# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Dec 24 15:07:20 host2 sshd[2204093]: Disconnected from invalid user test 209.141.52.88 port 48780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 15:07:40 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:54006: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.34
country_id: 6252001
description:
Dec 24 15:09:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.34, lip=66.85.158.92, session=<Nbmkbq9Gq+bDuEwi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.244
country_id: 6252001
description:
Dec 24 15:09:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.244, lip=66.85.158.92, session=<UXLpb69GzdDDuEz0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.245
country_id: 6252001
description:
Dec 24 15:09:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.245, lip=66.85.158.92, session=<buVPb69G093DuEz1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.247
country_id: 6252001
description:
Dec 24 15:09:28 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.247, lip=66.85.158.92, session=<Jo+5b69Gz5fDuEz3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-12-24 15:10:43 dovecot_login authenticator failed for H=([186.238.247.238]) [186.238.247.238]:60902: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 15:11:36 host2 sshd[2207552]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-24 15:13:09 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:45353: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-12-24 15:14:11 dovecot_login authenticator failed for H=([103.251.31.154]) [103.251.31.154]:53556: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-12-24 15:13:23 dovecot_login authenticator failed for H=89-67-37-8.dynamic.play.pl [89.67.37.8]:55092: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-12-24 15:19:23 dovecot_login authenticator failed for H=(177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:34224: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-24 15:19:45 dovecot_login authenticator failed for H=(58-27-253-6.wateen.net) [58.27.253.6]:37330: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 15:22:33 host2 sshd[2216039]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-12-24 15:25:49 dovecot_login authenticator failed for H=host-89-242-182-159.as13285.net [89.242.182.159]:48909: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-24 15:26:14 dovecot_login authenticator failed for H=([51.162.194.94]) [51.162.194.94]:57445: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.80.64.121
country_id: 6252001
description:
[2025-12-24 15:28:15 +0530] info [cpaneld] 72.80.64.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.196.96.136
country_id: 6252001
description:
[2025-12-24 15:28:16 +0530] info [cpaneld] 74.196.96.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.7.28
country_id: 6252001
description:
[2025-12-24 15:28:18 +0530] info [cpaneld] 23.243.7.28 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.26.104.122
country_id: 6252001
description:
[2025-12-24 15:28:20 +0530] info [whostmgrd] 98.26.104.122 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 24 15:28:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<oIUZta9GEMojygmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-24 15:28:54 dovecot_login authenticator failed for H=bl14-230-132.dsl.telepac.pt [85.247.230.132]:48978: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.250.173.134
country_id: 6252001
description:
[2025-12-24 15:28:22 +0530] info [cpaneld] 172.250.173.134 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.239.242.32
country_id: 6252001
description:
[2025-12-24 15:28:25 +0530] info [cpaneld] 141.239.242.32 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.32.171.142
country_id: 6252001
description:
[2025-12-24 15:28:23 +0530] info [cpaneld] 104.32.171.142 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.234
country_id: 1733045
description:
2025-12-24 15:28:36 dovecot_login authenticator failed for H=([49.124.152.234]) [49.124.152.234]:43186: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:34:27 host2 sshd[2224979]: Disconnected from invalid user lisa 193.70.86.193 port 49924 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.27.196.241
country_id: 6252001
description:
[2025-12-24 15:36:43 +0530] info [cpaneld] 50.27.196.241 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.31.139.15
country_id: 6252001
description:
[2025-12-24 15:36:45 +0530] info [cpaneld] 45.31.139.15 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.11.4.19
country_id: 6252001
description:
[2025-12-24 15:36:48 +0530] info [cpaneld] 100.11.4.19 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-12-24 15:37:03 dovecot_login authenticator failed for H=([65.20.191.97]) [65.20.191.97]:38021: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-24 15:36:22 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:59490: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.128.42.219
country_id: 6252001
description:
[2025-12-24 15:36:44 +0530] info [whostmgrd] 107.128.42.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.67.162.134
country_id: 6252001
description:
[2025-12-24 15:36:47 +0530] info [cpaneld] 71.67.162.134 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 24 15:36:27 host2 sshd[2226533]: Disconnected from invalid user git 205.185.126.121 port 52820 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.208.87.26
country_id: 6252001
description:
[2025-12-24 15:36:38 +0530] info [cpaneld] 72.208.87.26 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.59.225.11
country_id: 6252001
description:
[2025-12-24 15:36:40 +0530] info [cpaneld] 174.59.225.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.48
country_id: 1733045
description:
2025-12-24 15:37:44 dovecot_login authenticator failed for H=([49.124.151.48]) [49.124.151.48]:32852: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Dec 24 15:38:21 host2 sshd[2227938]: Disconnected from invalid user git 118.193.39.127 port 44956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.184
country_id: 3144096
description:
2025-12-24 15:39:14 dovecot_login authenticator failed for H=(cm-178.232.153.184.get.no) [178.232.153.184]:36536: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-24 15:40:05 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:52682: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:39:44 host2 sshd[2228921]: Disconnected from invalid user testuser1 193.70.86.193 port 40176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 24 15:39:49 host2 sshd[2229018]: Disconnected from invalid user finance 205.185.126.121 port 36498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 24 15:40:39 host2 sshd[2230164]: Disconnected from invalid user gituser 155.248.164.42 port 56690 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.137.56.185
country_id: 6252001
description:
[2025-12-24 15:40:22 +0530] info [cpaneld] 75.137.56.185 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.132.239.233
country_id: 6252001
description:
[2025-12-24 15:40:21 +0530] info [cpaneld] 99.132.239.233 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.29.184.39
country_id: 6252001
description:
[2025-12-24 15:40:26 +0530] info [whostmgrd] 96.29.184.39 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.218.78.4
country_id: 6252001
description:
[2025-12-24 15:40:31 +0530] info [cpaneld] 32.218.78.4 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 15:41:07 host2 pure-ftpd[2230543]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.50.150.35
country_id: 6252001
description:
[2025-12-24 15:40:24 +0530] info [cpaneld] 45.50.150.35 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.189.84.53
country_id: 6252001
description:
[2025-12-24 15:40:27 +0530] info [cpaneld] 99.189.84.53 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.96.110.65
country_id: 6252001
description:
[2025-12-24 15:40:29 +0530] info [cpaneld] 98.96.110.65 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-12-24 15:40:23 dovecot_login authenticator failed for H=([182.95.24.209]) [182.95.57.158]:53040: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.11
country_id: 3017382
description:
Dec 24 15:41:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.11, lip=66.85.158.92, session=<rCCh4a9GT+pb51kL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 24 15:41:53 host2 sshd[2230892]: Disconnected from invalid user victor 189.50.142.82 port 44413 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.126.121
country_id: 6252001
description:
Dec 24 15:42:13 host2 sshd[2231252]: Disconnected from invalid user john 205.185.126.121 port 34730 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.11
country_id: 3017382
description:
Dec 24 15:41:33 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.11, lip=66.85.158.92, session=<Sh174q9GO4Bb51kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.14
country_id: 3017382
description:
Dec 24 15:41:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.14, lip=66.85.158.92, session=<rlKt4q9G051b51kO>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:41:58 host2 sshd[2230962]: Disconnected from invalid user jose 193.70.86.193 port 38810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 24 15:41:27 host2 sshd[2230697]: Disconnected from invalid user asd 193.70.86.193 port 33710 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.134
country_id: 3017382
description:
Dec 24 15:41:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.134, lip=66.85.158.92, session=</9BG4q9Gmcpb51mG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 24 15:42:41 host2 sshd[2231578]: Disconnected from invalid user asd 155.248.164.42 port 40856 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.248.164.42
country_id: 1861060
description:
Dec 24 15:43:19 host2 sshd[2232042]: Disconnected from invalid user seedbox 155.248.164.42 port 34488 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.115.225.163
country_id: 6252001
description:
[2025-12-24 15:44:12 +0530] info [cpaneld] 172.115.225.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.190.217.190
country_id: 6252001
description:
[2025-12-24 15:44:13 +0530] info [whostmgrd] 68.190.217.190 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.42.7.86
country_id: 6252001
description:
[2025-12-24 15:44:16 +0530] info [cpaneld] 73.42.7.86 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.35.177.21
country_id: 6252001
description:
[2025-12-24 15:44:06 +0530] info [cpaneld] 98.35.177.21 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.52.149.226
country_id: 6252001
description:
[2025-12-24 15:44:10 +0530] info [cpaneld] 170.52.149.226 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.106.39.203
country_id: 6252001
description:
[2025-12-24 15:44:15 +0530] info [cpaneld] 99.106.39.203 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.89.244.47
country_id: 6252001
description:
[2025-12-24 15:44:18 +0530] info [cpaneld] 167.89.244.47 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.34.105.190
country_id: 6252001
description:
[2025-12-24 15:45:27 +0530] info [cpaneld] 104.34.105.190 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.213.132.158
country_id: 6252001
description:
[2025-12-24 15:45:29 +0530] info [cpaneld] 107.213.132.158 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.49.41
country_id: 6252001
description:
[2025-12-24 15:45:32 +0530] info [cpaneld] 98.97.49.41 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.170.218.163
country_id: 6252001
description:
[2025-12-24 15:45:30 +0530] info [whostmgrd] 76.170.218.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.254.83.71
country_id: 6252001
description:
[2025-12-24 15:45:35 +0530] info [cpaneld] 142.254.83.71 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.183.252.199
country_id: 6252001
description:
[2025-12-24 15:45:36 +0530] info [cpaneld] 71.183.252.199 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.199.22.11
country_id: 6252001
description:
[2025-12-24 15:45:26 +0530] info [cpaneld] 98.199.22.11 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.95.173.102
country_id: 6251999
description:
Dec 24 15:46:39 host2 pure-ftpd[2234697]: (?@38.95.173.102) [INFO] New connection from 38.95.173.102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.163
country_id: 3996063
description:
2025-12-24 15:46:52 dovecot_login authenticator failed for H=(201.172.88.163-clientes-izzi.mx) [201.172.88.163]:42542: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-24 15:47:05 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:50784: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.39.127
country_id: 1819730
description:
Dec 24 15:48:21 host2 sshd[2237157]: Disconnected from invalid user seedbox 118.193.39.127 port 46980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 24 15:49:24 host2 sshd[2238701]: Disconnected from invalid user uftp 189.50.142.82 port 53358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 24 15:52:24 host2 sshd[2243029]: Disconnected from invalid user ftpuser 189.50.142.82 port 39256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-24 15:55:11 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:47646: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2025-12-24 15:55:15 dovecot_login authenticator failed for H=1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:59584: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-24 15:55:23 dovecot_login authenticator failed for H=([46.8.246.27]) [46.8.246.27]:39730: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-24 15:55:34 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:35112: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-24 15:58:07 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:53396: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.88.178.214
country_id: 6252001
description:
[2025-12-24 15:59:26 +0530] info [webmaild] 166.88.178.214 - info@bostonlanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 24 16:04:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<NRu/MrBGEojBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-24 16:14:25 dovecot_login authenticator failed for H=([128.185.229.126]) [128.185.229.126]:51862: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.125
country_id: 3469034
description:
Dec 24 16:14:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=177.44.96.125, lip=66.85.158.91, TLS, session=<XfcOWLBGxMqxLGB9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.23
country_id: 690791
description:
Dec 24 16:15:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.25.23, lip=66.85.158.91, TLS, session=<GwE+WbBGVYWwZxkX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-12-24 16:15:04 dovecot_login authenticator failed for H=177-72-87-7.static.as262543.net.br [177.72.87.7]:34212: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-24 16:15:22 dovecot_plain authenticator failed for H=ool-457bdb52.dyn.optonline.net (ozoaccal) [69.123.219.82]:59894: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-24 16:18:36 dovecot_login authenticator failed for H=wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:56095: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-24 16:19:34 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (sphooded) [174.169.224.27]:40190: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.160
country_id: 3469034
description:
Dec 24 16:19:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=191.53.128.160, lip=66.85.158.91, TLS, session=<aUIbarBGSc+/NYCg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.0.14.108
country_id: 6252001
description:
[2025-12-24 16:18:56 +0530] info [cpaneld] 142.0.14.108 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.145.86.81
country_id: 6252001
description:
[2025-12-24 16:18:58 +0530] info [cpaneld] 104.145.86.81 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.171.101.255
country_id: 6252001
description:
[2025-12-24 16:19:04 +0530] info [cpaneld] 76.171.101.255 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-12-24 16:19:04 dovecot_login authenticator failed for H=137.173.198.203.static.netvigator.com [203.198.173.137]:42790: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.219
country_id: 3469034
description:
Dec 24 16:19:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=187.120.73.219, lip=66.85.158.91, TLS, session=<b97oaLBG6827eEnb>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.57.233.30
country_id: 6252001
description:
[2025-12-24 16:19:00 +0530] info [cpaneld] 99.57.233.30 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.165.130.42
country_id: 6252001
description:
[2025-12-24 16:19:02 +0530] info [cpaneld] 24.165.130.42 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.68.173.30
country_id: 6252001
description:
[2025-12-24 16:19:01 +0530] info [whostmgrd] 173.68.173.30 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.139.193.81
country_id: 6252001
description:
[2025-12-24 16:19:03 +0530] info [cpaneld] 35.139.193.81 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 288 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.26.57
country_id: 6252001
description:
Dec 24 16:25:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.97.26.57, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1SSWgLBGqtwSYRo5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.26.57
country_id: 6252001
description:
Dec 24 16:25:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.26.57, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Tmb7gLBG4sgSYRo5>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 315 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.4.157.5
country_id: 6252001
description:
[2025-12-24 16:29:01 +0530] info [cpaneld] 24.4.157.5 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.193.155.156
country_id: 6252001
description:
[2025-12-24 16:29:21 +0530] info [cpaneld] 216.193.155.156 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.254.4.112
country_id: 6252001
description:
[2025-12-24 16:29:24 +0530] info [whostmgrd] 73.254.4.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.244.230.48
country_id: 6252001
description:
[2025-12-24 16:29:27 +0530] info [cpaneld] 71.244.230.48 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.85.101.131
country_id: 6252001
description:
[2025-12-24 16:29:00 +0530] info [cpaneld] 69.85.101.131 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.135.246.242
country_id: 6252001
description:
[2025-12-24 16:29:08 +0530] info [cpaneld] 207.135.246.242 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.235.110.127
country_id: 6252001
description:
[2025-12-24 16:29:31 +0530] info [cpaneld] 98.235.110.127 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.234.166.119
country_id: 6252001
description:
[2025-12-24 16:29:02 +0530] info [whostmgrd] 73.234.166.119 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.206.18
country_id: 6252001
description:
[2025-12-24 16:29:03 +0530] info [cpaneld] 35.150.206.18 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.38.222.116
country_id: 6252001
description:
[2025-12-24 16:29:20 +0530] info [cpaneld] 100.38.222.116 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.180.57.121
country_id: 6252001
description:
[2025-12-24 16:29:23 +0530] info [cpaneld] 24.180.57.121 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.188.204.197
country_id: 6252001
description:
[2025-12-24 16:28:56 +0530] info [cpaneld] 65.188.204.197 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.130.72.50
country_id: 6252001
description:
[2025-12-24 16:29:06 +0530] info [cpaneld] 107.130.72.50 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.46.29.69
country_id: 6252001
description:
[2025-12-24 16:29:29 +0530] info [cpaneld] 74.46.29.69 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.235.215.166
country_id: 6252001
description:
[2025-12-24 16:31:16 +0530] info [cpaneld] 73.235.215.166 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.243.247.205
country_id: 6252001
description:
[2025-12-24 16:31:17 +0530] info [cpaneld] 23.243.247.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.121.242.186
country_id: 6252001
description:
[2025-12-24 16:31:19 +0530] info [whostmgrd] 70.121.242.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.117.116.46
country_id: 6252001
description:
[2025-12-24 16:31:18 +0530] info [cpaneld] 23.117.116.46 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.51.38.144
country_id: 6252001
description:
[2025-12-24 16:31:20 +0530] info [cpaneld] 75.51.38.144 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.147.242.170
country_id: 6252001
description:
[2025-12-24 16:31:21 +0530] info [cpaneld] 47.147.242.170 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.165.193
country_id: 6252001
description:
[2025-12-24 16:31:22 +0530] info [cpaneld] 67.188.165.193 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:39:44 host2 sshd[2293776]: Disconnected from invalid user miguel 51.222.106.104 port 58166 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.19.186
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.19.186: 250 connections per 30 seconds to 2078 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Dec 24 16:40:35 host2 sshd[2295120]: Disconnected from invalid user build 103.118.114.22 port 39692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:42:09 host2 sshd[2296819]: Disconnected from invalid user samba 51.222.106.104 port 56622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:42:35 host2 sshd[2297208]: Disconnected from invalid user appltest 163.181.207.222 port 49250 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 16:43:43 host2 pure-ftpd[2298314]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Dec 24 16:43:57 host2 sshd[2298597]: Disconnected from invalid user ubuntu 103.118.114.22 port 39144 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 322 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:45:07 host2 sshd[2299724]: Disconnected from invalid user tars 51.222.106.104 port 55622 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:45:47 host2 sshd[2300310]: Disconnected from invalid user teaspeak 167.71.128.40 port 60500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:46:20 host2 sshd[2301188]: Disconnected from invalid user samba 167.71.128.40 port 56272 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:47:21 host2 sshd[2302049]: Received disconnect from 167.71.128.40 port 36876:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:47:21 host2 sshd[2302049]: Disconnected from invalid user ftpuser 167.71.128.40 port 36876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 24 16:47:32 host2 sshd[2302203]: Disconnected from invalid user spooler 199.195.254.215 port 56536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Dec 24 16:47:56 host2 sshd[2302520]: Disconnected from invalid user test 20.102.116.25 port 43546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:48:14 host2 sshd[2302857]: Disconnected from invalid user gopal 163.181.207.222 port 39076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Dec 24 16:48:28 host2 sshd[2303060]: Disconnected from invalid user raaj 103.118.114.22 port 38236 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.102.116.25
country_id: 6252001
description:
Dec 24 16:48:31 host2 sshd[2303157]: Disconnected from invalid user tin 20.102.116.25 port 43984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.128.40
country_id: 2635167
description:
Dec 24 16:48:49 host2 sshd[2303443]: Disconnected from invalid user hoster 167.71.128.40 port 53346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:49:09 host2 sshd[2303872]: Disconnected from invalid user tin 163.181.207.222 port 39410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:50:29 host2 sshd[2305228]: Disconnected from invalid user nasrin 163.181.207.222 port 35636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 24 16:50:00 host2 sshd[2304637]: Disconnected from invalid user oracle 213.6.203.226 port 38443 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.79.63
country_id: 6252001
description:
Dec 24 16:50:57 host2 sshd[2305728]: Disconnected from invalid user wm 146.190.79.63 port 42934 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.79.63
country_id: 6252001
description:
Dec 24 16:51:29 host2 sshd[2306459]: Disconnected from invalid user admin 146.190.79.63 port 36700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Dec 24 16:51:39 host2 sshd[2306620]: Disconnected from invalid user j 51.222.106.104 port 46874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec 24 16:52:42 host2 sshd[2307380]: Disconnected from invalid user wahyu 213.6.203.226 port 61476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.181.207.222
country_id: 1605651
description:
Dec 24 16:53:20 host2 sshd[2307947]: Disconnected from invalid user wm 163.181.207.222 port 50640 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 16:57:24 host2 sshd[2311615]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-24 17:04:25 dovecot_plain authenticator failed for H=(allatoxyle) [24.104.225.201]:55637: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:05:59 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<XINuELFGRusDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:07:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<4aSKFLFGEtsDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 17:08:21 host2 sshd[2322614]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.27.194
country_id: 1210997
description:
2025-12-24 17:08:41 dovecot_login authenticator failed for H=([103.134.27.194]) [103.134.27.194]:35896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:09:06 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<pBahG7FGAMIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:10:15 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<0si0H7FGDrMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:11:36 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<BgSGJLFGDsgDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:12:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<zeLPJrFGdIoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:13:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<oqU/K7FGtOkDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:13:44 host2 dovecot[1881837]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<2/MtLLFGzLQDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.38.202.200
country_id: 3175395
description:
Dec 24 17:13:46 host2 sshd[2327828]: Disconnected from invalid user test 151.38.202.200 port 34668 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.248
country_id: 3865483
description:
Dec 24 17:14:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=186.124.218.248, lip=66.85.158.91, TLS, session=<u1hJL7FGnNW6fNr4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:14:57 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<tZKDMLFGGpMDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.192.179.139
country_id: 798544
description:
Dec 24 17:15:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=193.192.179.139, lip=66.85.158.91, TLS, session=<7GR6MLFGLJDBwLOL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Dec 24 17:15:53 host2 sshd[2330259]: Disconnected from invalid user ubuntu 195.199.212.141 port 35632 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 24 17:16:02 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<PjxtNLFGkpwDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Dec 24 17:17:51 host2 sshd[2332114]: Disconnected from invalid user mathias 195.199.212.141 port 42202 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.199.212.141
country_id: 719819
description:
Dec 24 17:18:27 host2 sshd[2332673]: Disconnected from invalid user wms 195.199.212.141 port 45580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 24 17:18:34 host2 sshd[2332802]: Disconnected from invalid user huawei 68.183.236.1 port 57048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.227.65.179
country_id: 3469034
description:
Dec 24 17:19:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=168.227.65.179, lip=66.85.158.91, TLS, session=</VfMQLFGucmo40Gz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 24 17:19:52 host2 sshd[2334219]: Disconnected from invalid user iptv 68.183.236.1 port 58212 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.118
country_id: 690791
description:
Dec 24 17:20:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=194.44.140.118, lip=66.85.158.91, TLS, session=<GAAjQrFGC4HCLIx2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Dec 24 17:21:22 host2 sshd[2336140]: Disconnected from invalid user steam 195.199.212.141 port 44522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.38.202.200
country_id: 3175395
description:
Dec 24 17:21:47 host2 sshd[2336502]: Disconnected from invalid user admin 151.38.202.200 port 34380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.212.141
country_id: 719819
description:
Dec 24 17:22:37 host2 sshd[2337397]: Disconnected from invalid user test 195.199.212.141 port 42506 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.84.112.17
country_id: 6252001
description:
[2025-12-24 17:24:24 +0530] info [cpaneld] 76.84.112.17 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.118.41.177
country_id: 6252001
description:
[2025-12-24 17:24:26 +0530] info [cpaneld] 23.118.41.177 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.45.194.155
country_id: 6252001
description:
[2025-12-24 17:24:28 +0530] info [whostmgrd] 68.45.194.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.216.99.101
country_id: 6252001
description:
[2025-12-24 17:24:27 +0530] info [cpaneld] 69.216.99.101 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.147.254.109
country_id: 6252001
description:
[2025-12-24 17:24:30 +0530] info [cpaneld] 98.147.254.109 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.116.41.147
country_id: 6252001
description:
[2025-12-24 17:24:31 +0530] info [cpaneld] 23.116.41.147 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.19.222.178
country_id: 6252001
description:
[2025-12-24 17:24:32 +0530] info [cpaneld] 149.19.222.178 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.38.202.200
country_id: 3175395
description:
Dec 24 17:25:15 host2 sshd[2340012]: Disconnected from invalid user wms 151.38.202.200 port 34446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.31.145.167
country_id: 798544
description:
Dec 24 17:25:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=78.31.145.167, lip=66.85.158.91, TLS, session=<AVxIVbFGMsFOH5Gn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-24 17:25:48 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:53078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.122.204
country_id: 690791
description:
Dec 24 17:25:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=91.228.122.204, lip=66.85.158.91, TLS, session=<PbdUVrFGJ+pb5HrM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.138.188
country_id: 3175395
description:
Dec 24 17:29:51 host2 sshd[2344892]: Disconnected from invalid user uap 151.43.138.188 port 2721 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-24 17:34:28 dovecot_login authenticator failed for H=079.33.246.220.static.netvigator.com [220.246.33.79]:50385: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-12-24 17:34:55 dovecot_login authenticator failed for H=(177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:58643: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2025-12-24 17:36:27 dovecot_login authenticator failed for H=213-67-45-29-no600.tbcn.telia.com [213.67.45.29]:40014: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Dec 24 17:36:17 host2 sshd[2353570]: Disconnected from invalid user fastuser 68.233.116.124 port 32410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Dec 24 17:37:43 host2 sshd[2355484]: Disconnected from invalid user javier 68.233.116.124 port 60462 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.43.138.188
country_id: 3175395
description:
Dec 24 17:37:54 host2 sshd[2355684]: Disconnected from invalid user ubuntu 151.43.138.188 port 2983 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Dec 24 17:38:27 host2 sshd[2356295]: Disconnected from invalid user ubuntu 68.233.116.124 port 17768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 24 17:38:40 host2 sshd[2356515]: Disconnected from invalid user oleg 38.137.11.10 port 49190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-24 17:39:38 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:39476: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Dec 24 17:40:28 host2 sshd[2358457]: Disconnected from invalid user oleg 77.87.40.114 port 41046 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.137.11.10
country_id: 1269750
description:
Dec 24 17:40:00 host2 sshd[2357697]: Disconnected from invalid user odoo12 38.137.11.10 port 51429 [preauth]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.209
country_id: 690791
description:
2025-12-24 17:40:26 H=([77.83.39.209]) [77.83.39.209]:63009 F=<dpr@priv8shop.com> rejected RCPT <davebruce06@outlook.com>: Sender verify failed


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 24 17:40:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<EhhcjbFGxOQjygmF>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.209
country_id: 690791
description:
2025-12-24 17:42:21 H=([77.83.39.209]) [77.83.39.209]:57739 F=<dpr@priv8shop.com> rejected RCPT <davebruce06@outlook.com>: Sender verify failed


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 77.87.40.114
country_id: 690791
description:
Dec 24 17:43:44 host2 sshd[2361643]: Received disconnect from 77.87.40.114 port 58788:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.87.40.114
country_id: 690791
description:
Dec 24 17:45:22 host2 sshd[2363422]: Disconnected from invalid user prometheus 77.87.40.114 port 39432 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.101.134.7
country_id: 6252001
description:
[2025-12-24 17:46:38 +0530] info [cpaneld] 172.101.134.7 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.114.128.199
country_id: 6252001
description:
[2025-12-24 17:46:39 +0530] info [whostmgrd] 68.114.128.199 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.206.168.138
country_id: 6252001
description:
[2025-12-24 17:46:42 +0530] info [cpaneld] 107.206.168.138 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 17:46:17 host2 pure-ftpd[2364456]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.83.38.168
country_id: 6252001
description:
[2025-12-24 17:46:35 +0530] info [cpaneld] 74.83.38.168 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.72.115.141
country_id: 6252001
description:
[2025-12-24 17:46:37 +0530] info [cpaneld] 75.72.115.141 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.248.93.166
country_id: 6252001
description:
[2025-12-24 17:46:41 +0530] info [cpaneld] 216.248.93.166 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.101.100.162
country_id: 6252001
description:
[2025-12-24 17:46:43 +0530] info [cpaneld] 73.101.100.162 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Dec 24 17:47:26 host2 sshd[2365880]: Disconnected from invalid user sonic 77.87.40.114 port 60662 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.2
country_id: 798549
description:
Dec 24 17:49:02 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.140.2, lip=66.85.158.92, TLS, session=<ouRuqrFGTLVV2YwC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Dec 24 17:50:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.92, session=<uH44rrFGOutV2YwD>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.194.123
country_id: 6252001
description:
Dec 24 17:50:09 host2 pure-ftpd[2369023]: (?@20.65.194.123) [INFO] New connection from 20.65.194.123


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.173.234
country_id: 6252001
description:
Dec 24 17:51:29 host2 pure-ftpd[2370686]: (?@40.124.173.234) [INFO] New connection from 40.124.173.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-24 17:52:12 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:48626: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 24 17:53:35 host2 sshd[2372609]: Disconnected from invalid user rust 88.147.30.59 port 47936 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.182
country_id: 3865483
description:
Dec 24 17:57:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=179.0.251.182, lip=66.85.158.91, TLS, session=<jGemx7FGzbOzAPu2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.202
country_id: 3469034
description:
Dec 24 17:57:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=191.53.107.202, lip=66.85.158.91, TLS, session=<shpcxrFGEYi/NWvK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 24 17:57:55 host2 sshd[2377144]: Disconnected from invalid user minecraft 88.147.30.59 port 35234 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-24 17:59:20 dovecot_login authenticator failed for H=([128.185.227.166]) [128.185.227.166]:46804: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.37
country_id: 3996063
description:
2025-12-24 17:58:54 dovecot_login authenticator failed for H=(187.161.136.37-clientes-izzi.mx) [187.161.136.37]:43740: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 24 17:58:59 host2 sshd[2378144]: Disconnected from invalid user barbara 88.147.30.59 port 53595 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 24 17:59:59 host2 sshd[2378957]: Disconnected from invalid user kdk 88.147.30.59 port 43549 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.19
country_id: 3175395
description:
Dec 24 18:02:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=217.26.179.19, lip=66.85.158.91, TLS, session=<JsRO2bFGr+HZGrMT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.251.39
country_id: 3469034
description:
Dec 24 18:02:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.11.251.39, lip=66.85.158.91, TLS, session=<wnpr2rFGzLaxC/sn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.205.37
country_id: 1168579
description:
2025-12-24 18:03:40 dovecot_login authenticator failed for H=([113.203.205.37]) [113.203.205.37]:44047: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-12-24 18:03:49 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:42655: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2025-12-24 18:04:32 dovecot_login authenticator failed for H=(abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [122.169.207.93]:3828: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.125.122
country_id: 1269750
description:
2025-12-24 18:03:54 dovecot_login authenticator failed for H=(nsg-static-233.166.76.182-airtel.com) [182.95.125.122]:42040: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-12-24 18:04:06 dovecot_login authenticator failed for H=([152.52.204.27]) [128.185.254.162]:37030: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.69
country_id: 3144096
description:
2025-12-24 18:04:22 dovecot_login authenticator failed for H=(cm-84.211.13.69.get.no) [84.211.13.69]:57913: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-24 18:10:19 dovecot_login authenticator failed for H=([182.95.63.50]) [182.95.63.50]:41178: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2025-12-24 18:09:55 dovecot_login authenticator failed for H=([182.78.10.145]) [122.185.101.50]:58220: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.41.48.79
country_id: 6252001
description:
[2025-12-24 18:13:47 +0530] info [cpaneld] 99.41.48.79 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.71.181.252
country_id: 6252001
description:
[2025-12-24 18:13:55 +0530] info [cpaneld] 208.71.181.252 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-12-24 18:14:17 dovecot_login authenticator failed for H=(223-197-145-126.static.imsbiz.com) [223.197.145.126]:60453: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.146.216
country_id: 3625428
description:
2025-12-24 18:13:28 dovecot_plain authenticator failed for H=([31.57.166.48]) [143.105.146.216]:22057: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.9.55.101
country_id: 6252001
description:
[2025-12-24 18:13:41 +0530] info [cpaneld] 73.9.55.101 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.23.51.161
country_id: 6252001
description:
[2025-12-24 18:13:43 +0530] info [cpaneld] 24.23.51.161 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.147.178
country_id: 6252001
description:
[2025-12-24 18:13:49 +0530] info [whostmgrd] 172.59.147.178 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.30.95.24
country_id: 6252001
description:
[2025-12-24 18:13:51 +0530] info [cpaneld] 71.30.95.24 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.114.162.27
country_id: 6252001
description:
[2025-12-24 18:13:52 +0530] info [cpaneld] 172.114.162.27 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.152.151.10
country_id: 3469034
description:
2025-12-24 18:16:17 dovecot_plain authenticator failed for H=([31.57.166.48]) [177.152.151.10]:65198: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.80.160.196
country_id: 102358
description:
2025-12-24 18:16:29 dovecot_plain authenticator failed for H=([31.57.166.48]) [178.80.160.196]:33546: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.161.182.16
country_id: 290291
description:
2025-12-24 18:16:43 dovecot_plain authenticator failed for H=109-161-182-16.rev.bb.zain.com ([31.57.166.48]) [109.161.182.16]:54212: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 24 18:16:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<ETZiDbJGGJKLonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:23:07 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=</zZQJLJGYrQDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-12-24 18:23:58 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:46155: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-12-24 18:24:07 dovecot_login authenticator failed for H=([106.0.165.219]) [106.0.165.219]:35821: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:23:32 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<oWPOJbJGvtcDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:25:10 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<H6+oK7JGMogDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.78.211.68
country_id: 3996063
description:
2025-12-24 18:25:11 dovecot_plain authenticator failed for H=([31.57.166.48]) [170.78.211.68]:52856: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.222.189.212
country_id: 3469034
description:
2025-12-24 18:25:24 dovecot_plain authenticator failed for H=([31.57.166.48]) [179.222.189.212]:6067: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.222.189.212
country_id: 3469034
description:
2025-12-24 18:25:31 dovecot_login authenticator failed for H=([31.57.166.48]) [179.222.189.212]:6067: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.178.13.157
country_id: 3865483
description:
2025-12-24 18:25:37 dovecot_plain authenticator failed for H=([31.57.166.48]) [190.178.13.157]:60699: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:25:38 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<j8JLLbJGGoQDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-24 18:26:52 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:38172: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-24 18:27:05 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:29490: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:26:42 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<hA0hMbJGDpsDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:28:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<mJ3NNrJGWNMDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:28:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<c6kaOLJGAJsDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:29:50 host2 dovecot[1881837]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<xFdNPLJGPqgDlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 18:30:11 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:53429: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 24 18:30:30 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<//uvPrJGQMADlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.214.55.230
country_id: 798544
description:
Dec 24 18:31:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=95.214.55.230, lip=66.85.158.92, session=<XPLqQLJGFphf1jfm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.120
country_id: 6252001
description:
Dec 24 18:33:37 host2 pure-ftpd[2411396]: (?@66.132.153.120) [INFO] New connection from 66.132.153.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-12-24 18:34:31 dovecot_login authenticator failed for H=(nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:36592: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-12-24 18:34:49 dovecot_login authenticator failed for H=([45.194.15.228]) [45.194.15.228]:48945: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-24 18:35:49 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:39108: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.142
country_id: 3175395
description:
2025-12-24 18:36:24 dovecot_login authenticator failed for H=95-210-105-142.ip.skylogicnet.com [95.210.105.142]:56668: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.89.74
country_id: 3996063
description:
2025-12-24 18:41:07 dovecot_login authenticator failed for H=(201.172.89.74-clientes-izzi.mx) [201.172.89.74]:45697: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2025-12-24 18:41:44 dovecot_login authenticator failed for H=([197.251.249.72]) [197.251.249.72]:41257: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.17
country_id: 3175395
description:
Dec 24 18:45:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.170.17, lip=66.85.158.91, TLS, session=<DLJ3crJGueS5D6oR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.74.7.79
country_id: 2395170
description:
Dec 24 18:45:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=41.74.7.79, lip=66.85.158.91, TLS, session=<Fjyrc7JGWcIpSgdP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 18:48:57 host2 pure-ftpd[2425285]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.89.85
country_id: 1880251
description:
Dec 24 19:05:20 host2 sshd[2438760]: Disconnected from invalid user webuser 159.223.89.85 port 36274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.89.85
country_id: 1880251
description:
Dec 24 19:06:40 host2 sshd[2439655]: Disconnected from invalid user zhangyue 159.223.89.85 port 50420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.225.55.168
country_id: 6252001
description:
Dec 24 19:06:47 host2 sshd[2439729]: Disconnected from invalid user afa 64.225.55.168 port 58270 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.225.55.168
country_id: 6252001
description:
Dec 24 19:09:32 host2 sshd[2441581]: Disconnected from invalid user richard 64.225.55.168 port 35254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-24 19:12:29 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:55039: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 19:13:24 host2 sshd[2444550]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-24 19:12:43 dovecot_login authenticator failed for H=(cm-84.214.63.110.get.no) [84.214.63.110]:50260: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.203.42.204
country_id: 290557
description:
Dec 24 19:19:25 host2 sshd[2449379]: Disconnected from invalid user infra 20.203.42.204 port 47206 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-24 19:20:31 dovecot_login authenticator failed for H=200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:41947: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Dec 24 19:20:39 host2 sshd[2450461]: Disconnected from invalid user design 20.203.42.204 port 42032 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-24 19:21:19 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:45150: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 19:24:24 host2 sshd[2453300]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-24 19:25:49 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:59414: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-24 19:26:06 dovecot_login authenticator failed for H=(201.173.250.36-clientes-izzi.mx) [201.173.250.36]:59338: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.100
country_id: 1269750
description:
Dec 24 19:30:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.18.166.100, lip=66.85.158.91, TLS, session=<kZKoFbNGrepnEqZk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.133
country_id: 2300660
description:
Dec 24 19:31:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=41.139.47.133, lip=66.85.158.91, TLS, session=<47oRF7NGhIspiy+F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Dec 24 19:33:29 host2 sshd[2462527]: Disconnected from invalid user josh 103.143.238.173 port 43066 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 166.0.106.131
country_id: 6251999
description:
Dec 24 19:32:32 host2 pure-ftpd[2461329]: (?@166.0.106.131) [INFO] New connection from 166.0.106.131


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.238.173
country_id: 1819730
description:
Dec 24 19:34:09 host2 sshd[2463260]: Disconnected from invalid user jira 103.143.238.173 port 60214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.78.64
country_id: 690791
description:
Dec 24 19:34:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=194.44.78.64, lip=66.85.158.91, TLS, session=<xj2BIbNGi7bCLE5A>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.106.161.226
country_id: 783754
description:
Dec 24 19:33:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=79.106.161.226, lip=66.85.158.91, TLS, session=<XwBRILNGTNNPaqHi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.63.62.103
country_id: 895949
description:
Dec 24 19:36:29 host2 sshd[2466097]: Disconnected from invalid user qa 41.63.62.103 port 53296 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.63.62.103
country_id: 895949
description:
Dec 24 19:37:22 host2 sshd[2466944]: Disconnected from invalid user local 41.63.62.103 port 55452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.63.62.103
country_id: 895949
description:
Dec 24 19:38:57 host2 sshd[2468532]: Disconnected from invalid user mahesh 41.63.62.103 port 41884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.17
country_id: 3175395
description:
Dec 24 19:43:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.169.17, lip=66.85.158.91, TLS, session=<s8bNQ7NGdo25D6kR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.97.148
country_id: 3996063
description:
Dec 24 19:44:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=138.122.97.148, lip=66.85.158.91, TLS, session=<+EkFRbNGNJSKemGU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.203.8.57
country_id: 294640
description:
[2025-12-24 19:47:06 +0530] info [webmaild] 193.203.8.57 - info@askinternationalconsortium.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.116.20
country_id: 2921044
description:
[2025-12-24 19:48:31 +0530] info [cpaneld] 85.215.116.20 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 86.54.31.42
country_id: 2750405
description:
Dec 24 19:48:45 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 4 secs): user=<>, rip=86.54.31.42, lip=66.85.158.91, session=<WIOKVrNGArFWNh8q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.42
country_id: 2750405
description:
Dec 24 19:48:48 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.42, lip=66.85.158.91, session=<J/e9VrNGGr5WNh8q>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 19:51:48 host2 pure-ftpd[2483521]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.1
country_id: 3175395
description:
Dec 24 19:52:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.171.1, lip=66.85.158.91, TLS, session=<XAJCYbNGVeC5D6sB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.56
country_id: 3469034
description:
Dec 24 19:52:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=187.120.76.56, lip=66.85.158.91, TLS, session=<TAeSYrNGdqW7eEw4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-12-24 19:54:10 dovecot_login authenticator failed for H=([217.33.89.47]) [217.33.89.47]:58039: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-24 19:54:23 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:48108: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.236
country_id: 2635167
description:
Dec 24 19:59:14 host2 pure-ftpd[2491325]: (?@87.236.176.236) [INFO] New connection from 87.236.176.236


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.209.59
country_id: 798544
description:
Dec 24 20:06:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.246.209.59, lip=66.85.158.91, TLS, session=<T5Xuk7NGF4Fb9tE7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.216
country_id: 3469034
description:
Dec 24 20:06:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan>, method=PLAIN, rip=187.120.73.216, lip=66.85.158.91, TLS, session=<bbCxlbNGYIS7eEnY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.162.195
country_id: 1643084
description:
Dec 24 20:06:46 host2 sshd[2498298]: Disconnected from invalid user abhi 36.64.162.195 port 40592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 24 20:07:34 host2 sshd[2499023]: Disconnected from invalid user elasticsearch 43.154.195.142 port 46760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 24 20:09:13 host2 sshd[2500474]: Disconnected from invalid user guest 209.141.33.240 port 55048 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.64.162.195
country_id: 1643084
description:
Dec 24 20:09:20 host2 sshd[2500561]: Disconnected from invalid user guest 36.64.162.195 port 35254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.162.195
country_id: 1643084
description:
Dec 24 20:08:39 host2 sshd[2499979]: Disconnected from invalid user developer 36.64.162.195 port 45828 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Dec 24 20:08:51 host2 sshd[2500124]: Disconnected from invalid user userm 117.247.111.70 port 13838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.113.114.67
country_id: 1269750
description:
Dec 24 20:10:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.113.114.67, lip=66.85.158.91, TLS, session=<ytnforNG/JtncXJD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.247.111.70
country_id: 1269750
description:
Dec 24 20:09:35 host2 sshd[2500766]: Disconnected from invalid user newuser 117.247.111.70 port 30410 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.12
country_id: 3469034
description:
Dec 24 20:10:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=191.53.131.12, lip=66.85.158.91, TLS, session=<hWMWpLNGeYa/NYMM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.223.223.96
country_id: 3996063
description:
Dec 24 20:10:50 host2 sshd[2502347]: Disconnected from invalid user vyos 189.223.223.96 port 55104 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.247.111.70
country_id: 1269750
description:
Dec 24 20:10:58 host2 sshd[2502419]: Disconnected from invalid user developer 117.247.111.70 port 17322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 24 20:11:14 host2 sshd[2502640]: Disconnected from invalid user dev 36.66.16.233 port 44428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 24 20:11:57 host2 sshd[2503110]: Disconnected from invalid user ftpuser 43.154.195.142 port 33962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.25.51
country_id: 1605651
description:
Dec 24 20:13:51 host2 sshd[2504415]: Disconnected from invalid user david 49.228.25.51 port 34918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 24 20:13:58 host2 sshd[2504497]: Disconnected from invalid user userm 209.141.33.240 port 53330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 24 20:14:03 host2 sshd[2504592]: Disconnected from invalid user panfeng 36.66.16.233 port 41154 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 24 20:15:04 host2 sshd[2505454]: Disconnected from invalid user panfeng 209.141.33.240 port 54892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 24 20:14:52 host2 sshd[2505150]: Disconnected from invalid user user 36.66.16.233 port 54464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.25.51
country_id: 1605651
description:
Dec 24 20:15:51 host2 sshd[2506112]: Disconnected from invalid user developer 49.228.25.51 port 33536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-24 20:16:27 dovecot_login authenticator failed for H=(201.173.216.62-clientes-izzi.mx) [201.173.216.62]:50243: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.223.223.96
country_id: 3996063
description:
Dec 24 20:15:35 host2 sshd[2505967]: Disconnected from invalid user ansible 189.223.223.96 port 57504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.195.142
country_id: 1819730
description:
Dec 24 20:15:38 host2 sshd[2505978]: Disconnected from invalid user zk 43.154.195.142 port 40608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.25
country_id: 298795
description:
2025-12-24 20:16:55 dovecot_login authenticator failed for H=([188.59.178.25]) [188.59.178.25]:32980: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.223.223.96
country_id: 3996063
description:
Dec 24 20:17:51 host2 sshd[2507515]: Disconnected from invalid user sftpuser 189.223.223.96 port 7786 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.223.223.96
country_id: 3996063
description:
Dec 24 20:20:04 host2 sshd[2509257]: Disconnected from invalid user lsk 189.223.223.96 port 54846 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.58
country_id: 6252001
description:
Dec 24 20:20:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=162.216.149.58, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Tncsx7NGGtui2JU6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.58
country_id: 6252001
description:
Dec 24 20:21:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.58, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<zzlyyrNG7Pii2JU6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-24 20:22:05 dovecot_login authenticator failed for H=(54-170-97-62.cust.smartcall.no) [62.97.170.54]:40844: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.223.223.96
country_id: 3996063
description:
Dec 24 20:22:12 host2 sshd[2511149]: Disconnected from invalid user runner 189.223.223.96 port 39401 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-24 20:23:01 dovecot_login authenticator failed for H=96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:54056: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.58
country_id: 6252001
description:
Dec 24 20:27:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.58, lip=66.85.158.92, TLS, session=<LgyF37NGLPai2JU6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.19.24.57
country_id: 798544
description:
Dec 24 20:31:15 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=146.19.24.57, lip=66.85.158.91, session=<3uyM7rNGFIWSExg5>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 206.189.19.148
country_id: 2635167
description:
Dec 24 20:31:52 host2 pure-ftpd[2519991]: (?@206.189.19.148) [INFO] New connection from 206.189.19.148


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.19.24.57
country_id: 798544
description:
Dec 24 20:36:54 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=146.19.24.57, lip=66.85.158.92, session=<pVa/ArRGxtuSExg5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-24 20:37:00 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:56460: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Dec 24 20:38:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<T6mRCLRG3qm4aYtG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-24 20:41:31 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:46274: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.82
country_id: 3865483
description:
Dec 24 20:44:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.251.82, lip=66.85.158.91, TLS, session=<xpaMG7RG78uzAPtS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.29.66
country_id: 933860
description:
Dec 24 20:44:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=83.143.29.66, lip=66.85.158.91, TLS, session=<slPaHLRG+99Tjx1C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Dec 24 20:46:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, session=<KCc2JrRG1v7CpRCn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.19.24.57
country_id: 798544
description:
Dec 24 20:49:09 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=146.19.24.57, lip=66.85.158.91, session=<x2qLLrRGasySExg5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 154.83.27.33
country_id: 241170
description:
Dec 24 20:49:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=154.83.27.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uZ7+L7RGAJGaUxsh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.106
country_id: 953987
description:
Dec 24 20:50:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=102.64.40.106, lip=66.85.158.91, TLS, session=<mWjMMLRGudNmQChq>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.131
country_id: 6252001
description:
Dec 24 20:50:20 host2 pure-ftpd[2540927]: (?@198.235.24.131) [INFO] New connection from 198.235.24.131


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.216.135.138
country_id: 1168579
description:
Dec 24 20:50:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=103.216.135.138, lip=66.85.158.91, TLS, session=<nwYhMrRGn99n2IeK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.19.24.57
country_id: 798544
description:
Dec 24 20:54:10 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=146.19.24.57, lip=66.85.158.91, session=<sZB6QLRGcs6SExg5>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 20:54:32 host2 pure-ftpd[2546120]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.19.24.57
country_id: 798544
description:
Dec 24 20:56:21 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=146.19.24.57, lip=66.85.158.91, session=<ZDpJSLRGNomSExg5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.173
country_id: 3175395
description:
Dec 24 20:56:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.197.9.173, lip=66.85.158.91, TLS, session=<5O1YR7RGuaK5xQmt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.211.16.169
country_id: 2300660
description:
Dec 24 20:56:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.211.16.169, lip=66.85.158.91, TLS, session=<jbaDSLRGAegp0xCp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 20:58:42 host2 sshd[2549736]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-24 21:02:43 dovecot_login authenticator failed for H=([152.52.246.198]) [152.52.246.198]:52164: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.22.140
country_id: 1269750
description:
2025-12-24 21:03:16 dovecot_login authenticator failed for H=([103.68.22.140]) [103.68.22.140]:39867: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-24 21:03:49 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:56122: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2025-12-24 21:04:13 dovecot_login authenticator failed for H=([152.70.157.25]) [152.70.157.25]:39000: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.40.73.133
country_id: 6252001
description:
[2025-12-24 21:05:18 +0530] info [webmaild] 216.40.73.133 - info@agentallianz.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User info@agentallianz.com has their account suspended. Login blocked.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.204.223.100
country_id: 2328926
description:
Dec 24 21:05:39 host2 pure-ftpd[2555773]: (?@102.204.223.100) [INFO] New connection from 102.204.223.100


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.9.19.90
country_id: 2782113
description:
[2025-12-24 21:08:35 +0530] info [webmaild] 185.9.19.90 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 21:09:42 host2 sshd[2559115]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-24 21:11:38 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:47297: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.42.210.18
country_id: 1880251
description:
Dec 24 21:14:22 host2 pure-ftpd[2563344]: (?@152.42.210.18) [INFO] New connection from 152.42.210.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.3
country_id: 3996063
description:
2025-12-24 21:14:58 dovecot_login authenticator failed for H=([177.239.160.3]) [177.239.160.3]:46421: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-12-24 21:15:27 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:45561: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.205.186.84
country_id: 146669
description:
[2025-12-24 21:21:16 +0530] info [webmaild] 185.205.186.84 - training@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-12-24 21:23:46 dovecot_login authenticator failed for H=h77-53-110-11.cust.bredband2.com [77.53.110.11]:41878: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-12-24 21:26:29 dovecot_login authenticator failed for H=([123.209.106.190]) [123.209.106.190]:49686: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-12-24 21:26:57 dovecot_login authenticator failed for H=([125.18.28.146]) [125.17.185.94]:58344: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.45
country_id: 3996063
description:
2025-12-24 21:29:00 dovecot_login authenticator failed for H=(189.219.138.45-clientes-izzi.mx) [189.219.138.45]:59761: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-24 21:29:26 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:33146: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.205
country_id: 6252001
description:
Dec 24 21:32:57 host2 pure-ftpd[2579478]: (?@205.210.31.205) [INFO] New connection from 205.210.31.205


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 38.148.242.232
country_id: 6252001
description:
Dec 24 21:40:08 host2 pure-ftpd[2586146]: (?@38.148.242.232) [INFO] New connection from 38.148.242.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-24 21:40:48 dovecot_login authenticator failed for H=2.135.31.74.dynamic.telecom.kz [2.135.31.74]:40914: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-12-24 21:41:42 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com [82.209.148.60]:50700: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-24 21:45:08 dovecot_login authenticator failed for H=([120.157.6.147]) [120.157.6.147]:42934: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-24 21:45:19 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:52844: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.108
country_id: 1733045
description:
2025-12-24 21:45:23 dovecot_login authenticator failed for H=([49.124.147.108]) [49.124.147.108]:34432: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.62.58
country_id: 1819730
description:
Dec 24 21:55:06 host2 sshd[2613485]: Disconnected from invalid user nominatim 20.255.62.58 port 37656 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-12-24 21:56:13 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:47762: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.24
country_id: 6252001
description:
Dec 24 21:56:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.24, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RvN/H7VGNMSi2JUY>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 21:57:01 host2 pure-ftpd[2615657]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-12-24 21:56:28 dovecot_login authenticator failed for H=(nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:42990: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.24
country_id: 6252001
description:
Dec 24 21:57:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.149.24, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Z3T/IrVGPP+i2JUY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 24 21:57:34 host2 sshd[2616250]: Disconnected from invalid user xyx 24.144.124.91 port 57608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 24 21:59:32 host2 sshd[2617953]: Disconnected from invalid user intern 24.144.124.91 port 54240 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.255.62.58
country_id: 1819730
description:
Dec 24 22:00:35 host2 sshd[2619066]: Disconnected from invalid user sebas 20.255.62.58 port 48256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.62.150
country_id: 6252001
description:
Dec 24 22:01:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=66.228.62.150, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<SeS2MrVGqdpC5D6W>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.24
country_id: 6252001
description:
Dec 24 22:04:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.24, lip=66.85.158.91, TLS, session=<Axu7PLVGjP+i2JUY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 24 22:06:12 host2 sshd[2623950]: Disconnected from invalid user hadi 5.182.83.231 port 35080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 24 22:07:13 host2 sshd[2624850]: Disconnected from invalid user vboxuser 5.182.83.231 port 55946 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 24 22:08:13 host2 sshd[2625873]: Disconnected from invalid user postgres 5.182.83.231 port 48632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-24 22:10:05 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:44788: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 24 22:10:13 host2 sshd[2627973]: Disconnected from invalid user terraria 5.182.83.231 port 53820 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 24 22:10:01 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<SxXHT7VGqB7UZija>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 24.144.124.91
country_id: 6252001
description:
Dec 24 22:11:07 host2 sshd[2628826]: Disconnected from invalid user sebas 24.144.124.91 port 46720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-24 22:10:25 dovecot_login authenticator failed for H=([197.219.228.250]) [197.219.228.250]:32882: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-24 22:12:48 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:53763: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-24 22:12:54 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:59155: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.242
country_id: 2186224
description:
2025-12-24 22:13:23 dovecot_login authenticator failed for H=([121.73.162.242]) [121.73.162.242]:33000: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.223
country_id: 6252001
description:
Dec 24 22:15:26 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.223, lip=66.85.158.91, TLS, session=<KX4mY7VGijotT7Xf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.239.145.75
country_id: 798544
description:
Dec 24 22:17:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=193.239.145.75, lip=66.85.158.91, TLS, session=<0vY3aLVGaNLB75FL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.159.85.208
country_id: 3469034
description:
Dec 24 22:16:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=201.159.85.208, lip=66.85.158.91, TLS, session=<t9/QZbVGl7LJn1XQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.41.18
country_id: 1269750
description:
2025-12-24 22:17:37 dovecot_login authenticator failed for H=([182.73.193.249]) [122.187.41.18]:58622: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2025-12-24 22:17:58 dovecot_login authenticator failed for H=([177.236.146.191]) [177.236.146.191]:49855: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 146.190.156.6
country_id: 6252001
description:
Dec 24 22:18:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=146.190.156.6, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0zqkbrVGdIySvpwG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Dec 24 22:20:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.69, lip=66.85.158.91, session=<xyapdbVG/rvY2s5F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.251.240
country_id: 290557
description:
2025-12-24 22:21:47 dovecot_login authenticator failed for H=([94.207.251.240]) [94.207.251.240]:50131: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-12-24 22:22:26 dovecot_login authenticator failed for H=(91-219-196-17.planeta.dn.ua) [91.219.196.17]:55806: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.241.134.107
country_id: 6252001
description:
Dec 24 22:24:17 host2 sshd[2640551]: Disconnected from invalid user admin 192.241.134.107 port 59082 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.241.134.107
country_id: 6252001
description:
Dec 24 22:25:27 host2 sshd[2641598]: Disconnected from invalid user julien 192.241.134.107 port 54798 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-24 22:26:18 dovecot_login authenticator failed for H=(cm-84.211.12.107.get.no) [84.211.12.107]:33888: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-24 22:26:33 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:51511: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-24 22:31:21 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:54467: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-24 22:33:32 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:49905: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-24 22:33:43 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:45444: 535 Incorrect authentication data (set_id=washeera)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.162
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.162: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-24 22:40:10 dovecot_login authenticator failed for H=([182.95.228.194]) [182.95.228.194]:34378: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-24 22:39:44 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:33100: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.159.174.81
country_id: 1733045
description:
Dec 24 22:42:53 host2 sshd[2656042]: Disconnected from invalid user facai 110.159.174.81 port 39246 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 22:43:55 host2 sshd[2657102]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.43
country_id: 298795
description:
2025-12-24 22:46:11 dovecot_login authenticator failed for H=([188.59.178.43]) [188.59.178.43]:53475: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.159.174.81
country_id: 1733045
description:
Dec 24 22:45:13 host2 sshd[2658575]: Disconnected from invalid user test123 110.159.174.81 port 48664 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-24 22:45:21 dovecot_login authenticator failed for H=(219-163-97-62.cust.smartcall.no) [62.97.163.219]:46217: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-24 22:47:07 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:43171: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.159.174.81
country_id: 1733045
description:
Dec 24 22:48:32 host2 sshd[2661614]: Disconnected from invalid user avahi 110.159.174.81 port 32768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.0.246
country_id: 1880251
description:
2025-12-24 22:48:59 dovecot_login authenticator failed for H=(246.0.245.49.unknown.m1.com.sg) [49.245.0.246]:35846: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-24 22:48:16 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:36695: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.87.21.241
country_id: 953987
description:
Dec 24 22:49:37 host2 sshd[2662489]: Disconnected from invalid user fastuser 20.87.21.241 port 53232 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.214.126.1
country_id: 6252001
description:
Dec 24 22:51:10 host2 sshd[2664048]: Disconnected from invalid user zimbra 162.214.126.1 port 37888 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 162.214.126.1
country_id: 6252001
description:
Dec 24 22:51:40 host2 sshd[2664470]: Received disconnect from 162.214.126.1 port 49934:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.126.1
country_id: 6252001
description:
Dec 24 22:52:12 host2 sshd[2664962]: Disconnected from invalid user asw 162.214.126.1 port 33762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 24 22:53:34 host2 sshd[2666484]: Disconnected from invalid user flora 51.178.43.161 port 56000 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 24 22:54:05 host2 sshd[2667373]: Disconnected from invalid user couchdb 51.178.43.161 port 39578 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 24 22:54:46 host2 sshd[2668263]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 166.0.106.131
country_id: 6251999
description:
Dec 24 22:54:33 host2 pure-ftpd[2668117]: (?@166.0.106.131) [INFO] New connection from 166.0.106.131


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 24 22:58:13 host2 sshd[2671094]: Disconnected from invalid user tony 103.117.57.134 port 33656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 24 22:59:30 host2 sshd[2672139]: Disconnected from invalid user phpmy 103.117.57.134 port 35104 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 24 22:59:41 host2 pure-ftpd[2672299]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-12-24 23:00:51 dovecot_login authenticator failed for H=202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:63570: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-24 23:01:15 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:43900: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.87.21.241
country_id: 953987
description:
Dec 24 23:01:29 host2 sshd[2674234]: Disconnected from invalid user admin1 20.87.21.241 port 57578 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-24 23:05:07 dovecot_login authenticator failed for H=(cm-84.211.14.36.get.no) [84.211.14.36]:41255: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.215.228.47
country_id: 130758
description:
Dec 24 23:04:28 host2 sshd[2676769]: Disconnected from invalid user raaj 185.215.228.47 port 42008 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.135.156
country_id: 6290252
description:
Dec 24 23:05:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=91.234.135.156, lip=66.85.158.91, TLS, session=<mK3DFbZGULJb6oec>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.41.134
country_id: 226074
description:
2025-12-24 23:05:42 dovecot_login authenticator failed for H=([196.0.41.134]) [196.0.41.134]:46407: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.209
country_id: 1269750
description:
Dec 24 23:05:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.164.246.209, lip=66.85.158.91, TLS, session=<Xp3bFrZGtMRnpPbR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 24 23:07:15 host2 sshd[2679205]: Disconnected from invalid user marina 190.60.51.173 port 50674 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 24 23:07:50 host2 sshd[2679655]: Disconnected from invalid user spooler 190.60.51.173 port 42632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.46.40
country_id: 3017382
description:
Dec 24 23:09:06 host2 sshd[2680605]: Disconnected from invalid user deploy 51.83.46.40 port 34558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Dec 24 23:08:38 host2 sshd[2680240]: Disconnected from invalid user rocketmq 51.83.46.40 port 41818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Dec 24 23:11:31 host2 sshd[2683031]: Disconnected from invalid user giulia 51.83.46.40 port 48686 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.141
country_id: 6252001
description:
Dec 24 23:11:37 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.141, lip=66.85.158.92, TLS handshaking: Connection closed, session=<FWIPLLZGO35APsWN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.137
country_id: 6252001
description:
Dec 24 23:11:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.137, lip=66.85.158.92, TLS handshaking: Connection closed, session=<sqARLbZGVmtAPsWJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.215.228.47
country_id: 130758
description:
Dec 24 23:17:32 host2 sshd[2688458]: Disconnected from invalid user marina 185.215.228.47 port 42628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.230.80.18
country_id: 3865483
description:
Dec 24 23:17:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=45.230.80.18, lip=66.85.158.91, TLS, session=<SQa1QLZGEOYt5lAS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.96.81
country_id: 3865483
description:
Dec 24 23:18:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan>, method=PLAIN, rip=190.181.96.81, lip=66.85.158.91, TLS, session=<+k5HQrZGyoq+tWBR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.108
country_id: 3865483
description:
Dec 24 23:22:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=179.0.252.108, lip=66.85.158.91, TLS, session=<rL+EULZGCoGzAPxs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.136.85.43
country_id: 1269750
description:
Dec 24 23:22:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=202.136.85.43, lip=66.85.158.91, TLS, session=<awlkUrZGcYDKiFUr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Dec 24 23:23:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tqQcWLZGfrRAPpzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.22
country_id: 1269750
description:
2025-12-24 23:25:23 dovecot_login authenticator failed for H=(aes-static-105.28.22.125.airtel.in) [182.95.228.22]:40246: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Dec 24 23:24:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS: Connection closed, session=<W/YPWrZG8MdAPpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.69
country_id: 6252001
description:
Dec 24 23:24:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.69, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dBogWrZGnNy4aYtF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-24 23:25:04 dovecot_login authenticator failed for H=([65.20.250.163]) [65.20.250.163]:42126: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.53.56
country_id: 2750405
description:
2025-12-24 23:27:55 dovecot_login authenticator failed for H=(72BR2l7) [178.16.53.56]:60827: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.53.56
country_id: 2750405
description:
2025-12-24 23:28:43 dovecot_login authenticator failed for H=(iCpxspv) [178.16.53.56]:56237: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.53.56
country_id: 2750405
description:
2025-12-24 23:29:50 dovecot_login authenticator failed for H=(GJuCo7) [178.16.53.56]:53254: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.168.213
country_id: 6252001
description:
[2025-12-24 23:33:38 +0530] info [webmaild] 140.235.168.213 - info@greentaraceylon.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.53.56
country_id: 2750405
description:
2025-12-24 23:33:43 dovecot_login authenticator failed for H=(ujQhLJ) [178.16.53.56]:51071: 535 Incorrect authentication data (set_id=ajith)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 178.16.53.56
country_id: 2750405
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[178.16.53.56] [Authentication Database]=[mail] [Username]=[ajith] (5/5 failures) (blocked until [Wed Dec 24 18:18:41 2025 UTC/Wed Dec 24 23:48:41 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-24 23:36:20 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:33041: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-12-24 23:36:34 dovecot_login authenticator failed for H=([102.88.10.10]) [102.88.10.10]:47486: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec 24 23:38:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<0tQPi7ZGxv8t4/6c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.79
country_id: 6252001
description:
Dec 24 23:44:54 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=18.97.5.79, lip=66.85.158.91, session=<k7cSo7ZGnOwSYQVP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.199.170
country_id: 3865483
description:
Dec 24 23:47:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=186.96.199.170, lip=66.85.158.91, TLS, session=<VCRpqrZG9ai6YMeq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.105
country_id: 953987
description:
Dec 24 23:47:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=102.129.62.105, lip=66.85.158.91, TLS, session=<uZhpqrZG04xmgT5p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.72.24.206
country_id: 51537
description:
Dec 24 23:47:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact>, method=PLAIN, rip=154.72.24.206, lip=66.85.158.91, TLS, session=<A6q8q7ZGc7CaSBjO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.55.23
country_id: 953987
description:
Dec 24 23:47:40 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact>, method=PLAIN, rip=102.129.55.23, lip=66.85.158.91, TLS, session=<gQDLq7ZGtOJmgTcX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.177.179.32
country_id: 1269750
description:
2025-12-24 23:48:10 dovecot_login authenticator failed for H=([223.177.179.32]) [223.177.179.32]:47988: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.16.88.39
country_id: 1269750
description:
Dec 24 23:48:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=210.16.88.39, lip=66.85.158.91, TLS, session=<cp3orbZGp4XSEFgn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.40
country_id: 1269750
description:
Dec 24 23:48:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=103.18.166.40, lip=66.85.158.91, TLS, session=<9Awqr7ZGbo9nEqYo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.105.86
country_id: 6252001
description:
Dec 24 23:50:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.80.105.86, lip=66.85.158.91, session=<BrOLuLZG4LIUUGlW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 24 23:55:03 host2 sshd[2723535]: Disconnected from invalid user ubuntu 189.194.140.170 port 42082 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-24 23:56:58 dovecot_login authenticator failed for H=(cm-46.212.39.201.get.no) [46.212.39.201]:49191: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 24 23:57:27 host2 sshd[2725600]: Disconnected from invalid user postgres 181.49.50.6 port 51850 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-24 23:57:38 dovecot_login authenticator failed for H=([84.211.10.140]) [84.211.10.140]:41784: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.6
country_id: 1819730
description:
2025-12-24 23:57:58 dovecot_login authenticator failed for H=(m121-202-152-6.smartone.com) [121.202.152.6]:55866: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 24 23:58:06 host2 sshd[2726212]: Disconnected from invalid user ftpuser 189.194.140.170 port 54310 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2025-12-24 23:58:12 dovecot_login authenticator failed for H=(31-154-85-196.orange.net.il) [2.55.85.196]:56490: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 24 23:59:21 host2 sshd[2727184]: Disconnected from invalid user ubuntu 189.194.140.170 port 50060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Dec 24 23:59:56 host2 sshd[2727608]: Disconnected from invalid user ftpuser 181.49.50.6 port 51628 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 25 00:01:01 host2 sshd[2728765]: Disconnected from invalid user user19 189.194.140.170 port 57782 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 00:02:12 host2 pure-ftpd[2729695]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 25 00:03:35 host2 sshd[2730905]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 61793


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 25 00:06:13 host2 sshd[2733386]: Disconnected from invalid user postgres 189.194.140.170 port 52722 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.194.140.170
country_id: 3996063
description:
Dec 25 00:07:19 host2 sshd[2734230]: Disconnected from invalid user user 189.194.140.170 port 48456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.78.162
country_id: 3469034
description:
Dec 25 00:07:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=177.190.78.162, lip=66.85.158.91, TLS, session=<ygxE9LZGsdexvk6i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.40.202.94
country_id: 1269750
description:
Dec 25 00:08:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan>, method=PLAIN, rip=103.40.202.94, lip=66.85.158.91, TLS, session=<qj579bZG77NnKMpe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 25 00:09:06 host2 sshd[2736013]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 58450


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-12-25 00:09:07 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.253
country_id: 6252001
description:
Dec 25 00:14:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.64.105.253, lip=66.85.158.92, session=<1U2BDLdGaMkUQGn9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.2
country_id: 6252001
description:
Dec 25 00:14:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.2, lip=66.85.158.91, session=<OvPtDLdGXKRKUi8C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.50
country_id: 6252001
description:
Dec 25 00:15:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.50, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<xDWfELdGltnN0h8y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 25 00:18:10 host2 sshd[2744656]: Disconnected from invalid user nate 172.208.24.217 port 42888 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.76
country_id: 953987
description:
Dec 25 00:18:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=102.129.51.76, lip=66.85.158.91, TLS, session=<JOV5GbdG8YlmgTNM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-25 00:19:09 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:59462: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.150
country_id: 226074
description:
Dec 25 00:18:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=196.0.87.150, lip=66.85.158.91, TLS, session=<d/nnGrdGe+PEAFeW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 25 00:18:44 host2 sshd[2745117]: Disconnected from invalid user tomcat7 172.208.24.217 port 13638 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.172
country_id: 6252001
description:
Dec 25 00:19:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.172, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gxSYH7dGRdDN0h+s>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-25 00:19:47 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:39696: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 25 00:19:53 host2 sshd[2746132]: Disconnected from invalid user backuppc 172.208.24.217 port 43526 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.175.190
country_id: 2921044
description:
Dec 25 00:25:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=164.90.175.190, lip=66.85.158.92, session=<JJBKNbdGnxKkWq++>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.60.73
country_id: 2921044
description:
Dec 25 00:25:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=206.189.60.73, lip=66.85.158.92, session=<rYpiNbdGpGzOvTxJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Dec 25 00:26:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Te1+NrdGYv7CpRCn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 00:28:15 host2 sshd[2754446]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 00:39:00 host2 sshd[2763511]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.145.68.102
country_id: 6252001
description:
[2025-12-25 00:39:19 +0530] info [whostmgrd] 216.145.68.102 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-12-25 00:40:10 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:52772: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.215.142
country_id: 933860
description:
Dec 25 00:40:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=41.216.215.142, lip=66.85.158.91, TLS, session=<eGH2aLdG+tIp2NeO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-25 00:40:48 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:50634: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.196
country_id: 953987
description:
Dec 25 00:40:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=102.64.46.196, lip=66.85.158.91, TLS, session=<LW9FardGtMtmQC7E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-25 00:45:29 dovecot_login authenticator failed for H=(cm-84.211.14.36.get.no) [84.211.14.36]:58791: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.64.93.161
country_id: 2077456
description:
2025-12-25 00:45:42 dovecot_login authenticator failed for H=115-64-93-161.tpgi.com.au [115.64.93.161]:56096: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2025-12-25 00:54:04 dovecot_login authenticator failed for H=([125.23.79.65]) [122.185.146.166]:37728: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.232.62.178
country_id: 3469034
description:
Dec 25 01:04:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=168.232.62.178, lip=66.85.158.91, TLS, session=<g/K+vrdGzoio6D6y>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 01:04:46 host2 pure-ftpd[2787825]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.157
country_id: 3175395
description:
Dec 25 01:04:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=185.15.171.157, lip=66.85.158.91, TLS, session=<6ccNwLdG3+e5D6ud>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.109.186
country_id: 226074
description:
Dec 25 01:06:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=196.0.109.186, lip=66.85.158.91, TLS, session=<vWYrx7dGKJ/EAG26>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.203
country_id: 3865483
description:
Dec 25 01:07:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.122.128.203, lip=66.85.158.91, TLS, session=<QNF0yLdGYNi+eoDL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-25 01:11:58 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:52249: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-25 01:12:08 dovecot_login authenticator failed for H=([65.191.211.33]) [65.191.211.33]:54898: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.178.14.65
country_id: 2464461
description:
Dec 25 01:11:48 host2 sshd[2794613]: Invalid user cloudtourssrilan_travel from 196.178.14.65 port 58925


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.178.14.65
country_id: 2464461
description:
[2025-12-25 01:11:49 +0530] info [cpaneld] 196.178.14.65 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-25 01:11:53 dovecot_login authenticator failed for H=([197.156.121.38]) [213.55.85.202]:3978: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-25 01:18:40 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:40370: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-12-25 01:18:42 dovecot_login authenticator failed for H=([41.72.201.170]) [41.72.202.86]:59870: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.90
country_id: 3996063
description:
2025-12-25 01:19:07 dovecot_login authenticator failed for H=(189.218.82.90-clientes-izzi.mx) [189.218.82.90]:40131: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-25 01:19:30 dovecot_login authenticator failed for H=([122.186.202.58]) [122.186.202.58]:50638: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-25 01:19:43 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:53306: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-25 01:25:22 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:46948: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-25 01:25:33 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:54478: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 25 01:30:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.91, session=<ePTBHLhGo//CpRCh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2025-12-25 01:33:16 dovecot_login authenticator failed for H=(18980204017.user.veloxzone.com.br) [189.80.146.46]:38526: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-25 01:33:35 dovecot_login authenticator failed for H=(30-170-97-62.cust.smartcall.no) [62.97.170.30]:34715: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-25 01:41:56 dovecot_login authenticator failed for H=([152.52.14.137]) [182.79.89.14]:47502: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.102.107.142
country_id: 3057568
description:
2025-12-25 01:44:27 dovecot_login authenticator failed for H=adsl-dyn-142.95-102-107.t-com.sk [95.102.107.142]:45356: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-25 01:48:35 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:39813: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-25 01:52:00 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:57049: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.70
country_id: 6252001
description:
Dec 25 01:54:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=98.80.4.70, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dOhxcbhG0JFiUARG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 01:55:16 host2 sshd[2831728]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-12-25 01:55:49 dovecot_login authenticator failed for H=([49.231.31.220]) [49.231.31.220]:34041: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-25 01:56:21 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:39714: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.233.77
country_id: 1861060
description:
Dec 25 01:57:56 host2 sshd[2833851]: Disconnected from invalid user diquest 156.227.233.77 port 55962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Dec 25 01:58:29 host2 sshd[2834220]: Disconnected from invalid user geek 51.75.27.166 port 57508 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.27.166
country_id: 3017382
description:
Dec 25 02:00:10 host2 sshd[2835683]: Disconnected from invalid user andrey 51.75.27.166 port 55566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.233.77
country_id: 1861060
description:
Dec 25 01:59:50 host2 sshd[2835221]: Disconnected from invalid user macro 156.227.233.77 port 57976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.239.86
country_id: 1819730
description:
Dec 25 02:01:10 host2 sshd[2836454]: Disconnected from invalid user macro 103.143.239.86 port 43808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.233.77
country_id: 1861060
description:
Dec 25 02:00:28 host2 sshd[2835937]: Disconnected from invalid user test 156.227.233.77 port 59684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Dec 25 02:00:44 host2 sshd[2836126]: Disconnected from invalid user testuser1 51.75.27.166 port 51038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Dec 25 02:02:09 host2 sshd[2837123]: Disconnected from invalid user larry 161.132.68.222 port 60918 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.51
country_id: 6252001
description:
Dec 25 02:01:26 host2 pure-ftpd[2836653]: (?@205.210.31.51) [INFO] New connection from 205.210.31.51


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.239.86
country_id: 1819730
description:
Dec 25 02:01:40 host2 sshd[2836792]: Disconnected from invalid user manager 103.143.239.86 port 51714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.227.233.77
country_id: 1861060
description:
Dec 25 02:01:50 host2 sshd[2836898]: Disconnected from invalid user user 156.227.233.77 port 37772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.239.86
country_id: 1819730
description:
Dec 25 02:03:17 host2 sshd[2838098]: Disconnected from invalid user teste1 103.143.239.86 port 48896 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.227.233.77
country_id: 1861060
description:
Dec 25 02:02:25 host2 sshd[2837322]: Disconnected from invalid user alfresco 156.227.233.77 port 34112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Dec 25 02:02:52 host2 sshd[2837649]: Disconnected from invalid user wyse 161.132.68.222 port 57090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Dec 25 02:03:34 host2 sshd[2838284]: Disconnected from invalid user flora 161.132.68.222 port 58772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.225.146.23
country_id: 934292
description:
Dec 25 02:03:38 host2 sshd[2838322]: Disconnected from invalid user coin 197.225.146.23 port 42726 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec 25 02:04:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.112, lip=66.85.158.92, TLS: Connection closed, session=<Lkv9lLhGTrZChJlw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.68.222
country_id: 3932488
description:
Dec 25 02:04:14 host2 sshd[2839022]: Disconnected from invalid user gis 161.132.68.222 port 51946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.225.146.23
country_id: 934292
description:
Dec 25 02:04:25 host2 sshd[2839192]: Disconnected from invalid user aaron 197.225.146.23 port 40562 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 02:07:17 host2 pure-ftpd[2842750]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.39.9.137
country_id: 1168579
description:
Dec 25 02:06:28 host2 sshd[2841811]: Disconnected from invalid user postgres 110.39.9.137 port 41792 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.39.9.137
country_id: 1168579
description:
Dec 25 02:10:08 host2 sshd[2845937]: Disconnected from invalid user abc 110.39.9.137 port 54666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.39.9.137
country_id: 1168579
description:
Dec 25 02:10:44 host2 sshd[2846634]: Disconnected from invalid user saude 110.39.9.137 port 37998 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 02:11:58 host2 sshd[2848243]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.172
country_id: 953987
description:
Dec 25 02:12:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=102.64.43.172, lip=66.85.158.91, TLS, session=<g6ilsLhGWMlmQCus>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.211.94
country_id: 933860
description:
Dec 25 02:12:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan>, method=PLAIN, rip=41.216.211.94, lip=66.85.158.91, TLS, session=<CfhYsrhGdbQp2NNe>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.187.21.105
country_id: 298795
description:
Dec 25 02:13:02 host2 sshd[2849342]: Disconnected from invalid user guest 78.187.21.105 port 38852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.187.21.105
country_id: 298795
description:
Dec 25 02:12:30 host2 sshd[2848763]: Disconnected from invalid user test1 78.187.21.105 port 39098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.114
country_id: 1880251
description:
Dec 25 02:13:22 host2 sshd[2849888]: Disconnected from invalid user abc 45.78.230.114 port 45222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.114
country_id: 1880251
description:
Dec 25 02:14:24 host2 sshd[2850993]: Disconnected from invalid user saude 45.78.230.114 port 50086 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.216.213.140
country_id: 2921044
description:
[2025-12-25 02:16:03 +0530] info [cpaneld] 185.216.213.140 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.114
country_id: 1880251
description:
Dec 25 02:16:30 host2 sshd[2853494]: Disconnected from invalid user username 45.78.230.114 port 37342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.114
country_id: 1880251
description:
Dec 25 02:18:32 host2 sshd[2855314]: Disconnected from invalid user allinone 45.78.230.114 port 48828 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 02:22:41 host2 sshd[2859023]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-25 02:23:02 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:37385: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.244.238
country_id: 2077456
description:
2025-12-25 02:23:27 dovecot_login authenticator failed for H=([161.8.244.238]) [161.8.244.238]:33031: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-25 02:23:32 dovecot_login authenticator failed for H=(nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:43748: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.176.50
country_id: 1861060
description:
2025-12-25 02:23:54 dovecot_login authenticator failed for H=p388051-obmd01.tokyo.ocn.ne.jp [60.45.176.50]:58053: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 25 02:26:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<To2I5bhGSomLonHU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.204
country_id: 6252001
description:
Dec 25 02:29:55 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.204, lip=66.85.158.92, session=<CI828bhGcLZC5DXM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.88.186
country_id: 1269750
description:
Dec 25 02:33:57 host2 sshd[2870022]: Disconnected from invalid user rabbit 68.183.88.186 port 43940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.88.186
country_id: 1269750
description:
Dec 25 02:35:53 host2 sshd[2871760]: Disconnected from invalid user backuppc 68.183.88.186 port 43582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.88.186
country_id: 1269750
description:
Dec 25 02:36:33 host2 sshd[2872499]: Disconnected from invalid user jay 68.183.88.186 port 57344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.15.163.44
country_id: 597427
description:
2025-12-25 02:38:47 dovecot_login authenticator failed for H=([84.15.163.44]) [84.15.163.44]:39512: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2025-12-25 02:39:07 dovecot_login authenticator failed for H=([176.30.212.99]) [176.30.212.99]:45786: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-25 02:41:53 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:59388: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-25 02:42:11 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:50655: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.27.65
country_id: 2921044
description:
Dec 25 02:45:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.89.27.65, lip=66.85.158.92, TLS, session=<L5A+KrlG5FKfWRtB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-25 02:49:37 dovecot_login authenticator failed for H=([125.19.175.68]) [152.52.236.158]:45898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-25 02:50:08 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:51722: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.208
country_id: 1880251
description:
Dec 25 02:50:43 host2 sshd[2885118]: Disconnected from invalid user bamboo 45.78.201.208 port 49786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-12-25 02:52:02 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:42958: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2025-12-25 02:51:33 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:37096: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.245.178
country_id: 1269750
description:
2025-12-25 02:51:58 dovecot_login authenticator failed for H=(dhcp-192-245-178.in2cable.com) [203.192.245.178]:43394: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.60
country_id: 798544
description:
Dec 25 03:01:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.228.33.60, lip=66.85.158.91, TLS, session=<5LpvYrlG4qFb5CE8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.84
country_id: 1210997
description:
2025-12-25 03:02:15 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.84]:47508: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.82.86
country_id: 1880251
description:
2025-12-25 03:03:06 dovecot_login authenticator failed for H=(86.82.156.175.unknown.m1.com.sg) [175.156.82.86]:53793: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.25.132.182
country_id: 1269750
description:
Dec 25 03:02:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=103.25.132.182, lip=66.85.158.91, TLS, session=<czJAZLlG+MFnGYS2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.242.112.200
country_id: 1269750
description:
2025-12-25 03:03:00 dovecot_login authenticator failed for H=(static-154-209-252-178.pol.net.in) [121.242.112.200]:55948: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 25 03:04:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, TLS: Connection closed, session=<YTYYbLlGKIdChJl9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 25 03:04:19 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, session=<IhlJbLlGjIdChJl9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-12-25 03:08:12 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:63757: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 03:09:43 host2 pure-ftpd[2900358]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.208
country_id: 1880251
description:
Dec 25 03:10:20 host2 sshd[2900929]: Disconnected from invalid user pierre 45.78.201.208 port 46884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Dec 25 03:11:28 host2 sshd[2902243]: Disconnected from invalid user testadmin 40.82.214.8 port 46092 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.57.217
country_id: 953987
description:
Dec 25 03:15:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.129.57.217, lip=66.85.158.91, TLS, session=<fn1RlLlGP8FmgTnZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.128
country_id: 3175395
description:
Dec 25 03:15:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=217.26.179.128, lip=66.85.158.91, TLS, session=<Ocktk7lGTdrZGrOA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.89.76
country_id: 1880251
description:
Dec 25 03:15:36 host2 sshd[2905562]: Disconnected from invalid user dev 103.189.89.76 port 59550 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 14.139.216.56
country_id: 1269750
description:
Dec 25 03:16:19 host2 sshd[2906285]: Disconnected from invalid user user1 14.139.216.56 port 56012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.89.76
country_id: 1880251
description:
Dec 25 03:17:21 host2 sshd[2907053]: Disconnected from invalid user sl 103.189.89.76 port 52254 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 25 03:17:46 host2 sshd[2907338]: Disconnected from invalid user vanessa 104.248.245.89 port 36440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 25 03:18:39 host2 sshd[2908129]: Disconnected from invalid user debian 104.248.245.89 port 44314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.86.95.199
country_id: 2921044
description:
Dec 25 03:19:16 host2 sshd[2908659]: Disconnected from invalid user user 172.86.95.199 port 54364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.196.237
country_id: 241170
description:
Dec 25 03:18:20 host2 sshd[2907804]: Disconnected from invalid user user 154.83.196.237 port 42448 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.93.68.178
country_id: 3469034
description:
Dec 25 03:20:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<eng_env@lezzarotech.com>, method=PLAIN, rip=187.93.68.178, lip=66.85.158.91, TLS, session=<ti00o7lGZ7S7XUSy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.201.199.153
country_id: 1880251
description:
Dec 25 03:20:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env@lezzarotech.com>, method=PLAIN, rip=118.201.199.153, lip=66.85.158.91, TLS, session=<p9oyo7lG2tZ2yceZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 216.21.208.55
country_id: 6252001
description:
Dec 25 03:20:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<env.eng@lezzarotech.com>, method=PLAIN, rip=216.21.208.55, lip=66.85.158.91, session=<93yxpLlGXczYFdA3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2025-12-25 03:19:22 dovecot_login authenticator failed for H=(18980204017.user.veloxzone.com.br) [189.80.146.46]:46155: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.223.53.234
country_id: 3932488
description:
Dec 25 03:19:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<eng@lezzarotech.com>, method=PLAIN, rip=190.223.53.234, lip=66.85.158.91, session=<fUC4o7lGSpy+3zXq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.230.13
country_id: 1269750
description:
Dec 25 03:20:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<eng.env@lezzarotech.com>, method=PLAIN, rip=122.187.230.13, lip=66.85.158.91, TLS, session=<4dRMo7lGL7p6u+YN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 88.248.250.143
country_id: 298795
description:
Dec 25 03:20:14 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (client didn't finish SASL auth, waited 7 secs): user=<>, method=PLAIN, rip=88.248.250.143, lip=66.85.158.91, session=<Ac7ApLlG7MlY+PqP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.233.235.203
country_id: 2661886
description:
Dec 25 03:20:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<enveng>, method=PLAIN, rip=81.233.235.203, lip=66.85.158.91, session=<A/RYpblGislR6evL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.86.95.199
country_id: 2921044
description:
Dec 25 03:19:44 host2 sshd[2908959]: Disconnected from invalid user kyt 172.86.95.199 port 48872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.149.93
country_id: 99237
description:
Dec 25 03:19:58 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<engenv@lezzarotech.com>, method=PLAIN, rip=65.20.149.93, lip=66.85.158.91, TLS, session=<11Awo7lGg5pBFJVd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.53.15.180
country_id: 2542007
description:
Dec 25 03:19:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=102.53.15.180, lip=66.85.158.91, TLS, session=<XWcvo7lGIc5mNQ+0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.57.69.227
country_id: 690791
description:
Dec 25 03:20:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng>, method=PLAIN, rip=37.57.69.227, lip=66.85.158.91, session=<di92pLlGUb8lOUXj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.89.76
country_id: 1880251
description:
Dec 25 03:19:35 host2 sshd[2908843]: Disconnected from invalid user debian 103.189.89.76 port 34024 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.106.49.149
country_id: 3932488
description:
Dec 25 03:19:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=200.106.49.149, lip=66.85.158.91, session=<N9Oto7lGYrDIajGV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.241.132.152
country_id: 1269750
description:
Dec 25 03:19:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env-eng@lezzarotech.com>, method=PLAIN, rip=43.241.132.152, lip=66.85.158.91, session=<bJbDo7lGXsEr8YSY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 2.180.18.173
country_id: 130758
description:
Dec 25 03:20:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env-eng>, method=PLAIN, rip=2.180.18.173, lip=66.85.158.91, session=<S8GYpLlGxbgCtBKt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.144.243.93
country_id: 2542007
description:
Dec 25 03:20:09 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<eng-env@lezzarotech.com>, method=PLAIN, rip=154.144.243.93, lip=66.85.158.91, TLS, session=<8f/no7lG9s+akPNd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.21.17.225
country_id: 6252001
description:
2025-12-25 03:19:55 dovecot_login authenticator failed for H=h225.17.21.98.static.ip.windstream.net [98.21.17.225]:42854: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.46.45.121
country_id: 290557
description:
Dec 25 03:19:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<enveng@lezzarotech.com>, method=PLAIN, rip=20.46.45.121, lip=66.85.158.91, TLS, session=<CW8wo7lGkfEULi15>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 25 03:20:31 host2 sshd[2909802]: Received disconnect from 104.248.245.89 port 46584:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.57.69.227
country_id: 690791
description:
Dec 25 03:20:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<env_eng>, method=PLAIN, rip=37.57.69.227, lip=66.85.158.91, session=<KZeqprlGb9MlOUXj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.206.93.90
country_id: 290557
description:
Dec 25 03:20:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng>, method=PLAIN, rip=94.206.93.90, lip=66.85.158.91, session=<uu21prlGVsRezl1a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.72.74.162
country_id: 6252001
description:
Dec 25 03:21:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<env_eng>, method=PLAIN, rip=64.72.74.162, lip=66.85.158.91, TLS, session=<M06Zp7lG4q1ASEqi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.75.197.174
country_id: 1269750
description:
Dec 25 03:20:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env>, method=PLAIN, rip=182.75.197.174, lip=66.85.158.91, TLS, session=<xKx2pLlGHr22S8Wu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.32.22.218
country_id: 290557
description:
Dec 25 03:20:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env.eng@lezzarotech.com>, method=PLAIN, rip=5.32.22.218, lip=66.85.158.91, TLS, session=<mIbxpLlGOYQFIBba>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.225.30.107
country_id: 2661886
description:
Dec 25 03:20:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<enveng>, method=PLAIN, rip=81.225.30.107, lip=66.85.158.91, TLS, session=<CHGQpblGJ+JR4R5r>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.86.95.199
country_id: 2921044
description:
Dec 25 03:20:40 host2 sshd[2909911]: Disconnected from invalid user mcserver 172.86.95.199 port 49456 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.144.243.93
country_id: 2542007
description:
Dec 25 03:20:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<env-eng>, method=PLAIN, rip=154.144.243.93, lip=66.85.158.91, TLS, session=<UVHdpLlGvt6akPNd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.68.22.140
country_id: 1269750
description:
Dec 25 03:20:40 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<eng.env>, method=PLAIN, rip=103.68.22.140, lip=66.85.158.91, session=<D9iaprlG3+lnRBaM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.92.76.210
country_id: 1694008
description:
Dec 25 03:20:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<engenv>, method=PLAIN, rip=119.92.76.210, lip=66.85.158.91, TLS, session=<MtJZpLlGMsl3XEzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 49.207.15.25
country_id: 1269750
description:
Dec 25 03:20:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<eng.env>, method=PLAIN, rip=49.207.15.25, lip=66.85.158.91, session=<gFDOpblGM/Uxzw8Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 20.212.200.144
country_id: 1880251
description:
Dec 25 03:20:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env_eng>, method=PLAIN, rip=20.212.200.144, lip=66.85.158.91, session=<iSzopblG/RcU1MiQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 50.223.176.171
country_id: 6252001
description:
Dec 25 03:20:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<env_eng>, method=PLAIN, rip=50.223.176.171, lip=66.85.158.91, session=<OeNgp7lGqbAy37Cr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.219.104.210
country_id: 3175395
description:
Dec 25 03:20:58 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<eng.env>, method=PLAIN, rip=188.219.104.210, lip=66.85.158.91, TLS, session=<YYHUprlGEr2822jS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.30.41.231
country_id: 1819730
description:
Dec 25 03:21:15 host2 sshd[2910552]: Disconnected from invalid user ftpuser2 103.30.41.231 port 37568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.114.140.70
country_id: 3469034
description:
Dec 25 03:20:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<eng_env>, method=PLAIN, rip=189.114.140.70, lip=66.85.158.91, TLS, session=<wGCLpLlGmt29coxG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.30.41.231
country_id: 1819730
description:
Dec 25 03:21:50 host2 sshd[2910920]: Disconnected from invalid user dev 103.30.41.231 port 45470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Dec 25 03:21:26 host2 sshd[2910666]: Disconnected from invalid user vanessa 40.82.214.8 port 54446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.86.95.199
country_id: 2921044
description:
Dec 25 03:21:38 host2 sshd[2910779]: Disconnected from invalid user julian 172.86.95.199 port 37450 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.30.41.231
country_id: 1819730
description:
Dec 25 03:22:25 host2 sshd[2911452]: Disconnected from invalid user user1 103.30.41.231 port 45358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.82.214.8
country_id: 2077456
description:
Dec 25 03:22:54 host2 sshd[2911910]: Disconnected from invalid user ftpuser2 40.82.214.8 port 51950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.196.237
country_id: 241170
description:
Dec 25 03:23:21 host2 sshd[2912507]: Disconnected from invalid user sameer 154.83.196.237 port 46760 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Dec 25 03:32:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.3, lip=66.85.158.91, session=<5CqO0LlGnqNV2YwD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 25 03:36:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.116, lip=66.85.158.91, TLS: Connection closed, session=<8jGd4LlGbEdChJl0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-25 03:42:49 dovecot_login authenticator failed for H=(bb118-200-42-112.singnet.com.sg) [118.200.42.112]:50390: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Dec 25 03:45:10 host2 sshd[2930491]: Disconnected from invalid user tony 23.227.147.163 port 57600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Dec 25 03:46:18 host2 sshd[2932293]: Disconnected from invalid user administrator 41.223.40.77 port 39116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.47.50
country_id: 1819730
description:
Dec 25 03:46:29 host2 sshd[2932510]: Disconnected from invalid user administrator 118.193.47.50 port 45316 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.227.147.163
country_id: 6252001
description:
Dec 25 03:47:33 host2 sshd[2933884]: Disconnected from invalid user vps 23.227.147.163 port 40568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Dec 25 03:47:46 host2 sshd[2934128]: Disconnected from invalid user ubuntu 41.223.40.77 port 40312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.227.147.163
country_id: 6252001
description:
Dec 25 03:49:05 host2 sshd[2936219]: Disconnected from invalid user explore 23.227.147.163 port 37662 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 25 03:49:11 host2 sshd[2936286]: Disconnected from invalid user demo2 103.139.59.214 port 58640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Dec 25 03:50:12 host2 sshd[2937334]: Disconnected from invalid user testuser 201.124.23.196 port 39072 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.223.40.77
country_id: 3351879
description:
Dec 25 03:51:15 host2 sshd[2938473]: Disconnected from invalid user admin 41.223.40.77 port 48224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-25 03:53:10 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:59904: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Dec 25 03:52:26 host2 sshd[2939363]: Disconnected from invalid user esuser 154.91.170.52 port 36974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.52
country_id: 241170
description:
Dec 25 03:53:35 host2 sshd[2940805]: Disconnected from invalid user sammy 154.91.170.52 port 42734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-25 03:54:11 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:58391: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 03:55:14 host2 sshd[2942999]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.229
country_id: 6252001
description:
Dec 25 03:55:54 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.229, lip=66.85.158.92, session=<GMa2JLpG/ses7OTl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Dec 25 03:57:25 host2 sshd[2944844]: Disconnected from invalid user vps 201.124.23.196 port 44721 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.48
country_id: 6252001
description:
Dec 25 04:02:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.48, lip=66.85.158.91, TLS: Connection closed, session=</6pfPLpGPNenXpIw>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.124.23.196
country_id: 3996063
description:
Dec 25 04:02:51 host2 sshd[2949832]: Disconnected from invalid user vpn 201.124.23.196 port 44393 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-25 04:04:02 dovecot_plain authenticator failed for H=(dralner) [75.97.190.237]:51470: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 04:05:52 host2 sshd[2952905]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 25 04:11:15 host2 sshd[2960325]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 51364


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 04:12:08 host2 pure-ftpd[2961425]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.49.89.39
country_id: 1694008
description:
Dec 25 04:14:15 host2 sshd[2964273]: Disconnected from invalid user user 161.49.89.39 port 54870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 25 04:14:07 host2 sshd[2964081]: Disconnected from invalid user jerry 45.61.187.220 port 51746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 25 04:14:45 host2 sshd[2964953]: Disconnected from invalid user yasin 45.61.187.220 port 36836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.47.50
country_id: 1819730
description:
Dec 25 04:14:35 host2 sshd[2964741]: Disconnected from invalid user user1 118.193.47.50 port 44946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.123.65.73
country_id: 1168579
description:
Dec 25 04:15:42 host2 sshd[2966434]: Disconnected from invalid user test1 223.123.65.73 port 37840 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.49.89.39
country_id: 1694008
description:
Dec 25 04:17:14 host2 sshd[2969115]: Disconnected from invalid user app 161.49.89.39 port 58656 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.66.209.98
country_id: 2017370
description:
[2025-12-25 04:16:32 +0530] info [webmaild] 45.66.209.98 - info@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.220
country_id: 6252001
description:
Dec 25 04:16:34 host2 sshd[2967988]: Disconnected from invalid user user 45.61.187.220 port 48570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.49.89.39
country_id: 1694008
description:
Dec 25 04:16:37 host2 sshd[2968056]: Disconnected from invalid user testuser 161.49.89.39 port 46606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2025-12-25 04:18:06 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:57600: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-12-25 04:18:12 dovecot_login authenticator failed for H=([65.20.149.26]) [65.20.149.26]:35594: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.177
country_id: 6252001
description:
Dec 25 04:17:45 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.177, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<aingcrpGSsPG6xix>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec 25 04:19:15 host2 sshd[2971761]: Disconnected from invalid user user 45.78.230.104 port 58512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-25 04:18:27 dovecot_login authenticator failed for H=(nsg-corporate-199.152.185.122.airtel.in) [182.95.178.158]:54436: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.97.98
country_id: 2661886
description:
2025-12-25 04:18:40 dovecot_login authenticator failed for H=h-46-59-97-98.a1648.priv.bahnhof.se [46.59.97.98]:35142: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 25 04:18:48 host2 sshd[2971133]: Disconnected from invalid user elsearch 209.141.47.217 port 57870 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.123.65.73
country_id: 1168579
description:
Dec 25 04:18:53 host2 sshd[2971224]: Disconnected from invalid user player 223.123.65.73 port 46726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 25 04:21:04 host2 sshd[2974486]: Disconnected from invalid user work 209.141.47.217 port 36802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 25 04:22:10 host2 sshd[2976184]: Disconnected from invalid user ubuntu 209.141.47.217 port 52022 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-25 04:23:44 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (truacity) [73.183.74.177]:38232: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 25 04:24:22 host2 sshd[2979310]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 64771


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-12-25 04:24:22 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec 25 04:25:27 host2 sshd[2980860]: Disconnected from invalid user test1 45.78.230.104 port 51878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-12-25 04:25:55 dovecot_login authenticator failed for H=(089-101-036159.customer.vmie.ie) [89.101.36.159]:32916: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-12-25 04:26:01 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-12-25 04:26:09 dovecot_login authenticator failed for H=([62.182.118.138]) [62.182.118.138]:40266: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-25 04:26:18 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:29431: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-25 04:28:22 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:51666: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 185.188.217.87
country_id: 831053
description:
Dec 25 04:30:35 host2 sshd[2987522]: Disconnecting authenticating user root 185.188.217.87 port 35648: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.188.217.87
country_id: 831053
description:
Dec 25 04:30:47 host2 sshd[2987800]: error: maximum authentication attempts exceeded for invalid user admin from 185.188.217.87 port 48804 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.188.217.87
country_id: 831053
description:
Dec 25 04:30:51 host2 sshd[2987892]: Disconnecting invalid user admin 185.188.217.87 port 52740: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 185.188.217.87
country_id: 831053
description:
Dec 25 04:30:35 host2 sshd[2987522]: error: maximum authentication attempts exceeded for root from 185.188.217.87 port 35648 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec 25 04:32:47 host2 sshd[2990811]: Disconnected from invalid user yasin 45.78.230.104 port 36864 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.3
country_id: 2635167
description:
Dec 25 04:34:08 host2 dovecot[1881837]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.3, lip=66.85.158.91, TLS, session=<B2Z1rbpGs99X7LAD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-25 04:40:40 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:34166: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.63
country_id: 1733045
description:
2025-12-25 04:41:20 dovecot_login authenticator failed for H=([49.124.151.63]) [49.124.151.63]:34310: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.245.196
country_id: 1605651
description:
Dec 25 04:41:41 host2 pure-ftpd[2999821]: (?@152.32.245.196) [INFO] New connection from 152.32.245.196


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.245.196
country_id: 1605651
description:
Dec 25 04:45:39 host2 pure-ftpd[3003249]: (?@152.32.245.196) [INFO] New connection from 152.32.245.196


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-25 04:47:47 dovecot_login authenticator failed for H=(nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:43166: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-12-25 04:48:02 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:38570: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.132.99
country_id: 3469034
description:
Dec 25 04:51:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=191.53.132.99, lip=66.85.158.91, TLS, session=<hj4p6bpGNrm/NYRj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.30.81.54
country_id: 1269750
description:
Dec 25 04:51:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=103.30.81.54, lip=66.85.158.91, TLS, session=<ucxn6rpGN+FnHlE2>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.249.32.140
country_id: 3017382
description:
[2025-12-25 04:57:55 +0530] info [cpaneld] 173.249.32.140 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 04:59:55 host2 sshd[3014811]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-12-25 05:00:15 dovecot_login authenticator failed for H=(149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:33448: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2025-12-25 04:59:43 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:58294: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.32.168.164
country_id: 2077456
description:
2025-12-25 04:59:51 dovecot_login authenticator failed for H=27-32-168-164.tpgi.com.au [27.32.168.164]:41944: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.40.73.112
country_id: 6252001
description:
[2025-12-25 05:03:35 +0530] info [webmaild] 216.40.73.112 - info@kamechotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.104.58.194
country_id: 3865483
description:
Dec 25 05:05:53 host2 sshd[3020212]: Disconnected from invalid user hqadmin 181.104.58.194 port 33002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.244
country_id: 3895114
description:
Dec 25 05:06:57 host2 sshd[3021131]: Disconnected from invalid user ubuntu 138.84.41.244 port 52890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.104.58.194
country_id: 3865483
description:
Dec 25 05:07:35 host2 sshd[3021541]: Disconnected from invalid user sysadmin 181.104.58.194 port 32842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.244
country_id: 3895114
description:
Dec 25 05:07:44 host2 sshd[3021619]: Disconnected from invalid user ruslan 138.84.41.244 port 29036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.244
country_id: 3895114
description:
Dec 25 05:09:13 host2 sshd[3022866]: Disconnected from invalid user hu 138.84.41.244 port 3120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.104.58.194
country_id: 3865483
description:
Dec 25 05:08:24 host2 sshd[3022097]: Disconnected from invalid user cma 181.104.58.194 port 46876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.54.168
country_id: 6252001
description:
Dec 25 05:08:36 host2 sshd[3022374]: Disconnected from invalid user admin1 162.240.54.168 port 41828 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.84.41.244
country_id: 3895114
description:
Dec 25 05:09:57 host2 sshd[3023350]: Disconnected from invalid user azureuser 138.84.41.244 port 36578 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 05:10:18 host2 sshd[3023792]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.54.168
country_id: 6252001
description:
Dec 25 05:11:07 host2 sshd[3024429]: Disconnected from invalid user comp 162.240.54.168 port 44842 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 162.240.54.168
country_id: 6252001
description:
Dec 25 05:10:40 host2 sshd[3024091]: Received disconnect from 162.240.54.168 port 32920:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-25 05:10:40 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:44668: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.104.58.194
country_id: 3865483
description:
Dec 25 05:11:30 host2 sshd[3024731]: Disconnected from invalid user deploy 181.104.58.194 port 46550 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.86.13
country_id: 2921044
description:
Dec 25 05:12:43 host2 sshd[3025557]: Disconnected from invalid user steam 83.229.86.13 port 47100 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.84.41.244
country_id: 3895114
description:
Dec 25 05:13:59 host2 sshd[3026476]: Disconnected from invalid user will 138.84.41.244 port 17347 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 05:14:36 host2 pure-ftpd[3027066]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.165
country_id: 690791
description:
2025-12-25 05:14:38 dovecot_login authenticator failed for H=(uHx5VJJ) [77.83.39.165]:55147: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.165
country_id: 690791
description:
2025-12-25 05:15:33 dovecot_login authenticator failed for H=(ike34YSW) [77.83.39.165]:57227: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 77.83.39.165
country_id: 690791
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[77.83.39.165] [Authentication Database]=[mail] [Username]=[marketing@lezzarotech.com] (5/5 failures) (blocked until [Thu Dec 25 00:00:31 2025 UTC/Thu Dec 25 05:30:31 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-12-25 05:18:49 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:49356: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-25 05:19:28 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:23328: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2025-12-25 05:19:44 dovecot_login authenticator failed for H=([31.141.216.143]) [31.141.216.143]:53114: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 25 05:21:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<jBcoVrtGVq+LonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2025-12-25 05:32:48 dovecot_login authenticator failed for H=([107.85.14.208]) [107.85.14.208]:37550: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-25 05:32:28 dovecot_login authenticator failed for H=([45.118.49.18]) [45.118.49.18]:62229: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.114
country_id: 6252001
description:
Dec 25 05:32:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.114, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<4LOwfrtGGd2TuYRy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-25 05:39:42 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:39750: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-25 05:39:54 dovecot_login authenticator failed for H=([122.185.152.72]) [122.187.222.54]:34900: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2025-12-25 05:46:21 dovecot_login authenticator failed for H=ip-d9bc.d-net.kiev.ua [94.154.217.188]:59542: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.21
country_id: 294640
description:
2025-12-25 05:46:23 dovecot_login authenticator failed for H=([84.111.136.21]) [84.111.136.21]:42535: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-12-25 05:46:40 dovecot_login authenticator failed for H=([85.159.165.216]) [85.159.165.216]:35600: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-25 05:46:44 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:33389: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-25 05:49:50 dovecot_login authenticator failed for H=([121.73.163.186]) [121.73.163.186]:42920: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-25 05:50:44 dovecot_login authenticator failed for H=([182.78.79.134]) [182.78.79.134]:59958: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-12-25 05:50:44 dovecot_login authenticator failed for H=([125.19.175.238]) [27.123.92.14]:34860: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.202.38.185
country_id: 2658434
description:
2025-12-25 05:50:58 dovecot_login authenticator failed for H=(dyn-cable-cust.185.38.202.213.quicknet.ch) [213.202.38.185]:50702: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2025-12-25 05:50:59 dovecot_login authenticator failed for H=(dsl-ncr-static-137.78.16.125.airtelbroadband.in) [182.95.123.202]:50826: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-25 05:50:44 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:54244: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 139.59.94.63
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 139.59.94.63: 259 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 05:59:24 host2 sshd[3065279]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-25 06:02:14 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:53634: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.230.160
country_id: 2510769
description:
2025-12-25 06:02:13 dovecot_login authenticator failed for H=160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:34218: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-12-25 06:01:40 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:34655: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-25 06:02:25 dovecot_login authenticator failed for H=(221-169-97-62.cust.smartcall.no) [62.97.169.221]:59459: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.253.95
country_id: 6252001
description:
Dec 25 06:06:20 host2 sshd[3072301]: Disconnected from invalid user transfer 199.195.253.95 port 47992 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.46.69
country_id: 1227603
description:
Dec 25 06:08:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=509) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=175.157.46.69, lip=66.85.158.91, TLS handshaking: read(size=509) failed: Connection reset by peer, session=<uYv3/7tG2EevnS5F>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.253.95
country_id: 6252001
description:
Dec 25 06:09:20 host2 sshd[3074890]: Disconnected from invalid user pepe 199.195.253.95 port 56506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-25 06:10:33 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:53504: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-25 06:11:00 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:56955: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.253.95
country_id: 6252001
description:
Dec 25 06:11:26 host2 sshd[3076783]: Disconnected from invalid user dts 199.195.253.95 port 52202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Dec 25 06:11:37 host2 sshd[3076925]: Disconnected from invalid user stack 128.1.38.64 port 41292 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.38.64
country_id: 1880251
description:
Dec 25 06:16:26 host2 sshd[3082159]: Disconnected from invalid user user1 128.1.38.64 port 39796 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 06:17:04 host2 pure-ftpd[3083142]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.174
country_id: 2186224
description:
2025-12-25 06:17:07 dovecot_login authenticator failed for H=([121.73.162.174]) [121.73.162.174]:38808: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.215.116.20
country_id: 2921044
description:
[2025-12-25 06:17:46 +0530] info [cpaneld] 85.215.116.20 - kamechot "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.46
country_id: 6252001
description:
Dec 25 06:17:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.46, lip=66.85.158.92, session=<EvxzILxGqOmTuYQu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Dec 25 06:18:04 host2 sshd[3084142]: Disconnected from invalid user ubuntu 38.248.12.102 port 37444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.178.105.157
country_id: 1269750
description:
Dec 25 06:18:49 host2 sshd[3084767]: Disconnected from invalid user choi 59.178.105.157 port 59524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.27.187
country_id: 3996063
description:
Dec 25 06:19:30 host2 sshd[3085416]: Disconnected from invalid user wg 187.212.27.187 port 34730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.38.64
country_id: 1880251
description:
Dec 25 06:20:14 host2 sshd[3086102]: Disconnected from invalid user sandbox 128.1.38.64 port 53356 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.248.12.102
country_id: 6252001
description:
Dec 25 06:20:22 host2 sshd[3086257]: Disconnected from invalid user username 38.248.12.102 port 37256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.178.105.157
country_id: 1269750
description:
Dec 25 06:21:54 host2 sshd[3087475]: Disconnected from invalid user wanghy 59.178.105.157 port 57243 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-12-25 06:21:11 dovecot_login authenticator failed for H=95-87-248-223.ip.btc-net.bg [95.87.248.223]:38638: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-12-25 06:21:41 dovecot_login authenticator failed for H=(victoryent.in) [111.93.80.158]:43334: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.248.12.102
country_id: 6252001
description:
Dec 25 06:22:17 host2 sshd[3087755]: Disconnected from invalid user igor 38.248.12.102 port 34428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.178.105.157
country_id: 1269750
description:
Dec 25 06:23:11 host2 sshd[3088358]: Disconnected from invalid user gitlab-runner 59.178.105.157 port 54374 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 25 06:24:16 host2 sshd[3089242]: Disconnected from invalid user choi 152.32.238.146 port 39584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.178.105.157
country_id: 1269750
description:
Dec 25 06:24:30 host2 sshd[3089500]: Disconnected from invalid user vpn 59.178.105.157 port 51507 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.215
country_id: 6252001
description:
Dec 25 06:30:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.215, lip=66.85.158.91, session=<V2QKTbxGiPvG6xjX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.212.27.187
country_id: 3996063
description:
Dec 25 06:32:24 host2 sshd[3096299]: Disconnected from invalid user gitlab-runner 187.212.27.187 port 59050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.96.176.233
country_id: 1861060
description:
2025-12-25 06:34:17 dovecot_plain authenticator failed for H=softbank060096176233.bbtec.net (8HRKD1AKEBBNP) [60.96.176.233]:65090: 535 Incorrect authentication data (set_id=onila.selaka@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.27.187
country_id: 3996063
description:
Dec 25 06:35:44 host2 sshd[3098999]: Disconnected from invalid user es_user 187.212.27.187 port 51730 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.3.14
country_id: 6252001
description:
[2025-12-25 06:36:51 +0530] info [webmaild] 140.235.3.14 - info@ksoft.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.91
country_id: 1819730
description:
Dec 25 06:40:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.142.154.91, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<uUAMcrxGwNItjppb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 25 06:46:37 host2 sshd[3109111]: Disconnected from invalid user gitlab-runner 93.71.118.99 port 35438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 25 06:47:50 host2 sshd[3110068]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 59585


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 25 06:48:38 host2 sshd[3110566]: Disconnected from invalid user student2 93.71.118.99 port 57844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-12-25 06:49:32 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [125.23.155.110]:60188: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-25 06:49:45 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:44073: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 25 06:50:09 host2 sshd[3111680]: Disconnected from invalid user user 93.71.118.99 port 47306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-12-25 06:52:17 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:57052: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-25 06:52:51 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:54657: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 93.71.118.99
country_id: 3175395
description:
Dec 25 06:52:53 host2 sshd[3113788]: Received disconnect from 93.71.118.99 port 42804:11: Bye Bye [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.61.222.162
country_id: 2017370
description:
[2025-12-25 06:54:31 +0530] info [webmaild] 185.61.222.162 - info@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2025-12-25 06:55:34 dovecot_login authenticator failed for H=([84.210.219.80]) [84.210.219.80]:59505: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.10
country_id: 1269750
description:
2025-12-25 06:55:47 dovecot_login authenticator failed for H=([125.18.244.137]) [182.78.64.10]:34956: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.250
country_id: 6252001
description:
Dec 25 06:57:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.250, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<vXwHr7xGXNPN0h/6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.231
country_id: 6252001
description:
Dec 25 06:59:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.231, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gUVBtbxGmNrG6xjn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.177.6
country_id: 390903
description:
2025-12-25 07:02:35 dovecot_login authenticator failed for H=([95.164.177.6]) [95.164.177.6]:34620: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-12-25 07:02:46 dovecot_login authenticator failed for H=([185.34.17.250]) [185.34.17.250]:49070: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 07:05:13 host2 sshd[3124306]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.170.21.223
country_id: 6252001
description:
2025-12-25 07:06:47 dovecot_login authenticator failed for H=(75-170-21-223.rcmt.centurylink.net) [75.170.21.223]:51818: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.64.93.161
country_id: 2077456
description:
2025-12-25 07:07:05 dovecot_login authenticator failed for H=115-64-93-161.tpgi.com.au [115.64.93.161]:59535: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-12-25 07:07:09 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:57300: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 25 07:06:18 host2 sshd[3125619]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 53509


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-12-25 07:06:19 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2025-12-25 07:06:20 dovecot_login authenticator failed for H=([152.52.238.88]) [182.95.184.130]:50816: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-25 07:06:48 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:46236: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 07:19:34 host2 pure-ftpd[3136255]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.197.203.58
country_id: 3057568
description:
2025-12-25 07:21:31 dovecot_login authenticator failed for H=([62.197.203.58]) [62.197.203.58]:44836: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.58
country_id: 3996063
description:
2025-12-25 07:21:48 dovecot_login authenticator failed for H=([177.236.146.58]) [177.236.146.58]:52646: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.17
country_id: 1733045
description:
2025-12-25 07:22:14 dovecot_login authenticator failed for H=([49.124.151.17]) [49.124.151.17]:39780: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 07:25:53 host2 sshd[3141188]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.80
country_id: 6252001
description:
Dec 25 07:29:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.80, lip=66.85.158.92, TLS, session=<GIdAH71GOOrN0h9Q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.207
country_id: 3996063
description:
2025-12-25 07:28:19 dovecot_login authenticator failed for H=([177.239.164.207]) [177.239.164.207]:52437: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.203.110.74
country_id: 6252001
description:
Dec 25 07:28:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=159.203.110.74, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<bbYlHb1G2Iefy25K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.227
country_id: 6252001
description:
Dec 25 07:30:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.227, lip=66.85.158.92, session=<v0RqI71GYsBAPsXj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.220.26.42
country_id: 3175395
description:
2025-12-25 07:31:48 dovecot_login authenticator failed for H=dynamic-adsl-84-220-26-42.clienti.tiscali.it [84.220.26.42]:64174: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-12-25 07:32:06 dovecot_login authenticator failed for H=(mamanguape.static.gvt.net.br) [177.207.248.5]:59033: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.6
country_id: 1819730
description:
2025-12-25 07:32:19 dovecot_login authenticator failed for H=(m121-202-152-6.smartone.com) [121.202.152.6]:45230: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2025-12-25 07:32:22 dovecot_login authenticator failed for H=(nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:57302: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-25 07:32:37 dovecot_login authenticator failed for H=96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:55824: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-25 07:32:38 dovecot_login authenticator failed for H=(221-169-97-62.cust.smartcall.no) [62.97.169.221]:49259: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2025-12-25 07:32:45 dovecot_login authenticator failed for H=([121.73.163.39]) [121.73.163.39]:38422: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.57.123.166
country_id: 2510769
description:
2025-12-25 07:33:12 dovecot_login authenticator failed for H=166.red-195-57-123.staticip.rima-tde.net [195.57.123.166]:15777: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-25 07:39:25 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:47282: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-25 07:39:45 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:55958: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-25 07:41:46 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:51069: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-25 07:44:07 dovecot_login authenticator failed for H=(cm-84.211.6.119.get.no) [84.211.6.119]:52748: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.69.147
country_id: 3374766
description:
2025-12-25 07:43:50 dovecot_login authenticator failed for H=([154.203.69.147]) [154.203.69.147]:59794: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.255.165
country_id: 2661886
description:
2025-12-25 07:45:51 dovecot_login authenticator failed for H=c188-148-255-165.bredband.tele2.se [188.148.255.165]:46776: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.88.171.166
country_id: 6252001
description:
[2025-12-25 07:45:38 +0530] info [webmaild] 166.88.171.166 - info@agronatureholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 07:47:47 host2 sshd[3159961]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-25 07:47:45 dovecot_login authenticator failed for H=([182.75.215.245]) [182.75.215.245]:56428: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.230
country_id: 6252001
description:
Dec 25 08:00:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.230, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KvfTj71Gp8vG6xjm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-12-25 08:01:06 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:54013: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.174.253
country_id: 3017382
description:
2025-12-25 08:05:27 dovecot_login authenticator failed for H=mastergateway.ville-saint-louis.fr [212.51.174.253]:51966: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-12-25 08:05:50 dovecot_login authenticator failed for H=([182.95.22.208]) [125.23.228.86]:42032: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.148.232.123
country_id: 294640
description:
[2025-12-25 08:06:13 +0530] info [webmaild] 45.148.232.123 - info@dataesite.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.148
country_id: 6252001
description:
Dec 25 08:10:37 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=18.97.19.148, lip=66.85.158.92, session=<i6Sws71GoqASYROU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-25 08:10:53 dovecot_login authenticator failed for H=(nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:58408: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-25 08:11:07 dovecot_login authenticator failed for H=([120.157.13.61]) [120.157.13.61]:38284: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 08:22:07 host2 pure-ftpd[3189780]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Dec 25 08:22:46 host2 sshd[3190349]: Disconnected from invalid user ftpadmin 172.174.5.146 port 22652 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.121.43
country_id: 3144096
description:
2025-12-25 08:23:03 dovecot_login authenticator failed for H=(cm-178.232.121.43.get.no) [178.232.121.43]:47227: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-25 08:23:15 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:51926: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Dec 25 08:25:07 host2 sshd[3192686]: Disconnected from invalid user docker 172.174.5.146 port 50928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.174.5.146
country_id: 6252001
description:
Dec 25 08:31:14 host2 sshd[3198289]: Disconnected from invalid user test01 172.174.5.146 port 65131 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Dec 25 08:33:43 host2 sshd[3199992]: Disconnected from invalid user user 172.174.5.146 port 36911 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 25 08:35:01 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, session=<m6XpCr5GapMs3lFz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.135.37
country_id: 1269750
description:
Dec 25 08:36:10 host2 sshd[3202059]: Disconnected from invalid user david 64.227.135.37 port 38236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-12-25 08:38:48 dovecot_login authenticator failed for H=([187.6.121.246]) [187.6.121.246]:45154: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-25 08:39:08 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:36418: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Dec 25 08:38:20 host2 sshd[3203591]: Disconnected from invalid user sara 43.252.229.25 port 41910 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2025-12-25 08:38:31 dovecot_login authenticator failed for H=([218.248.19.102]) [218.248.19.102]:38390: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.252.229.25
country_id: 1819730
description:
Dec 25 08:39:37 host2 sshd[3204698]: Disconnected from invalid user newusername 43.252.229.25 port 41438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.52.243
country_id: 3144096
description:
2025-12-25 08:39:14 dovecot_login authenticator failed for H=(cm-84.215.52.243.get.no) [84.215.52.243]:58213: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-25 08:39:23 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:52680: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-25 08:40:22 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:44693: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 25 08:40:51 host2 sshd[3205792]: Disconnected from invalid user ubuntu 101.36.120.76 port 40016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Dec 25 08:41:27 host2 sshd[3206438]: Disconnected from invalid user power 43.252.229.25 port 54830 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.66.34.121
country_id: 1643084
description:
Dec 25 08:42:17 host2 sshd[3207171]: Disconnected from invalid user newuser 157.66.34.121 port 35522 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2025-12-25 08:44:08 dovecot_login authenticator failed for H=([202.90.133.142]) [202.90.133.142]:12101: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2025-12-25 08:44:10 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:40890: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Dec 25 08:43:17 host2 sshd[3208114]: Disconnected from invalid user admin 138.68.9.182 port 50564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Dec 25 08:43:23 host2 sshd[3208146]: Disconnected from invalid user pc 157.66.34.121 port 40446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.135.37
country_id: 1269750
description:
Dec 25 08:43:28 host2 sshd[3208234]: Disconnected from invalid user user 64.227.135.37 port 50966 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.9.182
country_id: 6252001
description:
Dec 25 08:44:51 host2 sshd[3210470]: Disconnected from invalid user bitwarden 138.68.9.182 port 45836 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2025-12-25 08:44:55 dovecot_login authenticator failed for H=([125.23.178.65]) [182.78.64.18]:33394: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 195.25.17.31
country_id: 3017382
description:
Dec 25 08:45:02 host2 sshd[3211072]: Received disconnect from 195.25.17.31 port 34994:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.25.17.31
country_id: 3017382
description:
Dec 25 08:46:09 host2 sshd[3213028]: Disconnected from invalid user term1 195.25.17.31 port 15775 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.7.84.213
country_id: 6252001
description:
[2025-12-25 08:46:25 +0530] info [cpaneld] 47.7.84.213 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.164.113.97
country_id: 6252001
description:
[2025-12-25 08:46:26 +0530] info [cpaneld] 71.164.113.97 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.133.118.130
country_id: 6252001
description:
[2025-12-25 08:46:35 +0530] info [cpaneld] 76.133.118.130 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.104.109.67
country_id: 6252001
description:
[2025-12-25 08:46:22 +0530] info [cpaneld] 68.104.109.67 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.45.90.108
country_id: 6252001
description:
[2025-12-25 08:46:23 +0530] info [whostmgrd] 99.45.90.108 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.76.106
country_id: 6252001
description:
[2025-12-25 08:46:27 +0530] info [cpaneld] 76.33.76.106 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.49.101.17
country_id: 6252001
description:
[2025-12-25 08:46:31 +0530] info [cpaneld] 67.49.101.17 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.94.163.0
country_id: 6252001
description:
[2025-12-25 08:46:19 +0530] info [cpaneld] 76.94.163.0 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.19.164.53
country_id: 6252001
description:
[2025-12-25 08:46:36 +0530] info [cpaneld] 45.19.164.53 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.141.18.185
country_id: 6252001
description:
[2025-12-25 08:46:34 +0530] info [cpaneld] 63.141.18.185 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.218.241.230
country_id: 6252001
description:
[2025-12-25 08:46:24 +0530] info [cpaneld] 24.218.241.230 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.85.56.143
country_id: 6252001
description:
[2025-12-25 08:46:30 +0530] info [cpaneld] 72.85.56.143 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.91.206.225
country_id: 6252001
description:
[2025-12-25 08:46:33 +0530] info [cpaneld] 50.91.206.225 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 25 08:47:05 host2 sshd[3214182]: Disconnected from invalid user user 101.36.120.76 port 46870 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.182.52.124
country_id: 6252001
description:
[2025-12-25 08:46:20 +0530] info [cpaneld] 67.182.52.124 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 08:49:51 host2 sshd[3216642]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2025-12-25 08:49:57 dovecot_login authenticator failed for H=(nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:40908: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-12-25 08:50:19 dovecot_login authenticator failed for H=([180.94.75.114]) [180.94.75.114]:55565: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.194
country_id: 6252001
description:
Dec 25 08:50:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.194, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kKrnQb5GMM7N0h/C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 25 08:53:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<xW/TTL5G9IQD7r/l>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.61.223.109
country_id: 2017370
description:
[2025-12-25 08:54:18 +0530] info [webmaild] 185.61.223.109 - info@gnetuniversals.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.26
country_id: 6252001
description:
Dec 25 08:54:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=162.216.150.26, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<kLFzUb5GKtui2JYa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.26
country_id: 6252001
description:
Dec 25 08:55:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.26, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<H2bGVL5GoOSi2JYa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-12-25 08:57:06 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:37692: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-25 08:57:22 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:39194: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.26
country_id: 6252001
description:
Dec 25 09:01:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.26, lip=66.85.158.92, TLS, session=<zSD+aL5G0vGi2JYa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-25 09:01:27 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:41700: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-25 09:02:16 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:50121: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.51
country_id: 6252001
description:
Dec 25 09:07:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.51, lip=66.85.158.92, TLS, session=<6FwZgL5GvPnN0h8z>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 09:10:33 host2 sshd[3234929]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-25 09:12:41 dovecot_login authenticator failed for H=([154.208.47.13]) [154.208.47.13]:45054: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-25 09:13:32 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:49383: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.171.200
country_id: 6252001
description:
[2025-12-25 09:16:19 +0530] info [webmaild] 140.235.171.200 - info@jrdc.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.120
country_id: 6252001
description:
Dec 25 09:22:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.120, lip=66.85.158.92, TLS: Connection closed, session=<yt59s75GIs3HLZp4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 09:24:39 host2 pure-ftpd[3245887]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.31.53
country_id: 6252001
description:
2025-12-25 09:28:01 dovecot_login authenticator failed for H=(lezzarotech.com) [45.83.31.53]:61392: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.180.173
country_id: 3996063
description:
2025-12-25 09:30:38 dovecot_login authenticator failed for H=fixed-189-203-180-173.totalplay.net [189.203.180.173]:51216: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-25 09:30:57 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:51233: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec 25 09:37:28 host2 pure-ftpd[3256170]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 25 09:41:04 host2 sshd[3259130]: Disconnected from invalid user jhlee 181.212.81.228 port 39068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.70.102.114
country_id: 2233387
description:
Dec 25 09:42:38 host2 sshd[3260316]: Disconnected from invalid user user_jenkins 154.70.102.114 port 46200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.44.15.210
country_id: 357994
description:
Dec 25 09:44:04 host2 sshd[3261296]: Disconnected from invalid user opc 197.44.15.210 port 46358 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 25 09:44:18 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, session=<aLSxAr9GDIQ26lCA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 25 09:44:27 host2 sshd[3262185]: Disconnected from invalid user pivpn 181.212.81.228 port 42754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 25 09:44:08 host2 sshd[3261371]: Disconnected from invalid user www 125.20.16.22 port 31208 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-12-25 09:45:43 dovecot_login authenticator failed for H=([62.201.228.210]) [62.201.228.210]:53730: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-25 09:45:58 dovecot_login authenticator failed for H=(219-163-97-62.cust.smartcall.no) [62.97.163.219]:46639: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 25 09:46:27 host2 sshd[3263802]: Disconnected from invalid user git 181.212.81.228 port 50610 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.70.102.114
country_id: 2233387
description:
Dec 25 09:46:30 host2 sshd[3263829]: Disconnected from invalid user yogi 154.70.102.114 port 42342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 25 09:49:08 host2 sshd[3265577]: Disconnected from invalid user jhlee 125.20.16.22 port 15740 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 25 09:49:45 host2 sshd[3265952]: Disconnected from invalid user user 125.20.16.22 port 16890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.136.125
country_id: 1168579
description:
Dec 25 09:52:09 host2 sshd[3268208]: Disconnected from invalid user ubuntu 116.71.136.125 port 39764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-12-25 09:54:03 dovecot_login authenticator failed for H=(host253.181-93-60.telecom.net.ar) [181.93.60.253]:54674: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-12-25 09:54:26 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:58755: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.71.136.125
country_id: 1168579
description:
Dec 25 09:54:31 host2 sshd[3270099]: Disconnected from invalid user ftpuser 116.71.136.125 port 44730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-25 09:54:48 dovecot_login authenticator failed for H=(syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:34629: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.67.84.115
country_id: 3469034
description:
2025-12-25 09:54:50 dovecot_login authenticator failed for H=(45.168.140-35.smartlinkfibra.com.br) [177.67.84.115]:50665: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-25 09:55:00 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:37150: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-12-25 09:55:32 dovecot_login authenticator failed for H=(182.239.78.49.hk.chinamobile.com) [182.239.78.49]:44678: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-12-25 09:55:56 dovecot_login authenticator failed for H=([165.154.202.101]) [165.154.202.101]:49894: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.58
country_id: 1269750
description:
2025-12-25 09:56:20 dovecot_login authenticator failed for H=([182.95.22.220]) [125.19.251.58]:49004: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.96
country_id: 6252001
description:
Dec 25 09:57:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.195.96, lip=66.85.158.91, session=<W1AjML9GssUUQcNg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-25 09:57:19 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:54584: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2025-12-25 10:01:32 +0530] info [cpaneld] 45.168.113.8 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.115
country_id: 6252001
description:
Dec 25 10:09:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.115, lip=66.85.158.92, TLS: Connection closed, session=<dBU5Xb9GgN3HLZpz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.11
country_id: 6252001
description:
Dec 25 10:13:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=147.185.133.11, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<fLxgab9GssaTuYUL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.11
country_id: 6252001
description:
Dec 25 10:13:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.133.11, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<yfaYbL9Ggu6TuYUL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.74
country_id: 2635167
description:
Dec 25 10:13:50 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.74, lip=66.85.158.91, session=<ytRabL9GBv0jy9JK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.11
country_id: 6252001
description:
Dec 25 10:21:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.11, lip=66.85.158.91, TLS, session=<q+dgh79Gou+TuYUL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 10:27:09 host2 pure-ftpd[3297647]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-12-25 10:27:42 dovecot_login authenticator failed for H=([203.193.147.41]) [203.193.147.37]:57811: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.180.173
country_id: 3996063
description:
2025-12-25 10:27:53 dovecot_login authenticator failed for H=fixed-189-203-180-173.totalplay.net [189.203.180.173]:60326: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.199.36
country_id: 732800
description:
Dec 25 10:28:32 host2 sshd[3298598]: Disconnected from invalid user jack 91.92.199.36 port 59232 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-25 10:31:53 dovecot_login authenticator failed for H=([128.185.39.145]) [128.185.214.78]:43192: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.111
country_id: 6252001
description:
Dec 25 10:31:58 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.111, lip=66.85.158.91, TLS, session=<Avwtrb9GZuPN0h9v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.223
country_id: 3996063
description:
2025-12-25 10:31:24 dovecot_login authenticator failed for H=(201.173.56.223-clientes-izzi.mx) [201.173.56.223]:37056: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.49.38.12
country_id: 6252001
description:
[2025-12-25 10:34:46 +0530] info [webmaild] 64.49.38.12 - info@seyawin.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 10:35:34 host2 sshd[3304221]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.101
country_id: 3469034
description:
Dec 25 10:35:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=177.44.71.101, lip=66.85.158.91, TLS, session=<A+cgur9GaOSxLEdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-25 10:35:57 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:57841: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.219
country_id: 1269750
description:
Dec 25 10:35:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.164.246.219, lip=66.85.158.91, TLS, session=<2+gaur9G3JhnpPbb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 25 10:36:12 host2 sshd[3304740]: Disconnected from invalid user admin 160.242.96.43 port 32908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.61
country_id: 3469034
description:
Dec 25 10:36:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<contact>, method=PLAIN, rip=191.240.96.61, lip=66.85.158.91, TLS, session=<bdtTu79GF42/8GA9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.120.28
country_id: 3865483
description:
Dec 25 10:36:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact>, method=PLAIN, rip=190.181.120.28, lip=66.85.158.91, TLS, session=<al8bvL9G18e+tXgc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-25 10:36:45 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:45068: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 25 10:37:37 host2 sshd[3305728]: Disconnected from invalid user web 160.242.96.43 port 34502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-12-25 10:40:03 dovecot_login authenticator failed for H=([65.20.191.97]) [65.20.191.97]:50330: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-25 10:39:41 dovecot_login authenticator failed for H=([150.129.20.234]) [150.129.20.234]:41967: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.92.199.36
country_id: 732800
description:
Dec 25 10:42:30 host2 sshd[3309901]: Disconnected from invalid user test 91.92.199.36 port 53502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 25 10:42:35 host2 sshd[3309964]: Disconnected from invalid user openproject 138.248.168.20 port 63966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 25 10:44:05 host2 sshd[3311022]: Disconnected from invalid user timemachine 138.248.168.20 port 59700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Dec 25 10:44:11 host2 sshd[3311168]: Disconnected from invalid user rodrigo 81.215.228.18 port 42032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 25 10:44:40 host2 sshd[3311949]: Disconnected from invalid user ivan 138.248.168.20 port 45482 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Dec 25 10:45:49 host2 sshd[3313009]: Disconnected from invalid user cisco 81.215.228.18 port 49336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-25 10:47:21 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:55704: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Dec 25 10:47:38 host2 sshd[3314516]: Disconnected from invalid user admin 103.224.247.23 port 60946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.118.15.236
country_id: 130758
description:
Dec 25 10:47:39 host2 sshd[3314537]: Disconnected from invalid user debian 185.118.15.236 port 38922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 25 10:50:10 host2 sshd[3316670]: Disconnected from invalid user tempftp 196.189.124.195 port 38996 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.155
country_id: 6252001
description:
Dec 25 10:50:40 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.104.155, lip=66.85.158.92, session=<TjoN8L9GhLQUQGib>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.124.195
country_id: 337996
description:
Dec 25 10:51:10 host2 sshd[3317984]: Disconnected from invalid user production 196.189.124.195 port 43548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-25 10:51:59 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:50475: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 25 10:52:10 host2 sshd[3318694]: Disconnected from invalid user user 196.189.124.195 port 58018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 25 10:53:38 host2 sshd[3319905]: Disconnected from invalid user user 35.200.237.19 port 1120 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:04 host2 sshd[3320301]: error: maximum authentication attempts exceeded for root from 168.138.115.41 port 37926 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:04 host2 sshd[3320301]: Disconnecting authenticating user root 168.138.115.41 port 37926: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Dec 25 10:54:51 host2 sshd[3321325]: Disconnected from invalid user ts3server 103.224.247.23 port 33230 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:08 host2 sshd[3320521]: error: maximum authentication attempts exceeded for root from 168.138.115.41 port 37932 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:08 host2 sshd[3320521]: Disconnecting authenticating user root 168.138.115.41 port 37932: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:17 host2 sshd[3320775]: error: maximum authentication attempts exceeded for invalid user admin from 168.138.115.41 port 38188 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:20 host2 sshd[3320865]: Disconnecting invalid user admin 168.138.115.41 port 38204: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.118.15.236
country_id: 130758
description:
Dec 25 10:55:16 host2 sshd[3321802]: Disconnected from invalid user tableau 185.118.15.236 port 39198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 25 10:55:32 host2 sshd[3321989]: Disconnected from invalid user dev 35.200.237.19 port 1139 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.118.15.236
country_id: 130758
description:
Dec 25 10:55:48 host2 sshd[3322186]: Disconnected from invalid user test 185.118.15.236 port 39244 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 10:56:34 host2 sshd[3322756]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 25 10:56:11 host2 sshd[3322453]: Disconnected from invalid user tecmint 35.200.237.19 port 1143 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 25 10:57:24 host2 sshd[3323433]: Disconnected from invalid user admin 35.200.237.19 port 1133 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Dec 25 10:58:16 host2 sshd[3324045]: Disconnected from invalid user deployer 103.224.247.23 port 44674 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 25 10:58:38 host2 sshd[3324309]: Disconnected from invalid user kunal 35.200.237.19 port 1113 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:04:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<p6uUIcBGJJwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:06:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<zhFCJ8BGXOMDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.168
country_id: 6252001
description:
Dec 25 11:07:00 host2 pure-ftpd[3330645]: (?@205.210.31.168) [INFO] New connection from 205.210.31.168


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.145.131.213
country_id: 294640
description:
[2025-12-25 11:07:01 +0530] info [webmaild] 45.145.131.213 - info@tfab.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:07:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<L6qVK8BGPswDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:08:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<1TZWMcBGrucDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:13:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ug4NQcBGCLQDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:15:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<x1JMR8BGiOUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:16:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<2PcFS8BGGpIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:17:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<Y9NPUMBGOsIDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.228
country_id: 3865483
description:
2025-12-25 11:20:08 dovecot_login authenticator failed for H=([186.5.178.228]) [186.5.178.228]:41085: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-25 11:20:39 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:40094: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 25 11:20:48 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<sQrXW8BGaOeLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.26
country_id: 1149361
description:
2025-12-25 11:28:28 dovecot_login authenticator failed for H=([149.54.62.26]) [149.54.62.26]:49311: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-12-25 11:28:28 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:44322: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.142
country_id: 3144096
description:
2025-12-25 11:28:39 dovecot_login authenticator failed for H=(cm-178.232.138.142.get.no) [178.232.138.142]:45123: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-25 11:28:47 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:45975: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 11:29:45 host2 pure-ftpd[3349899]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-25 11:33:04 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:49984: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-25 11:33:15 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:49553: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.219.221.172
country_id: 2661886
description:
2025-12-25 11:38:30 dovecot_login authenticator failed for H=83-219-221-172.cust.bredband2.com [83.219.221.172]:39832: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2025-12-25 11:38:55 dovecot_login authenticator failed for H=([122.186.240.209]) [27.123.97.62]:43828: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 25 11:40:07 host2 sshd[3357330]: Disconnected from invalid user gino 200.91.236.125 port 33248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 25 11:40:44 host2 sshd[3357808]: Disconnected from invalid user ubuntu 200.91.236.125 port 41683 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 25 11:41:51 host2 sshd[3358639]: Disconnected from invalid user nasrin 103.210.21.242 port 50396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 25 11:42:26 host2 sshd[3359031]: Disconnected from invalid user alma 103.210.21.242 port 48398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 25 11:43:39 host2 sshd[3360073]: Disconnected from invalid user rootuser 103.210.21.242 port 44874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 25 11:43:47 host2 sshd[3360187]: Disconnected from invalid user user1 200.91.236.125 port 35050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-25 11:45:31 dovecot_login authenticator failed for H=([125.18.219.209]) [27.123.102.122]:57066: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-12-25 11:45:49 dovecot_login authenticator failed for H=([65.20.179.251]) [65.20.179.251]:49051: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.49
country_id: 6252001
description:
Dec 25 11:47:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.49, lip=66.85.158.91, TLS, session=<k6jcu8BGUP3N0h8x>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.178.85.71
country_id: 102358
description:
2025-12-25 11:47:37 dovecot_login authenticator failed for H=([95.178.85.71]) [95.178.85.71]:45354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 25 11:49:09 host2 sshd[3364613]: Disconnected from invalid user info 200.91.236.125 port 48882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.196
country_id: 1733045
description:
2025-12-25 11:50:21 dovecot_login authenticator failed for H=([49.124.148.196]) [49.124.148.196]:37356: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.152
country_id: 3703430
description:
Dec 25 11:55:19 host2 pure-ftpd[3370123]: (?@45.227.254.152) [INFO] New connection from 45.227.254.152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-25 11:57:32 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:36084: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:02:11 host2 pure-ftpd[3375288]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-12-25 12:01:31 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:50433: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:03:08 host2 pure-ftpd[3376049]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:03:03 host2 pure-ftpd[3375930]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:03:14 host2 pure-ftpd[3376123]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:03:15 host2 pure-ftpd[3376131]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:04:14 host2 pure-ftpd[3376930]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:04:18 host2 pure-ftpd[3377004]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:05:14 host2 pure-ftpd[3377958]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:05:15 host2 pure-ftpd[3377977]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:06:20 host2 pure-ftpd[3379072]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:06:15 host2 pure-ftpd[3378999]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:07:15 host2 pure-ftpd[3379793]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:07:17 host2 pure-ftpd[3379840]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:08:15 host2 pure-ftpd[3381190]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:08:16 host2 pure-ftpd[3381201]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:09:15 host2 pure-ftpd[3382078]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:09:19 host2 pure-ftpd[3382153]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:10:15 host2 pure-ftpd[3383336]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:10:16 host2 pure-ftpd[3383371]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:11:15 host2 pure-ftpd[3384362]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:11:19 host2 pure-ftpd[3384434]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:12:15 host2 pure-ftpd[3385301]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:12:16 host2 pure-ftpd[3385310]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:13:15 host2 pure-ftpd[3386277]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:13:14 host2 pure-ftpd[3386267]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:14:19 host2 pure-ftpd[3387117]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:14:14 host2 pure-ftpd[3387039]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:15:16 host2 pure-ftpd[3388002]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:15:14 host2 pure-ftpd[3387965]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 12:21:51 host2 sshd[3393104]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-12-25 12:21:55 dovecot_login authenticator failed for H=([190.85.134.20]) [190.85.134.20]:43433: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.180.232.172
country_id: 6252001
description:
[2025-12-25 12:26:32 +0530] info [webmaild] 194.180.232.172 - info@lankaherbalsolutions.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-25 12:27:18 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:42918: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.235.35.123
country_id: 1269750
description:
2025-12-25 12:27:26 dovecot_login authenticator failed for H=([20.235.35.123]) [20.235.35.123]:36496: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-25 12:30:15 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:51456: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 12:31:41 host2 sshd[3400738]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 12:32:14 host2 pure-ftpd[3401191]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.91
country_id: 1819730
description:
Dec 25 12:33:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.91, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<n8EhXsFG9vgtjppb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2025-12-25 12:33:14 dovecot_login authenticator failed for H=([196.0.113.110]) [196.0.113.110]:35570: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-12-25 12:33:33 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:50598: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-25 12:33:56 dovecot_login authenticator failed for H=([182.66.80.41]) [182.66.214.70]:38608: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-25 12:38:02 dovecot_login authenticator failed for H=([105.73.93.110]) [105.73.93.110]:60452: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-25 12:38:50 dovecot_login authenticator failed for H=([122.185.254.113]) [122.186.64.206]:43676: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.74.192.200
country_id: 2186224
description:
2025-12-25 12:39:14 dovecot_login authenticator failed for H=([202.74.192.200]) [202.74.192.200]:46794: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 12:42:52 host2 sshd[3409447]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.218.46.67
country_id: 6252001
description:
[2025-12-25 12:56:58 +0530] info [webmaild] 88.218.46.67 - info@anandaobauae.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Dec 25 12:59:33 host2 sshd[3424597]: Disconnected from invalid user cashier 38.47.94.55 port 49750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Dec 25 13:00:10 host2 sshd[3425201]: Disconnected from invalid user test1 40.74.115.25 port 38814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.215.144.32
country_id: 6252001
description:
Dec 25 13:01:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.215.144.32, lip=66.85.158.91, TLS, session=<jdjEwsFGkMOs15Ag>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Dec 25 13:02:18 host2 sshd[3427090]: Disconnected from invalid user test1 38.47.94.55 port 56648 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.30.240.167
country_id: 2635167
description:
Dec 25 13:03:35 host2 sshd[3427943]: Disconnected from invalid user tunel 92.30.240.167 port 59218 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.74.115.25
country_id: 1861060
description:
Dec 25 13:07:04 host2 sshd[3430883]: Disconnected from invalid user rafael 40.74.115.25 port 56114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-25 13:14:24 dovecot_login authenticator failed for H=(cm-84.211.6.119.get.no) [84.211.6.119]:46917: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2025-12-25 13:14:39 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:41848: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.7
country_id: 798549
description:
Dec 25 13:14:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.7, lip=66.85.158.92, session=<1fgB88FGSLdV2YwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.188.81.67
country_id: 6252001
description:
Dec 25 13:17:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.188.81.67, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<GKuM+8FGdrI0vFFD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.187.217
country_id: 2921044
description:
Dec 25 13:17:08 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=164.92.187.217, lip=66.85.158.92, TLS, session=<QmPe+8FG1L2kXLvZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.199.163.171
country_id: 2635167
description:
2025-12-25 13:18:01 dovecot_login authenticator failed for H=171.163.199.146.dyn.plus.net [146.199.163.171]:52758: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-25 13:18:16 dovecot_login authenticator failed for H=(static.ill.117.211.15.106.bsnl.co.in) [117.211.15.93]:41530: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.68.87.135
country_id: 192950
description:
2025-12-25 13:18:28 dovecot_login authenticator failed for H=([102.68.87.135]) [102.68.87.135]:47768: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2025-12-25 13:18:38 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:52822: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.119.46.111
country_id: 294640
description:
[2025-12-25 13:25:12 +0530] info [webmaild] 212.119.46.111 - info@saara.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-25 13:28:19 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:45274: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2025-12-25 13:29:14 dovecot_login authenticator failed for H=(223-197-145-114.static.imsbiz.com) [223.197.145.114]:61915: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 25 13:30:54 host2 sshd[3450182]: Disconnected from invalid user libuuid 137.59.55.50 port 42636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.123
country_id: 933860
description:
Dec 25 13:32:36 host2 sshd[3451528]: Disconnected from invalid user owncloud 168.167.228.123 port 34207 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.140.207.251
country_id: 294640
description:
[2025-12-25 13:33:33 +0530] info [webmaild] 45.140.207.251 - info@epid.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 25 13:34:27 host2 sshd[3452862]: Disconnected from invalid user andrey 137.59.55.50 port 46252 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 13:34:46 host2 pure-ftpd[3453075]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.123
country_id: 933860
description:
Dec 25 13:35:55 host2 sshd[3454047]: Disconnected from invalid user rich 168.167.228.123 port 34211 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 25 13:35:35 host2 sshd[3453793]: Disconnected from invalid user user100 137.59.55.50 port 45212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 25 13:37:49 host2 sshd[3455403]: Disconnected from invalid user miguel 140.106.25.217 port 45802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Dec 25 13:39:55 host2 sshd[3456862]: Disconnected from invalid user mamy 107.150.104.184 port 42338 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 25 13:40:20 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, session=<z1bXTsJGqOEs3lFz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:40:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ExnIUMJGQoUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:41:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5lBQUsJGAqADhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.104.184
country_id: 6252001
description:
Dec 25 13:41:50 host2 sshd[3458547]: Disconnected from invalid user ubuntu 107.150.104.184 port 38570 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 25 13:42:41 host2 sshd[3459111]: Received disconnect from 140.106.25.217 port 41766:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 25 13:42:41 host2 sshd[3459111]: Disconnected from invalid user teaspeak 140.106.25.217 port 41766 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:43:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<b/ZgWsJGboADhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 25 13:43:45 host2 sshd[3459939]: Disconnected from invalid user samba 140.106.25.217 port 37732 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:45:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<nE6MX8JGZqsDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 25 13:44:17 host2 sshd[3460539]: Disconnected from invalid user j 140.106.25.217 port 49832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Dec 25 13:44:42 host2 sshd[3460874]: Disconnected from invalid user postgres 107.150.104.184 port 47032 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:45:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<1uvVYMJGDsMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:46:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<W54cZcJGpt0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:47:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<V4baacJGwJ0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:48:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<xSt7bcJGouEDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-12-25 13:53:53 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:38709: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-25 13:54:21 dovecot_login authenticator failed for H=([94.201.22.158]) [94.201.22.158]:51635: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-12-25 13:56:12 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:56012: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-25 13:55:50 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:40838: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-25 14:02:17 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:49790: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-25 14:01:40 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:56282: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.202
country_id: 2750405
description:
Dec 25 14:03:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=80.82.77.202, lip=66.85.158.92, session=<meP+oMJGYOpQUk3K>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 14:08:11 host2 sshd[3481747]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-25 14:07:36 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49897: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-25 14:20:24 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:44499: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.16.99
country_id: 3144096
description:
2025-12-25 14:20:39 dovecot_login authenticator failed for H=(cm-178.232.16.99.get.no) [178.232.16.99]:55174: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 14:25:51 host2 sshd[3496001]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 14:29:11 host2 sshd[3498550]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-25 14:32:42 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:46010: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-12-25 14:33:28 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:62797: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-25 14:34:37 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:56649: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.198
country_id: 1733045
description:
Dec 25 14:36:30 host2 sshd[3504468]: Disconnected from invalid user server 202.165.16.198 port 49936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.16.198
country_id: 1733045
description:
Dec 25 14:37:08 host2 sshd[3504914]: Disconnected from invalid user server 202.165.16.198 port 60578 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 14:37:08 host2 pure-ftpd[3504937]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.182.243
country_id: 2802361
description:
Dec 25 14:38:43 host2 pure-ftpd[3506230]: (?@34.79.182.243) [INFO] New connection from 34.79.182.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-12-25 14:39:13 dovecot_login authenticator failed for H=202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:50584: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-12-25 14:39:29 dovecot_login authenticator failed for H=209.66.246.220.static.netvigator.com [220.246.66.209]:61815: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.210.200
country_id: 2802361
description:
Dec 25 14:40:23 host2 pure-ftpd[3508003]: (?@34.76.210.200) [INFO] New connection from 34.76.210.200


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.198
country_id: 1733045
description:
Dec 25 14:40:36 host2 sshd[3508172]: Disconnected from invalid user git 202.165.16.198 port 59682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-25 14:43:21 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:54476: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-25 14:43:44 dovecot_login authenticator failed for H=([5.76.44.40]) [5.76.44.40]:53948: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2025-12-25 14:47:44 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:55726: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-12-25 14:47:25 dovecot_login authenticator failed for H=([102.90.34.90]) [102.90.34.90]:47601: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 25 14:49:20 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, session=<TPaSRcNGEIo26lCA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-25 14:52:24 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:49914: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.99.80.56
country_id: 1643084
description:
Dec 25 14:56:07 host2 sshd[3522308]: Disconnected from invalid user frappe 118.99.80.56 port 10470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.99.80.56
country_id: 1643084
description:
Dec 25 14:58:37 host2 sshd[3524142]: Disconnected from invalid user deploy 118.99.80.56 port 2534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.99.80.56
country_id: 1643084
description:
Dec 25 15:01:18 host2 sshd[3526097]: Disconnected from invalid user ubuntu 118.99.80.56 port 7798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 25 15:03:39 host2 sshd[3527567]: Disconnected from invalid user admin 186.87.166.141 port 45434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 25 15:04:10 host2 sshd[3527787]: Disconnected from invalid user student2 186.87.166.141 port 51100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.74.229.158
country_id: 2510769
description:
Dec 25 15:06:52 host2 sshd[3530325]: Disconnected from invalid user test 77.74.229.158 port 47178 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-12-25 15:07:48 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:26403: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-12-25 15:08:14 dovecot_login authenticator failed for H=(cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:48168: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 25 15:08:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<6R+Ni8NG6Iws3lFz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Dec 25 15:08:38 host2 sshd[3531972]: Disconnected from invalid user gemini 152.42.203.0 port 48830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Dec 25 15:09:26 host2 sshd[3532577]: Disconnected from invalid user sftp_user 152.42.203.0 port 43242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.166.174.63
country_id: 1880251
description:
Dec 25 15:10:04 host2 sshd[3533291]: Disconnected from invalid user rustserver 207.166.174.63 port 45786 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.203.0
country_id: 1880251
description:
Dec 25 15:10:07 host2 sshd[3533352]: Disconnected from invalid user alan 152.42.203.0 port 33650 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.89.125.231
country_id: 6252001
description:
Dec 25 15:10:43 host2 pure-ftpd[3533850]: (?@13.89.125.231) [INFO] New connection from 13.89.125.231


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 211.24.41.44
country_id: 1733045
description:
Dec 25 15:12:30 host2 sshd[3535787]: Disconnected from invalid user abhishek 211.24.41.44 port 58130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.166.174.63
country_id: 1880251
description:
Dec 25 15:14:29 host2 sshd[3537487]: Disconnected from invalid user cheng 207.166.174.63 port 42534 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.225.19
country_id: 6252001
description:
Dec 25 15:15:00 host2 pure-ftpd[3537835]: (?@20.118.225.19) [INFO] New connection from 20.118.225.19


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 45.131.135.89
country_id: 2750405
description:
Dec 25 15:16:31 host2 sshd[3539205]: Received disconnect from 45.131.135.89 port 35736:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.131.135.89
country_id: 2750405
description:
Dec 25 15:16:31 host2 sshd[3539205]: Disconnected from invalid user sammy 45.131.135.89 port 35736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Dec 25 15:18:28 host2 sshd[3541187]: Disconnected from invalid user deploy 45.131.135.89 port 35176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-25 15:20:04 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:49370: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-25 15:20:06 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:33710: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-12-25 15:20:30 dovecot_login authenticator failed for H=([189.80.46.250]) [189.80.46.250]:60696: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.240.244.53
country_id: 1269750
description:
2025-12-25 15:20:45 dovecot_login authenticator failed for H=([152.52.93.82]) [115.240.244.53]:10400: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-12-25 15:20:51 dovecot_login authenticator failed for H=([121.73.169.161]) [121.73.169.161]:46790: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-25 15:21:21 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:40188: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-25 15:22:11 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:38624: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-25 15:22:25 dovecot_login authenticator failed for H=([105.73.93.110]) [105.73.93.110]:45967: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-25 15:22:45 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:17216: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 15:29:45 host2 sshd[3550322]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.55.50
country_id: 3469034
description:
Dec 25 15:29:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=170.82.55.50, lip=66.85.158.91, TLS, session=<54Ef1MNG55WqUjcy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.189
country_id: 3865483
description:
Dec 25 15:29:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=181.118.183.189, lip=66.85.158.91, TLS, session=<DIpi1cNGRK+1dre9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 25 15:33:23 host2 sshd[3553443]: Disconnected from invalid user ubuntu 92.191.96.115 port 54642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.46.102
country_id: 2921044
description:
Dec 25 15:33:43 host2 sshd[3553660]: Disconnected from invalid user thomas 51.195.46.102 port 46392 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 25 15:34:14 host2 sshd[3554158]: Disconnected from invalid user usher 158.69.194.34 port 52624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-25 15:34:47 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:58170: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 25 15:36:09 host2 sshd[3556309]: Disconnected from invalid user steam 92.191.96.115 port 37328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 25 15:36:19 host2 sshd[3556426]: Disconnected from invalid user apps 158.69.194.34 port 51808 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 25 15:37:49 host2 sshd[3557734]: Received disconnect from 158.69.194.34 port 49700:11: Bye Bye [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 15:38:30 host2 pure-ftpd[3558726]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.46.102
country_id: 2921044
description:
Dec 25 15:39:31 host2 sshd[3559362]: Disconnected from invalid user mark 51.195.46.102 port 33552 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-25 15:41:02 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (losal) [73.197.236.163]:56698: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.29.239.66
country_id: 1880251
description:
2025-12-25 15:45:54 dovecot_login authenticator failed for H=([114.29.239.66]) [114.29.239.66]:47496: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-25 15:46:07 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:42082: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 25 15:52:54 host2 sshd[3571097]: Disconnected from invalid user pt 152.32.215.203 port 40858 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 15:54:26 host2 sshd[3573255]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 25 15:55:12 host2 sshd[3573855]: Disconnected from invalid user felix 152.32.215.203 port 37724 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-25 15:56:25 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (culphinde) [73.176.157.57]:35094: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-25 16:10:40 dovecot_plain authenticator failed for H=(writy) [12.150.243.22]:24759: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 16:15:40 host2 sshd[3592765]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-12-25 16:17:47 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:51926: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-25 16:17:23 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:37973: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 31.208.188.18
country_id: 2661886
description:
Dec 25 16:17:33 host2 pure-ftpd[3594183]: (?@31.208.188.18) [INFO] New connection from 31.208.188.18


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.208.188.18
country_id: 2661886
description:
Dec 25 16:17:34 host2 sshd[3594186]: Invalid user httpsaccounts.zoho.comsigninhr@lezzarotech.com from 31.208.188.18 port 62837


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 31.208.188.18
country_id: 2661886
description:
Dec 25 16:17:40 host2 pure-ftpd[3594183]: (?@31.208.188.18) [WARNING] Authentication failed for user [httpsaccounts.zoho.comsigninhr@lezzarotech.com]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.208.188.18
country_id: 2661886
description:
Dec 25 16:17:41 host2 sshd[3594292]: Invalid user httpsaccounts.zoho.comsigninhr from 31.208.188.18 port 63332


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-12-25 16:23:24 dovecot_login authenticator failed for H=([49.231.31.220]) [49.231.31.220]:12196: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-12-25 16:24:02 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:33190: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:31:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<FmqjscRG7q8DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-25 16:31:19 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (jocaphyceo) [68.52.119.193]:47322: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:33:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<dJi6usRGnqYDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 25 16:34:42 host2 sshd[3613323]: Disconnected from invalid user andrey 89.218.69.66 port 11531 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:34:03 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<6zYTvMRG/OADiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 25 16:35:21 host2 sshd[3614226]: Disconnected from invalid user server 89.218.69.66 port 30355 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:36:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<1BKuw8RGIpUDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:36:40 host2 dovecot[1881837]: pop3-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<nahsxcRGutIDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:37:04 host2 dovecot[1881837]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<zO3lxsRGlpIDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 25 16:37:14 host2 sshd[3616418]: Disconnected from invalid user deploy 89.218.69.66 port 27789 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-25 16:38:06 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (cally) [73.183.74.177]:57744: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:38:05 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<iSeMysRGLLYDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Dec 25 16:38:09 host2 sshd[3617343]: Disconnected from invalid user bots 167.99.78.165 port 49648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.249.61.124
country_id: 298795
description:
Dec 25 16:38:52 host2 sshd[3618061]: Disconnected from invalid user tin 92.249.61.124 port 38294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 25 16:39:38 host2 sshd[3618954]: Disconnected from invalid user administrator 89.218.69.66 port 37439 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.78.165
country_id: 1880251
description:
Dec 25 16:39:50 host2 sshd[3619173]: Disconnected from invalid user fastuser 167.99.78.165 port 53974 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 16:41:20 host2 pure-ftpd[3621312]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Dec 25 16:41:06 host2 sshd[3620983]: Disconnected from invalid user server 167.99.78.165 port 45380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.249.61.124
country_id: 298795
description:
Dec 25 16:42:04 host2 sshd[3622177]: Disconnected from invalid user edu 92.249.61.124 port 57144 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.249.61.124
country_id: 298795
description:
Dec 25 16:42:44 host2 sshd[3622875]: Disconnected from invalid user posiflex 92.249.61.124 port 56552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.249.61.124
country_id: 298795
description:
Dec 25 16:44:36 host2 sshd[3625362]: Disconnected from invalid user wm 92.249.61.124 port 35544 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 25 16:44:42 host2 pure-ftpd[3625610]: (?@66.132.153.114) [INFO] New connection from 66.132.153.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-25 16:48:28 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:33370: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-25 16:48:31 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:40544: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.251.180.148
country_id: 1522867
description:
2025-12-25 16:49:08 dovecot_login authenticator failed for H=([5.251.180.148]) [5.251.180.148]:34404: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-25 16:49:25 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:18482: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.203.11.178
country_id: 294640
description:
[2025-12-25 17:02:44 +0530] info [webmaild] 193.203.11.178 - info@casa18villa.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-25 17:08:25 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:50378: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-25 17:09:34 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:53701: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-25 17:09:54 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:53373: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-25 17:08:58 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:8867: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-25 17:17:29 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:50730: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-25 17:31:27 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49310: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2025-12-25 17:31:54 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:34468: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-25 17:32:05 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:55335: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Dec 25 17:32:45 host2 sshd[3683437]: Disconnected from invalid user erik 209.141.57.124 port 34858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.57.124
country_id: 6252001
description:
Dec 25 17:35:13 host2 sshd[3685771]: Disconnected from invalid user gokul 209.141.57.124 port 42174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.7
country_id: 1605651
description:
Dec 25 17:35:26 host2 sshd[3686093]: Disconnected from invalid user kiran 49.49.231.7 port 58716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Dec 25 17:36:36 host2 sshd[3687343]: Disconnected from invalid user ubuntu 209.141.57.124 port 37638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.7
country_id: 1605651
description:
Dec 25 17:36:05 host2 sshd[3686862]: Disconnected from invalid user tomcat 49.49.231.7 port 33586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Dec 25 17:38:04 host2 sshd[3688757]: Disconnected from invalid user kiran 209.141.57.124 port 33102 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.49.231.7
country_id: 1605651
description:
Dec 25 17:39:22 host2 sshd[3690043]: Disconnected from invalid user liuyong 49.49.231.7 port 33560 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 17:40:21 host2 sshd[3691155]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 17:41:45 host2 sshd[3692339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:41:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<tPyYrsVGxL4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:42:10 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<YtOzr8VGiLMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:43:05 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<4Xn/ssVGqqIDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 17:44:04 host2 pure-ftpd[3694629]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:44:30 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<5o0JuMVGmMwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:45:14 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<WmmjusVGKrUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:46:19 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<72SJvsVGeJEDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.51.234.214
country_id: 6252001
description:
Dec 25 17:46:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.51.234.214, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ed06wMVGVNIUM+rW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:47:09 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<ItuCwcVG4KkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:48:27 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<YagoxsVGuqkDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.109
country_id: 2215636
description:
2025-12-25 17:49:17 dovecot_login authenticator failed for H=([102.38.3.109]) [102.38.3.109]:52274: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:49:21 host2 dovecot[1881837]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<RYJoycVGBMIDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.179.129
country_id: 3144096
description:
2025-12-25 17:49:46 dovecot_login authenticator failed for H=(cm-84.213.179.129.get.no) [84.213.179.129]:42048: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:50:11 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<I+hhzMVGFsoDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 17:51:33 host2 sshd[3702772]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:51:09 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<NePQz8VGzJ4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Dec 25 17:55:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<wUn43cVGApA2xDDo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.21.25
country_id: 6252001
description:
Dec 25 17:58:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.29.21.25, lip=66.85.158.91, TLS, session=<yjux6cVGFt0UHRUZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 18:01:19 host2 sshd[3712709]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.141.160
country_id: 2921044
description:
Dec 25 18:09:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.141.160, lip=66.85.158.91, session=<Mq5REMZGrclo+I2g>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.249.109
country_id: 2921044
description:
Dec 25 18:09:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.99.249.109, lip=66.85.158.91, session=<9/ZwEMZG1NmnY/lt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-25 18:32:14 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:51068: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.221.50
country_id: 2921044
description:
Dec 25 18:37:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=207.154.221.50, lip=66.85.158.92, TLS handshaking: Connection closed, session=<V39kdMZGVibPmt0y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.10.245
country_id: 2921044
description:
Dec 25 18:36:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.89.10.245, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<GuVAcsZGs9WfWQr1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 18:37:57 host2 sshd[3749505]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.117.78.106
country_id: 3865483
description:
Dec 25 18:41:55 host2 sshd[3753858]: Invalid user smtp.zoho.com587hr@lezzarotech.com from 138.117.78.106 port 55019


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.117.78.106
country_id: 3865483
description:
Dec 25 18:41:55 host2 pure-ftpd[3753855]: (?@138.117.78.106) [INFO] New connection from 138.117.78.106


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 138.117.78.106
country_id: 3865483
description:
Dec 25 18:42:00 host2 pure-ftpd[3753855]: (?@138.117.78.106) [WARNING] Authentication failed for user [smtp.zoho.com587hr@lezzarotech.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.57
country_id: 1733045
description:
2025-12-25 18:44:08 dovecot_login authenticator failed for H=([49.124.151.57]) [49.124.151.57]:60568: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.149.183.243
country_id: 3017382
description:
2025-12-25 18:43:30 dovecot_login authenticator failed for H=static-css-cqn-183243.business.bouyguestelecom.com [176.149.183.243]:47418: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-25 18:45:21 dovecot_login authenticator failed for H=([152.52.206.188]) [152.52.192.74]:38838: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-12-25 18:46:07 dovecot_login authenticator failed for H=([82.102.165.200]) [82.102.165.200]:40999: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 18:46:40 host2 pure-ftpd[3759363]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-25 18:51:27 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:48265: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 25 18:51:30 host2 sshd[3764821]: Disconnected from invalid user rancid 42.200.78.78 port 44778 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-25 18:51:56 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:59809: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 25 18:53:13 host2 sshd[3766389]: Disconnected from invalid user admin 42.200.78.78 port 51444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 25 18:53:30 host2 sshd[3766559]: Disconnected from invalid user forward 43.155.21.198 port 36902 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 25 18:54:44 host2 sshd[3768019]: Disconnected from invalid user app 43.155.21.198 port 51440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Dec 25 18:55:41 host2 sshd[3769172]: Disconnected from invalid user postgres 128.1.131.163 port 38606 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.131.163
country_id: 1819730
description:
Dec 25 18:56:18 host2 sshd[3769827]: Disconnected from invalid user tiptop 128.1.131.163 port 51416 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 18:58:59 host2 sshd[3772677]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.142
country_id: 3144096
description:
2025-12-25 19:04:43 dovecot_login authenticator failed for H=([178.232.138.142]) [178.232.138.142]:39532: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-25 19:05:33 dovecot_login authenticator failed for H=([187.51.252.236]) [186.201.54.90]:35569: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 25 19:09:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS: read(size=704) failed: Connection reset by peer, session=<r7gg6MZGSORChJly>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 19:14:07 host2 sshd[3790911]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.208.161
country_id: 2921044
description:
Dec 25 19:15:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=207.154.208.161, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<Sara/MZG60DPmtCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.203.219
country_id: 2921044
description:
Dec 25 19:15:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=178.128.203.219, lip=66.85.158.92, TLS handshaking: Connection closed, session=<JyX6/sZGwoaygMvb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-25 19:19:20 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:50550: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-25 19:19:48 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:49009: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.51
country_id: 6252001
description:
Dec 25 19:24:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.51, lip=66.85.158.91, TLS: Connection closed, session=<2VPdG8dGjlOnXpIz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.152
country_id: 6252001
description:
Dec 25 19:28:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gAgZK8dGlBtAPsWY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.152
country_id: 6252001
description:
Dec 25 19:28:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Bh0rLMdG5ttAPsWY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-25 19:31:09 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:57384: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 19:32:36 host2 sshd[3814959]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.85.65
country_id: 1880251
description:
Dec 25 19:34:57 host2 sshd[3817676]: Disconnected from invalid user www-data 167.172.85.65 port 31202 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:36:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Y5sMR8dGns2i2JVQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:36:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IS3ESMdG3Oqi2JVQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.172.85.65
country_id: 1880251
description:
Dec 25 19:36:49 host2 sshd[3820065]: Disconnected from invalid user pacs 167.172.85.65 port 11478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.129.41.91
country_id: 1643084
description:
Dec 25 19:36:54 host2 sshd[3820170]: Disconnected from invalid user admin 43.129.41.91 port 49438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 25 19:36:56 host2 sshd[3820239]: Disconnected from invalid user ubuntu 35.210.61.208 port 48032 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:37:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<Cmw3TMdG+vai2JVQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 25 19:39:03 host2 sshd[3822652]: Disconnected from invalid user ftpuser 144.31.195.14 port 52500 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.138
country_id: 1819730
description:
Dec 25 19:39:15 host2 sshd[3822831]: Disconnected from invalid user pacs 150.5.169.138 port 40146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.122
country_id: 1880251
description:
Dec 25 19:40:06 host2 sshd[3823865]: Disconnected from invalid user user 45.78.201.122 port 48572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.129.41.91
country_id: 1643084
description:
Dec 25 19:39:19 host2 sshd[3822945]: Disconnected from invalid user pzuser 43.129.41.91 port 47846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 25 19:39:30 host2 sshd[3823129]: Disconnected from invalid user oe 144.31.195.14 port 58000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Dec 25 19:39:30 host2 sshd[3823131]: Disconnected from invalid user pzuser 150.5.169.138 port 52124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 25 19:40:38 host2 sshd[3824660]: Disconnected from invalid user kostas 146.59.95.254 port 48804 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 25 19:40:56 host2 sshd[3825068]: Received disconnect from 144.31.195.14 port 55346:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 25 19:41:24 host2 sshd[3825766]: Disconnected from invalid user qa 144.31.195.14 port 51204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 25 19:41:32 host2 sshd[3825963]: Disconnected from invalid user ubuntu 162.240.212.247 port 60832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Dec 25 19:41:38 host2 sshd[3826017]: Disconnected from invalid user admin 103.31.39.143 port 59100 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:42:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<rZeyX8dGgOei2JVQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Dec 25 19:43:04 host2 sshd[3827775]: Disconnected from invalid user panda 103.31.39.143 port 42764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 25 19:42:32 host2 sshd[3827156]: Disconnected from invalid user firewall 35.210.61.208 port 37612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 25 19:44:06 host2 sshd[3828846]: Disconnected from invalid user vpn 162.240.212.247 port 33278 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.124.62.2
country_id: 2658434
description:
Dec 25 19:44:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.124.62.2, lip=66.85.158.92, TLS: Connection closed, session=<l+x/Y8dGJJOKfD4C>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 25 19:45:12 host2 sshd[3830458]: Disconnected from invalid user ftpuser 190.181.27.22 port 35376 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:46:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS, session=<aFaPasdGauui2JVQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.118.34.82
country_id: 1269750
description:
Dec 25 19:46:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=45.118.34.82, lip=66.85.158.91, TLS, session=<Nt8ibMdGTaUtdiJS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:46:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS, session=<fUZ+bcdGrPei2JVQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.137.252
country_id: 690791
description:
Dec 25 19:47:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=91.234.137.252, lip=66.85.158.91, TLS, session=<UHpdbcdGc9db6on8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 19:49:45 host2 pure-ftpd[3835257]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 25 19:51:36 host2 sshd[3837765]: Disconnected from invalid user papa 107.175.89.172 port 59338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.122
country_id: 1880251
description:
Dec 25 19:51:57 host2 sshd[3838597]: Disconnected from invalid user tester 45.78.201.122 port 60252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 25 19:55:37 host2 sshd[3842917]: Disconnected from invalid user es_user 107.175.89.172 port 32962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 25 19:57:12 host2 sshd[3844567]: Disconnected from invalid user terra 107.175.89.172 port 44162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.17.58.173
country_id: 2921044
description:
Dec 25 19:57:53 host2 sshd[3845341]: Disconnected from invalid user mac 178.17.58.173 port 59364 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.13
country_id: 798549
description:
Dec 25 19:59:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.13, lip=66.85.158.91, TLS: Connection closed, session=<A55XmsdGTttV2YwN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.28.222.221
country_id: 2264397
description:
Dec 25 19:59:24 host2 sshd[3847135]: Disconnected from invalid user portal 62.28.222.221 port 36620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.28.222.221
country_id: 2264397
description:
Dec 25 20:00:09 host2 sshd[3848281]: Disconnected from invalid user kevin 62.28.222.221 port 6123 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 25 20:00:24 host2 sshd[3848577]: Disconnected from invalid user admin 2.57.121.112 port 28749 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.28.222.221
country_id: 2264397
description:
Dec 25 20:00:49 host2 sshd[3849022]: Disconnected from invalid user andy 62.28.222.221 port 10097 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 25 20:02:52 host2 sshd[3850940]: Disconnected from invalid user roy 138.68.150.253 port 44820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.17.58.173
country_id: 2921044
description:
Dec 25 20:03:50 host2 sshd[3852035]: Disconnected from invalid user next 178.17.58.173 port 58056 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.17.58.173
country_id: 2921044
description:
Dec 25 20:04:29 host2 sshd[3852687]: Disconnected from invalid user ehsan 178.17.58.173 port 59774 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.252.150.207
country_id: 6252001
description:
[2025-12-25 20:06:47 +0530] info [cpaneld] 73.252.150.207 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.33.105.41
country_id: 6252001
description:
[2025-12-25 20:06:41 +0530] info [cpaneld] 98.33.105.41 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.195.24.33
country_id: 6252001
description:
[2025-12-25 20:06:42 +0530] info [cpaneld] 68.195.24.33 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.247.219.77
country_id: 6252001
description:
[2025-12-25 20:06:46 +0530] info [whostmgrd] 67.247.219.77 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.55.247.96
country_id: 6252001
description:
[2025-12-25 20:06:49 +0530] info [cpaneld] 184.55.247.96 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.16.224.121
country_id: 6252001
description:
[2025-12-25 20:06:50 +0530] info [cpaneld] 70.16.224.121 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.97.109.15
country_id: 6252001
description:
[2025-12-25 20:06:48 +0530] info [cpaneld] 99.97.109.15 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.23.70.13
country_id: 6252001
description:
[2025-12-25 20:06:59 +0530] info [cpaneld] 69.23.70.13 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.243.74.105
country_id: 6252001
description:
[2025-12-25 20:07:03 +0530] info [cpaneld] 108.243.74.105 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.229.175.188
country_id: 6252001
description:
[2025-12-25 20:07:02 +0530] info [cpaneld] 71.229.175.188 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.2.104
country_id: 6252001
description:
[2025-12-25 20:06:45 +0530] info [cpaneld] 98.97.2.104 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.218.52.234
country_id: 6252001
description:
[2025-12-25 20:06:51 +0530] info [cpaneld] 73.218.52.234 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.162.176.167
country_id: 6252001
description:
[2025-12-25 20:07:01 +0530] info [cpaneld] 47.162.176.167 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.242.14.23
country_id: 6252001
description:
[2025-12-25 20:07:00 +0530] info [cpaneld] 23.242.14.23 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2025-12-25 20:08:54 dovecot_login authenticator failed for H=([125.17.225.97]) [182.95.61.82]:43970: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.15.194
country_id: 3469034
description:
2025-12-25 20:09:36 dovecot_login authenticator failed for H=([200.195.15.194]) [200.195.15.194]:53747: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 25 20:10:25 host2 sshd[3859246]: Disconnected from invalid user igor 107.175.89.172 port 54628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.52.243
country_id: 3144096
description:
2025-12-25 20:21:52 dovecot_login authenticator failed for H=([84.215.52.243]) [84.215.52.243]:60606: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-12-25 20:22:06 dovecot_login authenticator failed for H=([59.98.144.36]) [59.98.144.36]:55828: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-25 20:23:21 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:43012: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 20:24:01 host2 sshd[3875068]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-25 20:23:50 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:33946: 535 Incorrect authentication data (set_id=washeera)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 38.58.182.203
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 38.58.182.203: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.161
country_id: 3175395
description:
Dec 25 20:29:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.63.133.161, lip=66.85.158.91, TLS, session=<VmffBMhG6+u5P4Wh>


