046 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.210
country_id: 6252001
description:
Nov 17 01:11:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.210, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mgeSartDedPN0h/S>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.167.238.118
country_id: 1861060
description:
Nov 17 01:12:22 host2 sshd[1912941]: Disconnected from invalid user lol 43.167.238.118 port 49360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.167.238.118
country_id: 1861060
description:
Nov 17 01:13:48 host2 sshd[1913668]: Disconnected from invalid user user2 43.167.238.118 port 58404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 01:13:55 host2 sshd[1913709]: Disconnected from invalid user admin 2.57.121.112 port 39713 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.217
country_id: 1643084
description:
Nov 17 01:16:13 host2 sshd[1915434]: Invalid user lankaherbalsolutions from 103.189.235.217 port 55688


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.116.91.180 - cloudt "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudt (has_cpuser_file failed)


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 136.116.91.180
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 136.116.91.180 - travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid webmail user travel (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.151
country_id: 1880251
description:
Nov 17 01:19:08 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=15.235.189.151, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xTAdhrtDx5oP672X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.159
country_id: 1880251
description:
Nov 17 01:19:11 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=15.235.189.159, lip=66.85.158.91, TLS: Connection closed, session=<6stNhrtDedEP672f>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.158
country_id: 1880251
description:
Nov 17 01:18:23 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=15.235.189.158, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OKF5g7tDw5kP672e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.189.145
country_id: 1880251
description:
Nov 17 01:18:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=15.235.189.145, lip=66.85.158.91, TLS: Connection closed, session=<IS10hLtDBe4P672R>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.131.131.43
country_id: 1269750
description:
Nov 17 01:20:30 host2 sshd[1918644]: Disconnected from invalid user bala 34.131.131.43 port 60646 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-17 01:23:18 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49311: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 01:24:37 host2 sshd[1920791]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 17 01:25:53 host2 sshd[1921739]: Disconnected from invalid user ubuntu 182.93.50.90 port 55466 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Nov 17 01:26:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<J8wOobtDu/7CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 01:27:11 host2 sshd[1922298]: Disconnected from invalid user  2.57.121.112 port 62083 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-17 01:29:22 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:49270: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.160
country_id: 1733045
description:
2025-11-17 01:29:49 dovecot_login authenticator failed for ([49.124.154.160]) [49.124.154.160]:47448: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 01:32:51 host2 sshd[1925353]: Disconnected from invalid user  2.57.121.112 port 62633 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 17 01:35:05 host2 sshd[1926685]: Disconnected from invalid user user2 182.93.50.90 port 48416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-11-17 01:37:49 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:60882: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 17 01:38:12 host2 sshd[1928656]: Disconnected from invalid user admin 182.93.50.90 port 43880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2025-11-17 01:38:27 dovecot_login authenticator failed for (164-53-26-103.intechonline.net) [103.26.53.164]:39762: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.39
country_id: 6252001
description:
Nov 17 01:39:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.39, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<qku+zrtDuM+TuYQn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.50.90
country_id: 1821275
description:
Nov 17 01:44:18 host2 sshd[1932790]: Disconnected from invalid user sage 182.93.50.90 port 53420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.217
country_id: 1643084
description:
Nov 17 01:45:16 host2 sshd[1933817]: Invalid user lankaherbalsolutions from 103.189.235.217 port 58940


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
country_id: 798544
description:
2025-11-17 01:57:01 dovecot_login authenticator failed for 5.185.198.73.ipv4.public.orange.pl [5.185.198.73]:48886: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Nov 17 02:08:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=</SnSN7xDwv7CpRCi>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.172
country_id: 6252001
description:
Nov 17 02:11:44 host2 pure-ftpd[1950930]: (?@205.210.31.172) [INFO] New connection from 205.210.31.172


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.87
country_id: 6252001
description:
Nov 17 02:13:53 host2 pure-ftpd[1951943]: (?@205.210.31.87) [INFO] New connection from 205.210.31.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-11-17 02:16:05 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:60660: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-11-17 02:15:37 dovecot_login authenticator failed for ([103.83.130.80]) [103.83.130.80]:59988: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.95.56.101
country_id: 1527747
description:
2025-11-17 02:16:24 dovecot_login authenticator failed for (77-95-56-101.elcat.kg) [77.95.56.101]:48552: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 17 02:20:49 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I1C4YrxDmEVChJly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.237.117
country_id: 130758
description:
2025-11-17 02:21:29 dovecot_login authenticator failed for (kqTHO1) [195.24.237.117]:64061: 535 Incorrect authentication data (set_id=u003eamila)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 02:25:00 host2 sshd[1958062]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.219.146
country_id: 6252001
description:
Nov 17 02:28:54 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=66.240.219.146, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<v6Smf7xDxK9C8NuS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.206
country_id: 1861060
description:
2025-11-17 02:31:57 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.206]:62434: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-11-17 02:32:19 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:56608: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.50
country_id: 3017382
description:
Nov 17 02:35:38 host2 pure-ftpd[1964811]: (?@91.196.152.50) [INFO] New connection from 91.196.152.50


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.49
country_id: 3017382
description:
Nov 17 02:35:37 host2 pure-ftpd[1964809]: (?@91.196.152.49) [INFO] New connection from 91.196.152.49


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.240
country_id: 6252001
description:
Nov 17 02:36:36 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.240, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<50owm7xDIduTuYTw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.228
country_id: 6251999
description:
Nov 17 02:38:30 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=148.113.210.228, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<vO3wobxD8JuUcdLk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.28.138
country_id: 1269750
description:
2025-11-17 02:45:13 dovecot_login authenticator failed for ([125.17.28.112]) [125.17.28.138]:45444: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-17 02:45:57 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:45964: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.237.117
country_id: 130758
description:
2025-11-17 03:03:56 dovecot_login authenticator failed for (f1qMruxJU) [195.24.237.117]:60831: 535 Incorrect authentication data (set_id=u003eamila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 03:05:54 host2 sshd[1984067]: Disconnected from invalid user maria 2.57.121.112 port 62335 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.237.117
country_id: 130758
description:
2025-11-17 03:08:03 dovecot_login authenticator failed for (OrbmUaUEMl) [195.24.237.117]:61085: 535 Incorrect authentication data (set_id=u003eamila)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 03:09:11 host2 sshd[1986142]: Disconnected from invalid user admin 2.57.121.112 port 28709 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 03:18:24 host2 sshd[1992224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 17 03:21:27 host2 sshd[1994167]: Disconnected from invalid user deployer 209.141.53.124 port 37390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.15.139
country_id: 6252001
description:
Nov 17 03:23:51 host2 sshd[1995613]: Disconnected from invalid user teamspeak 107.172.15.139 port 53290 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 17 03:23:15 host2 sshd[1995308]: Disconnected from invalid user prueba 209.141.53.124 port 36652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.15.139
country_id: 6252001
description:
Nov 17 03:26:38 host2 sshd[1997590]: Disconnected from invalid user phoenix 107.172.15.139 port 54770 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.15.139
country_id: 6252001
description:
Nov 17 03:27:57 host2 sshd[1998415]: Disconnected from invalid user ftpuser 107.172.15.139 port 43974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.15.139
country_id: 6252001
description:
Nov 17 03:29:14 host2 sshd[1999116]: Disconnected from invalid user m 107.172.15.139 port 54532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Nov 17 03:40:47 host2 sshd[2006329]: Disconnected from invalid user m 209.141.53.124 port 57596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 03:53:38 host2 sshd[2017442]: Disconnected from invalid user admin 2.57.121.112 port 22589 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov 17 03:54:12 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ZuassL1DWP4t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.116.162.215
country_id: 6251999
description:
2025-11-17 03:57:31 dovecot_login authenticator failed for ([206.116.162.215]) [206.116.162.215]:39204: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.115.177.212
country_id: 6251999
description:
2025-11-17 03:57:52 dovecot_login authenticator failed for ([209.115.177.212]) [209.115.177.212]:57598: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.74.229.158
country_id: 2510769
description:
Nov 17 04:11:36 host2 sshd[2036577]: Disconnected from invalid user zz 77.74.229.158 port 60124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 17 04:13:04 host2 sshd[2038391]: Disconnected from invalid user wialon 156.236.75.209 port 38052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 17 04:14:41 host2 sshd[2040012]: Disconnected from invalid user ludmila 156.236.75.209 port 46666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 17 04:15:08 host2 sshd[2040477]: Disconnected from invalid user kirin 155.4.244.169 port 54722 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 04:18:44 host2 sshd[2045913]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 17 04:18:35 host2 sshd[2045850]: Disconnected from invalid user pterodactyl 155.4.244.169 port 19717 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 17 04:19:10 host2 sshd[2046163]: Disconnected from invalid user qwerty 156.236.75.209 port 37864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 17 04:20:09 host2 sshd[2046799]: Disconnected from invalid user ludmila 155.4.244.169 port 40164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.74.229.158
country_id: 2510769
description:
Nov 17 04:20:13 host2 sshd[2046891]: Disconnected from invalid user mysqladmin 77.74.229.158 port 48432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.74.229.158
country_id: 2510769
description:
Nov 17 04:21:32 host2 sshd[2047714]: Disconnected from invalid user insight 77.74.229.158 port 33898 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Nov 17 04:22:49 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, session=<AKQFF75DvAjCpRCh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Nov 17 04:23:46 host2 sshd[2049168]: Disconnected from invalid user debian 155.4.244.169 port 14016 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.74.229.158
country_id: 2510769
description:
Nov 17 04:24:17 host2 sshd[2049479]: Disconnected from invalid user t 77.74.229.158 port 47272 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Nov 17 04:24:45 host2 sshd[2049680]: Disconnected from invalid user qwerty 103.98.176.164 port 39560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.98.176.164
country_id: 1643084
description:
Nov 17 04:26:25 host2 sshd[2050878]: Disconnected from invalid user wialon 103.98.176.164 port 60166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.28.73.178
country_id: 3923057
description:
2025-11-17 04:27:48 dovecot_plain authenticator failed for ([31.57.166.48]) [189.28.73.178]:8418: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.209
country_id: 1819730
description:
Nov 17 04:28:46 host2 sshd[2052096]: Disconnected from invalid user jet 156.236.75.209 port 55086 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.98.176.164
country_id: 1643084
description:
Nov 17 04:31:30 host2 sshd[2053912]: Disconnected from invalid user debian 103.98.176.164 port 39346 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Nov 17 04:33:00 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.76, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<SyB1O75Db46594lM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.52
country_id: 2635167
description:
Nov 17 04:32:59 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.52, lip=66.85.158.91, TLS, session=<W3hhO75DT95X7LA0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.87
country_id: 2635167
description:
Nov 17 04:33:33 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.87, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<m5NwPb5D/5i594lX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.83
country_id: 2635167
description:
Nov 17 04:34:07 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.83, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<oSZsP75DT5W594lT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.93
country_id: 2635167
description:
Nov 17 04:34:40 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.93, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<RZxnQb5D4Y+594ld>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-17 04:35:53 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:55315: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.174
country_id: 6252001
description:
Nov 17 04:35:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.174, lip=66.85.158.92, session=<Y64iRr5DWP7G6xiu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.89
country_id: 2635167
description:
Nov 17 04:35:13 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.89, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<mQxjQ75DK5tX7LBZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.90
country_id: 2635167
description:
Nov 17 04:35:46 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.90, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<x3NcRb5DQ7e594la>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.89
country_id: 2635167
description:
Nov 17 04:36:20 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.89, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<xKxZR75Dv7FX7LBZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.82
country_id: 2635167
description:
Nov 17 04:36:53 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.82, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<GhBVSb5DhZhX7LBS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.105
country_id: 2635167
description:
Nov 17 04:37:26 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.105, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<WINOS75DF5pX7LBp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.82
country_id: 2635167
description:
Nov 17 04:37:59 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.82, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<+dhJTb5Dj4W594lS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.11
country_id: 1861060
description:
Nov 17 04:38:37 host2 sshd[2058086]: Invalid user lankaherbalsolutions from 152.32.201.11 port 62930


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 04:44:21 host2 sshd[2061659]: Disconnected from invalid user joyce 2.57.121.112 port 62389 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.213.181.98
country_id: 2215636
description:
Nov 17 04:46:53 host2 sshd[2063647]: Invalid user lankaherbalsolutions from 102.213.181.98 port 41068


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 04:48:09 host2 sshd[2064494]: Disconnected from invalid user user 2.57.121.25 port 37541 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.71.35
country_id: 6252001
description:
2025-11-17 04:48:15 dovecot_login authenticator failed for ([65.76.71.35]) [65.76.71.35]:36094: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.68.141
country_id: 294640
description:
2025-11-17 04:48:33 dovecot_login authenticator failed for (31-154-68-141.orange.net.il) [2.55.68.141]:52002: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 04:49:57 host2 sshd[2066060]: Disconnected from invalid user  2.57.121.112 port 63052 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.110
country_id: 2635167
description:
Nov 17 04:52:03 host2 dovecot[3661788]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.110, lip=66.85.158.92, TLS, session=<KoqPf75DZ+NX7LBu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 04:56:21 host2 sshd[2070727]: Disconnected from invalid user karson 62.60.131.157 port 12490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.71.227.12
country_id: 285570
description:
2025-11-17 04:56:45 dovecot_plain authenticator failed for ([31.57.166.48]) [188.71.227.12]:60210: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Nov 17 05:04:27 host2 sshd[2075743]: Disconnected from invalid user david 195.199.212.141 port 39570 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.92.242.214
country_id: 2750405
description:
Nov 17 05:06:44 host2 pure-ftpd[2077284]: (?@91.92.242.214) [INFO] New connection from 91.92.242.214


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Nov 17 05:07:39 host2 sshd[2077732]: Disconnected from invalid user angela 103.187.165.26 port 46280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-11-17 05:15:02 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:43857: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-17 05:14:48 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:34780: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Nov 17 05:15:18 host2 sshd[2082930]: Disconnected from invalid user nextcloud 103.187.165.26 port 41114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Nov 17 05:16:29 host2 sshd[2083826]: Disconnected from invalid user ubuntu 195.199.212.141 port 59092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Nov 17 05:16:57 host2 sshd[2084105]: Disconnected from invalid user mysftp 103.187.165.26 port 37854 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.92.242.214
country_id: 2750405
description:
Nov 17 05:18:07 host2 pure-ftpd[2084775]: (?@91.92.242.214) [INFO] New connection from 91.92.242.214


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.169.49.231
country_id: 6252001
description:
Nov 17 05:18:57 host2 pure-ftpd[2085273]: (?@20.169.49.231) [INFO] New connection from 20.169.49.231


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.165.26
country_id: 1643084
description:
Nov 17 05:18:35 host2 sshd[2085041]: Disconnected from invalid user foundry 103.187.165.26 port 45340 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 05:19:41 host2 sshd[2085624]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 17 05:20:57 host2 sshd[2086476]: Disconnected from invalid user pydio 130.107.240.11 port 57934 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.190.57
country_id: 6251999
description:
Nov 17 05:22:50 host2 pure-ftpd[2087479]: (?@148.113.190.57) [INFO] New connection from 148.113.190.57


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.190.57
country_id: 6251999
description:
Nov 17 05:22:57 host2 pure-ftpd[2087540]: (?@148.113.190.57) [INFO] New connection from 148.113.190.57


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 17 05:26:10 host2 sshd[2090228]: Disconnected from invalid user user1 130.107.240.11 port 58972 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 17 05:27:37 host2 sshd[2090938]: Disconnected from invalid user user03 130.107.240.11 port 48688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.107.240.11
country_id: 6251999
description:
Nov 17 05:28:55 host2 sshd[2091896]: Disconnected from invalid user andreas 130.107.240.11 port 57322 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-11-17 05:38:29 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:34572: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.92.115.73
country_id: 6252001
description:
2025-11-17 05:39:19 dovecot_login authenticator failed for ([168.92.115.73]) [168.92.115.73]:57394: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 05:47:36 host2 sshd[2104659]: Disconnected from invalid user admin 2.57.121.112 port 15919 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 06:12:27 host2 sshd[2120751]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-11-17 06:15:36 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:48294: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-11-17 06:15:51 dovecot_login authenticator failed for (177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:56625: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.111
country_id: 6252001
description:
Nov 17 06:27:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.111, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FO0H1L9DocTG6xhv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 06:28:25 host2 sshd[2129921]: Disconnected from invalid user admin 2.57.121.112 port 61983 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.89
country_id: 1880251
description:
Nov 17 06:32:29 host2 sshd[2132611]: Disconnected from invalid user appuser 45.78.198.89 port 47220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Nov 17 06:35:24 host2 sshd[2134331]: Disconnected from invalid user martin 185.158.22.150 port 50814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 06:36:25 host2 sshd[2135016]: Disconnected from invalid user user 2.57.121.25 port 19796 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.22.150
country_id: 99237
description:
Nov 17 06:41:52 host2 sshd[2137947]: Disconnected from invalid user maman 185.158.22.150 port 1960 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:44:24 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<RQFZEcBDDoYDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:45:54 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<O0e8FsBDHpYDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Nov 17 06:45:41 host2 sshd[2140500]: Disconnected from invalid user sanjay 185.158.22.150 port 61554 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:46:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<s9ltGMBD0J4DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-11-17 06:46:58 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:40492: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:47:14 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<80l8G8BDZo0DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-17 06:47:22 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:35292: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:49:10 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<V5lvIsBD/tMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 17 06:49:20 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.113, lip=66.85.158.91, TLS handshaking: Connection closed, session=<BL0AI8BDEOBChJlx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.89
country_id: 1880251
description:
Nov 17 06:49:24 host2 sshd[2142481]: Disconnected from invalid user ubuntu 45.78.198.89 port 51132 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:51:09 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<vqSHKcBDGMEDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Nov 17 06:52:28 host2 sshd[2144300]: Disconnected from invalid user winter 185.158.22.150 port 2718 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:53:48 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<9ZT9MsBDkrUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.195
country_id: 6252001
description:
Nov 17 06:54:45 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.195, lip=66.85.158.92, TLS, session=<FMpdNsBDXvyTuYTD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:54:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EB2eNsBDdKcDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.198.89
country_id: 1880251
description:
Nov 17 06:54:51 host2 sshd[2145963]: Disconnected from invalid user martin 45.78.198.89 port 46938 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 17 06:55:47 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<608XOsBDWuUDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 90.224.44.204
country_id: 2661886
description:
Nov 17 06:56:58 host2 sshd[2147228]: Disconnecting invalid user admin 90.224.44.204 port 55466: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 90.224.44.204
country_id: 2661886
description:
Nov 17 06:56:46 host2 sshd[2147143]: Disconnecting authenticating user root 90.224.44.204 port 52996: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 90.224.44.204
country_id: 2661886
description:
Nov 17 06:56:46 host2 sshd[2147143]: error: maximum authentication attempts exceeded for root from 90.224.44.204 port 52996 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.89
country_id: 1880251
description:
Nov 17 06:57:44 host2 sshd[2147600]: Disconnected from invalid user maman 45.78.198.89 port 32798 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-11-17 07:03:51 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:58083: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.171
country_id: 1733045
description:
2025-11-17 07:04:17 dovecot_login authenticator failed for ([183.171.7.171]) [183.171.7.171]:33680: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-17 07:04:50 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:58510: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 07:06:04 host2 sshd[2153188]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 41.107.82.252
country_id: 2589581
description:
Nov 17 07:20:25 host2 pure-ftpd[2161500]: (?@41.107.82.252) [WARNING] Authentication failed for user [awanish@maximsholdings.com]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 41.107.82.252
country_id: 2589581
description:
Nov 17 07:20:18 host2 pure-ftpd[2161500]: (?@41.107.82.252) [INFO] New connection from 41.107.82.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.107.82.252
country_id: 2589581
description:
Nov 17 07:20:19 host2 sshd[2161501]: Invalid user awanish@maximsholdings.com from 41.107.82.252 port 56975


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-11-17 07:23:04 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:47903: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.217
country_id: 1733045
description:
2025-11-17 07:22:13 dovecot_login authenticator failed for ([49.124.149.217]) [49.124.149.217]:51328: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.65.108
country_id: 2077456
description:
2025-11-17 07:22:47 dovecot_login authenticator failed for ([120.157.65.108]) [120.157.65.108]:57170: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.177
country_id: 6252001
description:
Nov 17 07:30:49 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.177, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iTlbt8BDE9LG6xix>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 07:33:52 host2 sshd[2169088]: Disconnected from invalid user alex 62.60.131.157 port 44482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 07:35:22 host2 sshd[2170113]: Disconnected from invalid user user 2.57.121.25 port 37085 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.229.10.11
country_id: 3175395
description:
Nov 17 07:45:20 host2 sshd[2176456]: Disconnected from invalid user ftpuser 95.229.10.11 port 52970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Nov 17 07:47:04 host2 sshd[2177252]: Disconnected from invalid user nexus 37.252.188.15 port 35398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Nov 17 07:47:16 host2 sshd[2177338]: Disconnected from invalid user afzal 157.66.34.121 port 34258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.43.189.36
country_id: 2658434
description:
Nov 17 07:47:30 host2 sshd[2177450]: Disconnected from invalid user lijy 179.43.189.36 port 36238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Nov 17 07:48:00 host2 sshd[2177664]: Disconnected from invalid user lijy 45.202.211.6 port 53054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.229.10.11
country_id: 3175395
description:
Nov 17 07:48:52 host2 sshd[2178210]: Disconnected from invalid user lijy 95.229.10.11 port 38176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.252.188.15
country_id: 2782113
description:
Nov 17 07:48:18 host2 sshd[2177870]: Disconnected from invalid user dmdba 37.252.188.15 port 36836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.43.189.36
country_id: 2658434
description:
Nov 17 07:49:50 host2 sshd[2178691]: Disconnected from invalid user thiago 179.43.189.36 port 33560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.43.189.36
country_id: 2658434
description:
Nov 17 07:50:54 host2 sshd[2179411]: Disconnected from invalid user ubuntu 179.43.189.36 port 38030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Nov 17 07:50:32 host2 sshd[2179217]: Disconnected from invalid user st 37.252.188.15 port 39704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Nov 17 07:50:39 host2 sshd[2179282]: Disconnected from invalid user debian 45.202.211.6 port 54052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Nov 17 07:51:23 host2 sshd[2179906]: Disconnected from invalid user st 157.66.34.121 port 44026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Nov 17 07:51:59 host2 sshd[2180450]: Disconnected from invalid user matias 45.202.211.6 port 60434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.43.189.36
country_id: 2658434
description:
Nov 17 07:53:12 host2 sshd[2181120]: Disconnected from invalid user ftpuser 179.43.189.36 port 49320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.229.10.11
country_id: 3175395
description:
Nov 17 07:53:27 host2 sshd[2181215]: Disconnected from invalid user st 95.229.10.11 port 40738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.43.189.36
country_id: 2658434
description:
Nov 17 07:54:20 host2 sshd[2182190]: Disconnected from invalid user dmdba 179.43.189.36 port 37032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Nov 17 07:54:31 host2 sshd[2182326]: Disconnected from invalid user ubuntu 45.202.211.6 port 54490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Nov 17 07:55:14 host2 sshd[2182900]: Disconnected from invalid user francesco 157.66.34.121 port 46218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Nov 17 07:56:14 host2 sshd[2183465]: Disconnected from invalid user ftpuser 37.252.188.15 port 46880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 08:01:09 host2 sshd[2186186]: Disconnected from invalid user  2.57.121.112 port 62152 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 08:06:32 host2 sshd[2189533]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.109
country_id: 6252001
description:
Nov 17 08:06:44 host2 pure-ftpd[2189739]: (?@66.240.236.109) [INFO] New connection from 66.240.236.109


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.236.109
country_id: 6252001
description:
Nov 17 08:07:22 host2 pure-ftpd[2190058]: (?@66.240.236.109) [INFO] New connection from 66.240.236.109


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 08:12:06 host2 sshd[2192898]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 08:20:33 host2 sshd[2197924]: Disconnected from invalid user user 2.57.121.25 port 46187 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2025-11-17 08:25:01 dovecot_login authenticator failed for ([92.62.74.41]) [92.62.74.41]:38711: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 08:24:12 host2 sshd[2199922]: Disconnected from invalid user admin 2.57.121.112 port 17072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.249.105.213
country_id: 1605651
description:
2025-11-17 08:25:35 dovecot_login authenticator failed for ([43.249.105.213]) [43.249.105.213]:47674: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:25:38 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<xwxoe8FDqokDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-11-17 08:25:55 dovecot_login authenticator failed for ([180.129.66.134]) [180.129.66.134]:52915: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:28:53 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<lGQKh8FDsKIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:29:15 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<t3ZdiMFDvoYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:30:10 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<FZSgi8FD4LgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:32:22 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<8m54k8FDBo8DiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:32:46 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<TLHtlMFDVKIDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:33:10 host2 dovecot[3661788]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<c+ZWlsFDqucDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:34:48 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<cUkvnMFDDpoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 17 08:35:10 host2 dovecot[3661788]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<BvF5ncFDbIIDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 08:35:39 host2 sshd[2206634]: Disconnected from invalid user brionna 62.60.131.157 port 26542 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.223
country_id: 6252001
description:
Nov 17 08:41:06 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.223, lip=66.85.158.91, TLS, session=<gZm9ssFDRPDN0h/f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.100.144
country_id: 3865483
description:
Nov 17 08:41:50 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<training>, method=PLAIN, rip=190.181.100.144, lip=66.85.158.91, TLS, session=<XN8ltMFDyMy+tWSQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.156.62.121
country_id: 2510769
description:
Nov 17 08:41:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<training@v-deploy.com>, method=PLAIN, rip=178.156.62.121, lip=66.85.158.91, TLS, session=<UL0Bs8FDib6ynD55>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-17 08:50:09 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61268: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 17 08:51:13 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<0qfg1sFDqueLonQW>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.5
country_id: 1605651
description:
Nov 17 08:59:03 host2 pure-ftpd[2222823]: (?@103.176.152.5) [INFO] New connection from 103.176.152.5


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 17 09:00:05 host2 sshd[2223580]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-11-17 09:04:04 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:64360: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-11-17 09:04:36 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:45477: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 17 09:32:32 host2 sshd[2245243]: Disconnecting invalid user  2.57.121.112 port 61664: Change of username or service not allowed: (,ssh-connection) -> (cisco,ssh-connection) [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Nov 17 09:38:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=35.203.211.214, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IGJngMJDk9Ejy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Nov 17 09:39:37 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=35.203.211.214, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<TbH6g8JDuOcjy9PW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Nov 17 09:40:08 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=35.203.211.214, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<VPzShcJDjOojy9PW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 17 09:41:19 host2 sshd[2251077]: Disconnected from invalid user tobias 38.213.63.12 port 35190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Nov 17 09:41:39 host2 sshd[2251210]: Disconnected from invalid user haproxy 179.125.24.202 port 56480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 17 09:42:37 host2 sshd[2251778]: Disconnected from invalid user sanjay 38.213.63.12 port 41690 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.142
country_id: 6252001
description:
Nov 17 09:43:05 host2 pure-ftpd[2252089]: (?@66.132.153.142) [INFO] New connection from 66.132.153.142


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.138.243
country_id: 1269750
description:
Nov 17 09:42:21 host2 sshd[2251641]: Disconnected from invalid user haproxy 4.213.138.243 port 43282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.92.99
country_id: 6252001
description:
Nov 17 09:42:24 host2 sshd[2251666]: Disconnected from invalid user duc 172.245.92.99 port 52982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 17 09:43:30 host2 sshd[2252274]: Disconnected from invalid user admin 200.7.101.139 port 44688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov 17 09:43:41 host2 sshd[2252377]: Disconnected from invalid user sysadmin 172.245.92.99 port 46016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Nov 17 09:44:30 host2 sshd[2252961]: Disconnected from invalid user admin 179.125.24.202 port 55730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov 17 09:44:53 host2 sshd[2253307]: Disconnected from invalid user dev 172.245.92.99 port 34138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 17 09:45:04 host2 sshd[2253820]: Disconnected from invalid user dev 38.213.63.12 port 57176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Nov 17 09:46:03 host2 sshd[2254550]: Disconnected from invalid user vlad 179.125.24.202 port 44860 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.213.63.12
country_id: 2750405
description:
Nov 17 09:46:15 host2 sshd[2254638]: Disconnected from invalid user fd 38.213.63.12 port 44666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 17 09:46:36 host2 sshd[2254764]: Disconnected from invalid user matthew 200.7.101.139 port 48786 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Nov 17 09:46:13 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.214, lip=66.85.158.91, TLS, session=<xdCbm8JDEvIjy9PW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 17 09:47:57 host2 sshd[2255363]: Disconnected from invalid user admin 200.7.101.139 port 53662 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.214
country_id: 2635167
description:
Nov 17 09:47:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.214, lip=66.85.158.91, TLS, session=<+8gaoMJD2uYjy9PW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 17 09:49:12 host2 sshd[2256097]: Disconnected from invalid user adminuser 200.7.101.139 port 39914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.175.151.48
country_id: 130758
description:
Nov 17 09:49:26 host2 sshd[2256195]: Disconnected from invalid user uni 79.175.151.48 port 57432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Nov 17 09:49:07 host2 sshd[2256043]: Disconnected from invalid user jeff 179.125.24.202 port 52900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Nov 17 09:50:35 host2 sshd[2257078]: Disconnected from invalid user adminuser 179.125.24.202 port 32832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.7.101.139
country_id: 6252001
description:
Nov 17 09:51:45 host2 sshd[2257679]: Disconnected from invalid user coder 200.7.101.139 port 39040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.138.243
country_id: 1269750
description:
Nov 17 09:53:27 host2 sshd[2258591]: Disconnected from invalid user adminuser 4.213.138.243 port 50164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.213.138.243
country_id: 1269750
description:
Nov 17 09:55:01 host2 sshd[2259866]: Disconnected from invalid user coder 4.213.138.243 port 39826 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.213.138.243
country_id: 1269750
description:
Nov 17 09:56:29 host2 sshd[2260989]: Disconnected from invalid user matthew 4.213.138.243 port 37486 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-11-17 09:57:35 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:64726: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-11-17 09:57:45 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:30038: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.154
country_id: 6252001
description:
Nov 17 10:00:15 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.154.154, lip=66.85.158.92, TLS: Connection closed, session=<QqXHzcJDAq7HLZqa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.236
country_id: 6252001
description:
Nov 17 10:11:00 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.236, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VuRA9MJDENLN0h/s>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.231.66
country_id: 6252001
description:
Nov 17 10:16:07 host2 sshd[2272889]: Disconnected from invalid user ryan 50.6.231.66 port 37886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.231.66
country_id: 6252001
description:
Nov 17 10:20:42 host2 sshd[2275353]: Disconnected from invalid user user3 50.6.231.66 port 41288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.6.231.66
country_id: 6252001
description:
Nov 17 10:27:43 host2 sshd[2279217]: Disconnected from invalid user admin 50.6.231.66 port 45976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.231.66
country_id: 6252001
description:
Nov 17 10:28:57 host2 sshd[2279784]: Disconnected from invalid user usr1cv8 50.6.231.66 port 39032 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.155.91
country_id: 6252001
description:
Nov 17 10:33:29 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=199.45.155.91, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<zp6fRMNDuE/HLZtb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.71
country_id: 1819730
description:
2025-11-17 10:45:54 dovecot_login authenticator failed for (182.239.80.71.hk.chinamobile.com) [182.239.80.71]:55200: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.202.149
country_id: 2413451
description:
2025-11-17 10:45:14 dovecot_login authenticator failed for (197-255-202-149.netpagedns.net) [197.255.202.149]:55711: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-17 10:45:35 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:42565: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-11-17 10:45:36 dovecot_login authenticator failed for (aes-static-025.20.22.125.airtel.in) [128.185.192.166]:56516: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 17 10:54:59 host2 sshd[2295085]: Disconnected from invalid user nestor 62.60.131.157 port 22774 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.78.245.104
country_id: 2802361
description:
Nov 17 10:58:32 host2 pure-ftpd[2297102]: (?@34.78.245.104) [INFO] New connection from 34.78.245.104


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 17 10:59:23 host2 sshd[2297475]: Disconnected from invalid user user 2.57.121.25 port 39406 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.19
country_id: 2635167
description:
Nov 17 11:07:51 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.19, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<7rKIv8NDHsMjy9IT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.19
country_id: 2635167
description:
Nov 17 11:08:17 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.210.19, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<09YXwcNDhPMjy9IT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-11-17 11:10:34 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:56974: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.55.131.144
country_id: 1694008
description:
2025-11-17 11:10:57 dovecot_login authenticator failed for (122.55.143.46.static.pldt.net) [122.55.131.144]:59022: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.19
country_id: 2635167
description:
Nov 17 11:15:03 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.19, lip=66.85.158.92, TLS, session=<cEdP2cNDMuYjy9IT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.204
country_id: 6252001
description:
Nov 17 11:16:28 host2 dovecot[3661788]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.204, lip=66.85.158.91, session=<ni1a3sNDSo8UQcHM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.97
country_id: 2264397
description:
Nov 17 11:19:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.156.129.97, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<eLl+6MND940tnIFh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.98
country_id: 2264397
description:
Nov 17 11:19:18 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.98, lip=66.85.158.92, session=<AP936MND79EtnIFi>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.97
country_id: 2264397
description:
Nov 17 11:19:18 host2 dovecot[3661788]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.97, lip=66.85.158.92, TLS, session=<0UJ86MNDW6EtnIFh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.96
country_id: 2264397
description:
Nov 17 11:19:18 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.129.96, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<a0KF6MND06EtnIFg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.95
country_id: 2264397
description:
Nov 17 11:19:19 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=45.156.129.95, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<mfCJ6MND8a0tnIFf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.98
country_id: 2264397
description:
Nov 17 11:19:19 host2 dovecot[3661788]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=45.156.129.98, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<eySR6MNDdZ0tnIFi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.196
country_id: 2186224
description:
2025-11-17 11:26:36 dovecot_login authenticator failed for ([121.73.169.196]) [121.73.169.196]:54294: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


