# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Dec 16 06:52:53 host2 sshd[634764]: Disconnected from invalid user admin 101.47.51.246 port 43998 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-16 06:53:43 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:45710: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-16 06:54:34 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:49666: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 67.207.83.103
country_id: 6252001
description:
Dec 16 06:54:51 host2 sshd[636843]: Disconnected from invalid user devops 67.207.83.103 port 58554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.246
country_id: 1880251
description:
Dec 16 06:55:06 host2 sshd[637060]: Disconnected from invalid user ansible 101.47.51.246 port 43776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.41
country_id: 130758
description:
2025-12-16 06:55:09 dovecot_plain authenticator failed for (localhost) [62.60.131.41]:41266: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.47
country_id: 3625428
description:
2025-12-16 06:55:15 dovecot_login authenticator failed for (ADMIN) [95.181.237.47]:51194: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.246
country_id: 1880251
description:
Dec 16 06:56:21 host2 sshd[637928]: Disconnected from invalid user mika 101.47.51.246 port 42660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.96
country_id: 3996063
description:
2025-12-16 06:56:42 dovecot_login authenticator failed for (201.173.216.96-clientes-izzi.mx) [201.173.216.96]:39193: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-16 06:56:55 dovecot_plain authenticator failed for (dranited) [5.31.15.108]:56926: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-16 06:56:58 dovecot_plain authenticator failed for (renowal) [176.113.155.132]:44690: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.116.162.215
country_id: 6251999
description:
2025-12-16 06:57:32 dovecot_login authenticator failed for ([206.116.162.215]) [206.116.162.215]:34856: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 06:58:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<X+e+pAdGNNI+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-16 06:59:31 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:55246: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.248.55
country_id: 1880251
description:
Dec 16 07:00:43 host2 sshd[640901]: Disconnected from invalid user username 139.59.248.55 port 49992 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-16 07:00:19 dovecot_plain authenticator failed for (aenetful) [65.20.143.159]:35076: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-16 07:00:33 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:43522: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 07:01:17 host2 sshd[641153]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.218.89.110
country_id: 226074
description:
Dec 16 07:01:38 host2 sshd[641451]: Disconnected from invalid user dockeruser 102.218.89.110 port 60362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.9.116.195
country_id: 2921044
description:
Dec 16 07:04:21 host2 sshd[643807]: Disconnected from invalid user mcserver 45.9.116.195 port 41142 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 16 07:04:33 host2 sshd[643952]: Disconnected from invalid user jboss 172.208.24.217 port 39394 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.126
country_id: 2963597
description:
Dec 16 07:04:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=37.203.49.126, lip=66.85.158.91, TLS, session=<SZh4ugdGJaMlyzF+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.109.178.8
country_id: 1269750
description:
Dec 16 07:05:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=103.109.178.8, lip=66.85.158.91, TLS, session=<ziSYuwdGDeBnbbII>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.82.208.178
country_id: 2245662
description:
Dec 16 07:05:05 host2 sshd[644343]: Disconnected from invalid user frappe-user 41.82.208.178 port 58872 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-16 07:05:12 +0530] info [cpaneld] 43.245.222.27 - epid "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 07:06:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<0IowwgdG5t0+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.248.55
country_id: 1880251
description:
Dec 16 07:07:48 host2 sshd[646051]: Disconnected from invalid user ftpadmin 139.59.248.55 port 58714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-12-16 07:07:50 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:60458: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-16 07:08:03 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:34274: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.9.116.195
country_id: 2921044
description:
Dec 16 07:08:51 host2 sshd[646761]: Disconnected from invalid user intel 45.9.116.195 port 40382 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.82.208.178
country_id: 2245662
description:
Dec 16 07:08:51 host2 sshd[646763]: Disconnected from invalid user dal 41.82.208.178 port 2847 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 07:10:01 host2 sshd[647409]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.9.116.195
country_id: 2921044
description:
Dec 16 07:09:23 host2 sshd[647102]: Disconnected from invalid user docker 45.9.116.195 port 46830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.104.111.235
country_id: 6252001
description:
Dec 16 07:09:38 host2 sshd[647323]: Disconnected from invalid user scsadmin 149.104.111.235 port 47518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-16 07:11:15 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:46326: 535 Incorrect authentication data (set_id=support@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 149.104.111.235
country_id: 6252001
description:
Dec 16 07:11:26 host2 sshd[648589]: Disconnected from invalid user hamza 149.104.111.235 port 56900 [preauth]


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 62.60.135.40
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[62.60.135.40] [Authentication Database]=[mail] [Username]=[support@dataesite.lk] (10/10 failures) (blocked until [Wed Dec 17 01:42:48 2025 UTC/Wed Dec 17 07:12:48 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.100
country_id: 3469034
description:
Dec 16 07:12:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=168.0.224.100, lip=66.85.158.91, TLS, session=<CHeE1wdGfNCoAOBk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-16 07:12:50 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:60904: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.115.143
country_id: 1269750
description:
Dec 16 07:13:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.58.115.143, lip=66.85.158.91, TLS, session=<wFuz2AdGwtFnOnOP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.7
country_id: 1821275
description:
2025-12-16 07:13:37 dovecot_login authenticator failed for (ADMIN) [84.252.92.7]:13228: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.130
country_id: 6252001
description:
2025-12-16 07:14:27 dovecot_login authenticator failed for (ADMIN) [102.129.153.130]:36696: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.104
country_id: 130758
description:
2025-12-16 07:14:42 dovecot_plain authenticator failed for (localhost) [62.60.135.104]:49472: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 07:14:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<NjDM3wdGBrQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-16 07:15:02 dovecot_plain authenticator failed for (acher) [5.31.15.108]:37909: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.52
country_id: 130758
description:
2025-12-16 07:16:55 dovecot_plain authenticator failed for (localhost) [62.60.131.52]:51570: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-16 07:18:47 dovecot_plain authenticator failed for (allierle) [176.113.155.132]:58774: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-16 07:20:13 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:52888: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 07:20:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<ZHyp9AdGNKo+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-16 07:23:43 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:54664: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-12-16 07:24:02 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:60884: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-12-16 07:25:26 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:60364: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-12-16 07:25:44 dovecot_login authenticator failed for ([186.238.247.238]) [186.238.247.238]:49533: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.103
country_id: 130758
description:
2025-12-16 07:26:04 dovecot_plain authenticator failed for (localhost) [62.60.135.103]:44370: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.194.166
country_id: 1269750
description:
2025-12-16 07:26:46 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:43074: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-16 07:27:08 dovecot_login authenticator failed for ([94.201.22.158]) [94.201.22.158]:39837: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.103
country_id: 130758
description:
2025-12-16 07:26:11 dovecot_plain authenticator failed for (localhost) [62.60.135.103]:43220: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 16 07:27:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<e1uUDAhGbNDBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-16 07:28:24 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (thumbrus) [217.215.74.195]:43477: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.36.9.54
country_id: 3175395
description:
Dec 16 07:28:45 host2 sshd[659075]: Disconnected from invalid user testadmin 151.36.9.54 port 27134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Dec 16 07:29:12 host2 sshd[659320]: Disconnected from invalid user sonic 20.203.42.204 port 50894 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 07:30:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<zM8FGQhG5Lo+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 16 07:32:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<deXBHghGLs0+PIcr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.18.139.237
country_id: 1269750
description:
Dec 16 07:32:52 host2 sshd[661701]: Disconnected from invalid user user1 182.18.139.237 port 50898 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.25
country_id: 2264397
description:
2025-12-16 07:32:17 dovecot_login authenticator failed for (ADMIN) [146.70.59.25]:2825: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.97
country_id: 6252001
description:
Dec 16 07:33:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.97, lip=66.85.158.92, TLS handshaking: Connection closed, session=<mAzRIwhGj3JBMQFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.28
country_id: 130758
description:
2025-12-16 07:34:01 dovecot_plain authenticator failed for (localhost) [62.60.135.28]:32806: 535 Incorrect authentication data (set_id=support@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Dec 16 07:34:04 host2 sshd[662364]: Disconnected from invalid user admin 20.203.42.204 port 57752 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.94
country_id: 6252001
description:
Dec 16 07:34:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.94, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Qrb/JAhGSmZBMQFe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-16 07:34:42 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:36746: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 182.18.139.237
country_id: 1269750
description:
Dec 16 07:35:28 host2 sshd[663532]: Received disconnect from 182.18.139.237 port 49444:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Dec 16 07:36:35 host2 sshd[664805]: Disconnected from invalid user user1 20.203.42.204 port 45048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 16 07:36:48 host2 sshd[664998]: Disconnected from invalid user deploy 158.178.141.16 port 65386 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.203.42.204
country_id: 290557
description:
Dec 16 07:37:13 host2 sshd[665301]: Disconnected from invalid user marco 20.203.42.204 port 49826 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-16 07:37:17 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:58282: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 16 07:37:32 host2 sshd[665549]: Disconnected from invalid user centos 158.178.141.16 port 29406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 16 07:38:14 host2 sshd[666084]: Disconnected from invalid user user1 158.178.141.16 port 48830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 07:39:45 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (oxillobile) [87.103.126.54]:3359: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-16 07:39:49 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (unlizeele) [85.225.19.144]:48055: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-16 07:39:54 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:48048: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 16 07:40:30 host2 sshd[668161]: Disconnected from invalid user admin 158.178.141.16 port 33996 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Dec 16 07:41:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<jjloPQhGbrkDU5En>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-12-16 07:42:04 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:65007: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.153
country_id: 6252001
description:
2025-12-16 07:42:13 dovecot_login authenticator failed for ([98.185.120.153]) [98.185.120.153]:38630: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 16 07:43:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<XBewRwhGdtcs3lFz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-12-16 07:43:31 dovecot_login authenticator failed for ([186.238.247.238]) [186.238.247.238]:34162: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.216.146
country_id: 357994
description:
2025-12-16 07:43:41 dovecot_plain authenticator failed for (rataudow) [196.219.216.146]:36268: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.168
country_id: 3996063
description:
2025-12-16 07:43:48 dovecot_login authenticator failed for ([177.236.146.168]) [177.236.146.168]:34955: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.222
country_id: 6252001
description:
2025-12-16 07:45:28 dovecot_login authenticator failed for (ADMIN) [173.244.56.222]:49024: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-16 07:47:37 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:65269: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-16 07:47:49 dovecot_login authenticator failed for (187.161.198.68-clientes-izzi.mx) [187.161.198.68]:53734: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-16 07:47:55 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:36135: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-12-16 07:48:08 dovecot_login authenticator failed for ([82.102.165.200]) [82.102.165.200]:49608: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 07:50:13 host2 sshd[674415]: Disconnected from invalid user ayla 62.60.131.157 port 39044 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.246
country_id: 6252001
description:
Dec 16 07:51:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.246, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5+hqYQhGI6fDuEz2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.35
country_id: 6252001
description:
Dec 16 07:51:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.35, lip=66.85.158.92, TLS: Connection closed, session=<wtIZYghGycXDuEwj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.247
country_id: 6252001
description:
Dec 16 07:51:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=195.184.76.247, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<RTumYghGBYDDuEz3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.33
country_id: 6252001
description:
Dec 16 07:51:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.33, lip=66.85.158.92, TLS: Connection closed, session=<OS/VYghGAc7DuEwh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.193.169
country_id: 290557
description:
2025-12-16 07:52:52 dovecot_login authenticator failed for (ADMIN) [217.138.193.169]:20507: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 62.60.131.52
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Local Port]=[110] [Remote IP Address]=[62.60.131.52] [Remote Port]=[35634] [Authentication Database]=[mail] [Username]=[admin@anandaobauae.org] (10/10 failures) (blocked until [Wed Dec 17 02:24:30 2025 UTC/Wed Dec 17 07:54:30 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 07:54:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<vVxwbQhGMos+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 07:56:53 host2 sshd[678935]: Disconnected from invalid user ayla 62.60.131.157 port 49823 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2025-12-16 07:57:43 dovecot_login authenticator failed for ([84.213.189.178]) [84.213.189.178]:50436: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.61
country_id: 1733045
description:
2025-12-16 07:58:25 dovecot_login authenticator failed for ([49.124.151.61]) [49.124.151.61]:58988: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-16 08:00:48 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (ducianick) [24.98.45.238]:60188: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.103
country_id: 130758
description:
2025-12-16 08:00:49 dovecot_plain authenticator failed for (localhost) [62.60.135.103]:44206: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.188.156
country_id: 99237
description:
2025-12-16 08:00:54 dovecot_plain authenticator failed for (coune) [65.20.188.156]:35039: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 16 08:01:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<xk6yhAhGFsA+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 08:01:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<lalGhQhGlLg+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.238
country_id: 3017382
description:
Dec 16 08:04:14 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.238, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vHw/kAhGA41b51nu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.146
country_id: 3017382
description:
Dec 16 08:04:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.146, lip=66.85.158.92, TLS: Connection closed, session=<NoblkAhGT+db51mS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-16 08:04:26 dovecot_login authenticator failed for ([84.214.98.168]) [84.214.98.168]:46667: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.235
country_id: 3017382
description:
Dec 16 08:04:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.235, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<V964kQhGa65b51nr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.221.254.250
country_id: 783754
description:
2025-12-16 08:04:42 dovecot_login authenticator failed for ([185.221.254.250]) [185.221.254.250]:44032: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-16 08:08:56 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:48958: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-16 08:09:04 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:49502: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.52
country_id: 732800
description:
2025-12-16 08:09:06 dovecot_login authenticator failed for (ADMIN) [94.156.14.52]:47212: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-16 08:09:11 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:49510: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 16 08:10:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<tIuqpghGmMI+PIdq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 16 08:10:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<2qG/pghGqN+LonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.123
country_id: 3703430
description:
2025-12-16 08:11:28 dovecot_login authenticator failed for (ADMIN) [91.90.126.123]:33570: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
country_id: 3017382
description:
2025-12-16 08:11:58 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (movess) [90.0.156.128]:55462: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 08:15:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<cIg6uAhGhqY+PIMp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.138.29
country_id: 2921044
description:
Dec 16 08:15:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=164.92.138.29, lip=66.85.158.92, TLS, session=<MdSuuQhGAiCkXIod>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.138.29
country_id: 2921044
description:
Dec 16 08:16:08 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=164.92.138.29, lip=66.85.158.92, session=<fN/SughGPPKkXIod>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-16 08:16:45 dovecot_plain authenticator failed for (busly) [65.20.149.93]:49352: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-16 08:16:49 dovecot_plain authenticator failed for (aglate) [102.53.15.56]:52112: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 08:17:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<kEBVvwhG5sk+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 08:18:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<zLWDwQhGuKI+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-16 08:18:19 dovecot_login authenticator failed for ([84.211.24.143]) [84.211.24.143]:58224: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.94
country_id: 130758
description:
2025-12-16 08:20:14 dovecot_plain authenticator failed for (localhost) [62.60.135.94]:56372: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.36
country_id: 6252001
description:
Dec 16 08:20:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.36, lip=66.85.158.91, TLS, session=<s3zFywhGyPHG6xgk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 08:21:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<tje8zAhGqoM+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.14
country_id: 1269750
description:
2025-12-16 08:24:55 dovecot_login authenticator failed for ([152.52.229.14]) [152.52.229.14]:48554: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.12
country_id: 1733045
description:
2025-12-16 08:25:17 dovecot_login authenticator failed for ([49.124.151.12]) [49.124.151.12]:40332: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.144
country_id: 1562822
description:
2025-12-16 08:28:53 dovecot_login authenticator failed for (ADMIN) [173.239.247.144]:25876: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.133.172.9
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.133.172.9 - dragon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-16 08:28:46 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (gante) [24.15.216.41]:60520: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.21
country_id: 6252001
description:
Dec 16 08:29:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.21, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0FUq6ghGvsSTuYQV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-12-16 08:29:30 dovecot_plain authenticator failed for (slitan) [2.55.122.202]:45071: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 08:32:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<2hiF9ghG+rc+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-16 08:33:14 dovecot_plain authenticator failed for (hunly) [65.20.205.197]:40939: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
country_id: 294640
description:
2025-12-16 08:34:33 dovecot_plain authenticator failed for (drapicus) [195.133.156.133]:47038: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.118
country_id: 2661886
description:
2025-12-16 08:34:52 dovecot_login authenticator failed for (ADMIN) [212.112.19.118]:62509: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-16 08:36:27 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:34024: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-16 08:37:21 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:50042: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.41
country_id: 130758
description:
2025-12-16 08:37:49 dovecot_plain authenticator failed for (localhost) [62.60.131.41]:51590: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-16 08:37:53 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:48772: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.64
country_id: 3865483
description:
Dec 16 08:37:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=179.0.249.64, lip=66.85.158.91, TLS, session=<DJFoBwlGS8CzAPlA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 160.226.132.56
country_id: 953987
description:
Dec 16 08:38:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=160.226.132.56, lip=66.85.158.91, TLS, session=<M1/uBwlGStKg4oQ4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.144.70
country_id: 690791
description:
Dec 16 08:38:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.144.70, lip=66.85.158.91, TLS, session=<ttbJCAlGG4ol3ZBG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-12-16 08:38:21 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:34942: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.40.72
country_id: 3469034
description:
Dec 16 08:38:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=191.53.40.72, lip=66.85.158.91, TLS, session=<cUYuCQlGXdK/NShI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.126
country_id: 690791
description:
Dec 16 08:39:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.17.124.126, lip=66.85.158.91, TLS, session=<iEOoDglG28G5EXx+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.227.226.66
country_id: 3057568
description:
Dec 16 08:40:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=91.227.226.66, lip=66.85.158.91, TLS, session=<Ts29DwlGgs9b4+JC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 08:41:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<ATg2FglGypM+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.154.204.131
country_id: 2510769
description:
Dec 16 08:42:01 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.154.204.131, lip=66.85.158.91, TLS, session=<N5pzFglGIa+5msyD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-16 08:42:17 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:60998: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.208
country_id: 3865483
description:
Dec 16 08:42:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=179.0.252.208, lip=66.85.158.91, TLS, session=<R7ydFwlGRduzAPzQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 16 08:43:06 host2 sshd[712754]: Disconnected from invalid user user 2.57.121.25 port 7889 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.123.117
country_id: 6252001
description:
2025-12-16 08:44:04 dovecot_login authenticator failed for (ADMIN) [151.241.123.117]:33814: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-12-16 08:45:03 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:56770: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-16 08:44:31 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:42396: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.186.16
country_id: 3996063
description:
2025-12-16 08:45:51 dovecot_login authenticator failed for (187.161.186.16-clientes-izzi.mx) [187.161.186.16]:33226: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.236.119
country_id: 6252001
description:
Dec 16 08:47:32 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=66.240.236.119, lip=66.85.158.91, session=<irAlKwlG8OlC8Ox3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2025-12-16 08:48:29 dovecot_login authenticator failed for ([27.123.114.130]) [27.123.114.130]:56406: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.48
country_id: 3996063
description:
2025-12-16 08:48:13 dovecot_login authenticator failed for ([201.166.222.48]) [201.166.222.48]:51103: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.48
country_id: 6252001
description:
Dec 16 08:49:47 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.48, lip=66.85.158.92, TLS: Connection closed, session=<UpAoMwlG5CenXpIw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.29
country_id: 1733045
description:
2025-12-16 08:50:48 dovecot_login authenticator failed for ([49.124.153.29]) [49.124.153.29]:60336: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-16 08:51:12 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:54044: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-16 08:54:03 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:57578: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-16 08:54:10 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:36158: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-16 08:55:35 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:42544: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.104
country_id: 130758
description:
2025-12-16 08:58:30 dovecot_plain authenticator failed for (localhost) [62.60.135.104]:33006: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.23
country_id: 798549
description:
2025-12-16 08:58:34 dovecot_login authenticator failed for (ADMIN) [143.244.54.23]:33463: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.52
country_id: 130758
description:
2025-12-16 08:59:53 dovecot_plain authenticator failed for (localhost) [62.60.131.52]:43850: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.62
country_id: 2635167
description:
2025-12-16 09:00:02 dovecot_login authenticator failed for (ADMIN) [98.159.234.62]:31731: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 09:01:28 host2 sshd[727532]: Disconnected from invalid user bridgette 62.60.131.157 port 58889 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 16 09:01:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.125, lip=66.85.158.91, TLS: Connection closed, session=<++RjXglGqo9ChJl9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 09:02:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<1UAvYAlGPNk+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 09:03:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<6u6sYglGWI0+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.208
country_id: 6252001
description:
Dec 16 09:03:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.208, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<H3jcZQlGD8XG6xjQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-16 09:04:09 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:38760: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.201
country_id: 6252001
description:
Dec 16 09:04:48 host2 pure-ftpd[729908]: (?@205.210.31.201) [INFO] New connection from 205.210.31.201


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 62.60.135.106
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[62.60.135.106] [Authentication Database]=[mail] [Username]=[admin@ceylondigest.com] (10/10 failures) (blocked until [Wed Dec 17 03:34:07 2025 UTC/Wed Dec 17 09:04:07 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-16 09:04:16 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:46786: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 09:05:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<J+3YawlGwNo+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 16 09:08:08 host2 sshd[732445]: Disconnected from invalid user deployuser 85.206.171.113 port 36938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-16 09:08:38 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:46822: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-16 09:08:54 dovecot_login authenticator failed for ([27.123.102.122]) [27.123.102.122]:41084: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.51.186
country_id: 1269750
description:
2025-12-16 09:08:56 dovecot_login authenticator failed for (static.bb.ill.59.92.51.186.bsnl.in) [59.92.51.186]:53184: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-16 09:09:43 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:58246: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 09:09:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<GzRBewlGTJA+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-16 09:10:23 dovecot_plain authenticator failed for (pastrebers) [46.10.210.68]:47544: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.103
country_id: 130758
description:
2025-12-16 09:10:29 dovecot_plain authenticator failed for (localhost) [62.60.135.103]:42546: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.226.163
country_id: 3144096
description:
2025-12-16 09:11:58 dovecot_login authenticator failed for ([178.232.226.163]) [178.232.226.163]:53584: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-12-16 09:11:18 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:53390: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 16 09:13:36 host2 sshd[736711]: Disconnected from invalid user surya 85.206.171.113 port 38002 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-16 09:14:54 dovecot_plain authenticator failed for (caleent) [65.20.143.159]:60805: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.206.171.113
country_id: 597427
description:
Dec 16 09:15:19 host2 sshd[737980]: Disconnected from invalid user carlos 85.206.171.113 port 43430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.28
country_id: 130758
description:
2025-12-16 09:16:25 dovecot_plain authenticator failed for (localhost) [62.60.135.28]:41626: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-16 09:17:16 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:38300: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.203.26
country_id: 2077456
description:
2025-12-16 09:17:49 dovecot_login authenticator failed for (ADMIN) [173.239.203.26]:6287: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 85.206.171.113
country_id: 597427
description:
Dec 16 09:17:57 host2 sshd[739500]: Received disconnect from 85.206.171.113 port 49822:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.27
country_id: 6252001
description:
Dec 16 09:19:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.149.27, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<EV3/mwlGbMai2JUb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.27
country_id: 6252001
description:
Dec 16 09:19:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=162.216.149.27, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LXkhnwlGKuOi2JUb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-16 09:19:58 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:39046: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.54.110
country_id: 6252001
description:
2025-12-16 09:21:56 dovecot_login authenticator failed for (ADMIN) [212.56.54.110]:65398: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-16 09:22:27 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:47038: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-16 09:25:08 dovecot_login authenticator failed for (t9NpWUH4) [178.16.54.97]:64014: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-16 09:24:25 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:55897: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.254.2
country_id: 6252001
description:
Dec 16 09:24:32 host2 sshd[743578]: Disconnected from invalid user splunk 165.154.254.2 port 36990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-16 09:24:40 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:35152: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-16 09:25:32 dovecot_login authenticator failed for (miQzOt) [178.16.54.97]:64441: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.254.2
country_id: 6252001
description:
Dec 16 09:26:17 host2 sshd[745032]: Disconnected from invalid user test1 165.154.254.2 port 25772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.97
country_id: 2750405
description:
2025-12-16 09:26:20 dovecot_login authenticator failed for (CpBhPO) [178.16.54.97]:55652: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.111.178.165
country_id: 2589581
description:
Dec 16 09:28:06 host2 sshd[746020]: Disconnected from invalid user lh 41.111.178.165 port 50774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.178.165
country_id: 2589581
description:
Dec 16 09:27:33 host2 sshd[745687]: Disconnected from invalid user web 41.111.178.165 port 42332 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.27
country_id: 6252001
description:
Dec 16 09:28:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.27, lip=66.85.158.91, TLS, session=<KVHIvAlGXuOi2JUb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.4
country_id: 1643084
description:
Dec 16 09:29:33 host2 sshd[746792]: Disconnected from invalid user test1 103.172.204.4 port 58232 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.4
country_id: 1643084
description:
Dec 16 09:31:11 host2 sshd[748050]: Disconnected from invalid user sina 103.172.204.4 port 57406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-16 09:31:56 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:51892: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-12-16 09:32:07 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:45374: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 09:32:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<lXlwzAlGJsc+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.190
country_id: 3175395
description:
Dec 16 09:32:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=185.208.106.190, lip=66.85.158.91, TLS, session=<RTxQzAlGx4K50Gq+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-16 09:33:05 dovecot_plain authenticator failed for (jemolize) [64.72.74.162]:49544: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.168.146
country_id: 3175395
description:
Dec 16 09:33:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.15.168.146, lip=66.85.158.91, TLS, session=<77JkzQlG77m5D6iS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.247.54.89
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.247.54.89 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.207.229.216
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 223.207.229.216 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.25.109.58
country_id: 3439705
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 179.25.109.58 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.159.159.175
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 105.159.159.175 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.152.237.165
country_id: 3658394
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.152.237.165 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.67.156.127
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.67.156.127 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.82.23.197
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 191.82.23.197 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.36.63
country_id: 6251999
description:
2025-12-16 09:36:09 dovecot_login authenticator failed for (ADMIN) [191.96.36.63]:2154: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 09:38:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<f7sa4AlGrKI+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 16 09:40:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<dY7J5glG+qE+PIcq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.47
country_id: 1819730
description:
Dec 16 09:40:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.47, lip=66.85.158.91, TLS, session=<JfQM6AlGDLQtjpov>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 09:41:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<7nAE7AlGfNs+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.187
country_id: 2635167
description:
2025-12-16 09:44:20 dovecot_login authenticator failed for (ADMIN) [98.159.234.187]:48839: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 09:44:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<urf+9glGTtM+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-16 09:44:54 dovecot_plain authenticator failed for (mersity) [65.20.149.93]:38696: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.103
country_id: 130758
description:
2025-12-16 09:45:11 dovecot_plain authenticator failed for (localhost) [62.60.135.103]:43366: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-16 09:46:42 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (sibled) [73.183.74.177]:37084: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 09:49:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<x+hMCgpGtMY+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-16 09:49:31 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:41461: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.172
country_id: 2635167
description:
2025-12-16 09:49:39 dovecot_login authenticator failed for (ADMIN) [98.159.234.172]:28501: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 09:49:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<2OQ/CQpGONQ+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-16 09:49:41 dovecot_login authenticator failed for (cm-178.232.194.231.get.no) [178.232.194.231]:53181: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-16 09:51:39 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:50288: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-16 09:51:41 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:60028: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-16 09:51:50 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:55509: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-12-16 09:51:28 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:46810: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.49
country_id: 1819730
description:
Dec 16 09:53:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.49, lip=66.85.158.92, TLS, session=<YjqdFwpG6o0tjpox>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.131.97.171
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.131.97.171 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.161.116.97
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 88.161.116.97 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 123.58.209.39
country_id: 1819730
description:
Dec 16 09:53:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=123.58.209.39, lip=66.85.158.92, TLS, session=<0EQHGApGgut7OtEn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.246.147.138
country_id: 690791
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 193.246.147.138 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.174.21.219
country_id: 298795
description:
2025-12-16 09:53:44 dovecot_plain authenticator failed for (bakitte) [185.174.21.219]:58374: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-16 09:53:48 dovecot_plain authenticator failed for (chicyntats) [65.20.250.163]:51931: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.169.49.220
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.169.49.220 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.221.216.181
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 177.221.216.181 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.173.112.54
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.173.112.54 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.160.133.121
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.160.133.121 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-16 09:54:50 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (isiandae) [73.230.86.50]:34496: 535 Incorrect authentication data (set_id=ksoft@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 09:59:04 host2 sshd[766914]: Disconnected from invalid user elyssa 62.60.131.157 port 8660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.94
country_id: 130758
description:
2025-12-16 10:03:54 dovecot_plain authenticator failed for (localhost) [62.60.135.94]:55402: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.101.224.61
country_id: 1605651
description:
2025-12-16 10:03:18 dovecot_login authenticator failed for cm-171-101-224-61.revip11.asianet.co.th [171.101.224.61]:52340: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 70.184.117.114
country_id: 6252001
description:
Dec 16 10:05:02 host2 sshd[770740]: Disconnecting invalid user admin 70.184.117.114 port 40332: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.103.253.48
country_id: 1820814
description:
2025-12-16 10:04:09 dovecot_login authenticator failed for (48-253.adsl.static.espeed.com.bn) [118.103.253.48]:60955: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 70.184.117.114
country_id: 6252001
description:
Dec 16 10:04:58 host2 sshd[770555]: Disconnecting authenticating user root 70.184.117.114 port 40264: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 70.184.117.114
country_id: 6252001
description:
Dec 16 10:04:58 host2 sshd[770555]: error: maximum authentication attempts exceeded for root from 70.184.117.114 port 40264 ssh2 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 10:05:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<yuOOQQpGFq8+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.50.212.137
country_id: 6252001
description:
2025-12-16 10:07:01 dovecot_login authenticator failed for (ADMIN) [149.50.212.137]:61578: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 10:07:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<S29xSQpGOuw+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.142
country_id: 6252001
description:
Dec 16 10:08:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.142, lip=66.85.158.91, TLS handshaking: Connection closed, session=<94njTQpGIHdChJmO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 10:10:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<kua+UwpGfLs+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-12-16 10:11:42 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:51568: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-16 10:11:53 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:37273: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-16 10:14:29 dovecot_plain authenticator failed for (kinted) [65.20.174.63]:58421: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 10:16:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<WOKjZwpGguk+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 10:16:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<xbghaQpGWLw+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-16 10:19:12 dovecot_login authenticator failed for (nsg-corporate-199.152.185.122.airtel.in) [182.95.178.158]:36542: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-16 10:19:13 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:58278: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-16 10:19:20 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:43236: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-12-16 10:19:25 dovecot_login authenticator failed for (186.235.248.73.girardi-rs.com.br) [186.235.248.73]:44048: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-16 10:19:40 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:54860: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-16 10:19:54 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:59998: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-16 10:20:08 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:40780: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.41
country_id: 130758
description:
2025-12-16 10:20:30 dovecot_plain authenticator failed for (localhost) [62.60.131.41]:44642: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-16 10:20:32 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (wagatize) [67.173.58.47]:45248: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.21
country_id: 2264397
description:
2025-12-16 10:24:16 dovecot_login authenticator failed for (ADMIN) [146.70.59.21]:20498: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-16 10:24:44 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:49251: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.38
country_id: 130758
description:
2025-12-16 10:24:49 dovecot_plain authenticator failed for (localhost) [62.60.135.38]:59634: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-12-16 10:25:04 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:34149: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.19.134.66
country_id: 3469034
description:
[2025-12-16 10:26:02 +0530] info [cpaneld] 187.19.134.66 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.57.33.22
country_id: 1269750
description:
[2025-12-16 10:26:04 +0530] info [cpaneld] 27.57.33.22 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-16 10:25:50 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63113: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 10:25:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<fHyKigpG3os+PIcl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.184.109.194
country_id: 1733045
description:
[2025-12-16 10:25:51 +0530] info [cpaneld] 202.184.109.194 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.242.115.151
country_id: 617790
description:
[2025-12-16 10:25:52 +0530] info [cpaneld] 91.242.115.151 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.181.89.191
country_id: 3469034
description:
[2025-12-16 10:25:58 +0530] info [whostmgrd] 187.181.89.191 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.103.250
country_id: 1733045
description:
[2025-12-16 10:26:00 +0530] info [cpaneld] 175.144.103.250 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.222.238.201
country_id: 3469034
description:
[2025-12-16 10:25:56 +0530] info [cpaneld] 179.222.238.201 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 160.226.132.2
country_id: 953987
description:
Dec 16 10:26:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=160.226.132.2, lip=66.85.158.91, TLS, session=<RwSejQpGAYig4oQC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.240.44.196
country_id: 798544
description:
Dec 16 10:27:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.240.44.196, lip=66.85.158.91, TLS, session=<gZHYjgpGub1b8CzE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Dec 16 10:28:17 host2 sshd[792694]: Disconnected from invalid user steven 146.190.154.85 port 57888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-16 10:28:19 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:37438: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 10:28:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<f8uNkwpGLqg+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 16 10:28:20 host2 sshd[792756]: Disconnected from invalid user admin 103.144.247.233 port 33028 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 16 10:28:39 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, session=<i7K6lApGst826lCA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 10:30:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<yhzomQpG8I4+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.44.190.194
country_id: 3625428
description:
Dec 16 10:30:11 host2 sshd[794661]: Disconnected from invalid user ubuntu 200.44.190.194 port 43526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.59.187
country_id: 290557
description:
Dec 16 10:30:49 host2 sshd[795502]: Disconnected from invalid user newusername 20.203.59.187 port 43684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 10:30:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<oNrQnApGkrA+PIce>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 16 10:31:52 host2 sshd[796464]: Disconnected from invalid user raj 103.144.247.233 port 38648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Dec 16 10:34:03 host2 sshd[798624]: Disconnected from invalid user admin 152.200.217.230 port 46632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Dec 16 10:33:26 host2 sshd[798002]: Disconnected from invalid user user 146.190.154.85 port 39988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 16 10:33:53 host2 sshd[798407]: Disconnected from invalid user tomcat 103.144.247.233 port 59736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 16 10:34:46 host2 sshd[799143]: Disconnected from invalid user admin 103.193.176.131 port 36612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Dec 16 10:34:37 host2 sshd[799040]: Disconnected from invalid user openproject 152.200.217.230 port 52687 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 16 10:34:53 host2 sshd[799255]: Received disconnect from 103.144.247.233 port 56164:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.0.4
country_id: 3469034
description:
Dec 16 10:34:15 host2 sshd[798770]: Disconnected from invalid user ubuntu 170.80.0.4 port 34452 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.154.85
country_id: 6252001
description:
Dec 16 10:34:28 host2 sshd[798938]: Disconnected from invalid user raj 146.190.154.85 port 59200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.217.230
country_id: 3686110
description:
Dec 16 10:35:46 host2 sshd[800216]: Disconnected from invalid user nokia 152.200.217.230 port 36568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.44.190.194
country_id: 3625428
description:
Dec 16 10:35:58 host2 sshd[800471]: Disconnected from invalid user mm 200.44.190.194 port 46872 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 10:36:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<i2HjrwpGTLI+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.31
country_id: 130758
description:
2025-12-16 10:36:41 dovecot_plain authenticator failed for (localhost) [62.60.135.31]:33678: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 16 10:36:40 host2 sshd[800919]: Disconnected from invalid user ubuntu 103.193.176.131 port 36780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-16 10:36:38 dovecot_login authenticator failed for ([84.210.192.240]) [84.210.192.240]:48072: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.0.4
country_id: 3469034
description:
Dec 16 10:36:44 host2 sshd[800980]: Disconnected from invalid user teamspeak 170.80.0.4 port 59103 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.44.190.194
country_id: 3625428
description:
Dec 16 10:36:34 host2 sshd[800879]: Disconnected from invalid user newusername 200.44.190.194 port 50432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.193.176.131
country_id: 1643084
description:
Dec 16 10:37:15 host2 sshd[801316]: Disconnected from invalid user michael 103.193.176.131 port 36832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.0.4
country_id: 3469034
description:
Dec 16 10:38:03 host2 sshd[801809]: Disconnected from invalid user xue 170.80.0.4 port 43196 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-16 10:38:01 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (exisgus) [24.91.103.202]:46672: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.80.0.4
country_id: 3469034
description:
Dec 16 10:38:42 host2 sshd[802165]: Disconnected from invalid user ec2-user 170.80.0.4 port 49358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.44.190.194
country_id: 3625428
description:
Dec 16 10:38:19 host2 sshd[801967]: Disconnected from invalid user robin 200.44.190.194 port 49952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.8
country_id: 3625428
description:
2025-12-16 10:38:38 dovecot_login authenticator failed for (ADMIN) [95.181.237.8]:41218: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.40
country_id: 130758
description:
2025-12-16 10:38:23 dovecot_plain authenticator failed for (localhost) [62.60.135.40]:60436: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.77.5.202
country_id: 3277605
description:
[2025-12-16 10:39:31 +0530] info [cpaneld] 178.77.5.202 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.0.4
country_id: 3469034
description:
Dec 16 10:39:17 host2 sshd[802570]: Disconnected from invalid user user 170.80.0.4 port 55521 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-12-16 10:39:29 dovecot_login authenticator failed for ([118.26.153.84]) [118.26.153.84]:43634: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.114.113.88
country_id: 3865483
description:
[2025-12-16 10:39:29 +0530] info [cpaneld] 190.114.113.88 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.246.38
country_id: 3865483
description:
[2025-12-16 10:39:33 +0530] info [cpaneld] 45.181.246.38 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.107.217.140
country_id: 290557
description:
[2025-12-16 10:39:42 +0530] info [whostmgrd] 5.107.217.140 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.246.148.169
country_id: 3865483
description:
[2025-12-16 10:39:44 +0530] info [cpaneld] 190.246.148.169 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.68.232
country_id: 1282988
description:
[2025-12-16 10:39:46 +0530] info [cpaneld] 27.34.68.232 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 167.99.122.86
country_id: 6252001
description:
Dec 16 10:39:46 host2 sshd[803022]: Received disconnect from 167.99.122.86 port 51160:11: Bye Bye [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.222.56.20
country_id: 3625428
description:
[2025-12-16 10:39:49 +0530] info [cpaneld] 38.222.56.20 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-16 10:41:23 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (chfuely) [74.218.95.154]:55468: 535 Incorrect authentication data (set_id=ksoft@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-16 10:41:41 dovecot_login authenticator failed for ([62.97.163.72]) [62.97.163.72]:33724: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 10:41:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<4qonxApGZII+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.104
country_id: 130758
description:
2025-12-16 10:42:09 dovecot_plain authenticator failed for (localhost) [62.60.135.104]:40240: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.52
country_id: 130758
description:
2025-12-16 10:42:41 dovecot_plain authenticator failed for (localhost) [62.60.131.52]:43168: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.175
country_id: 1269750
description:
2025-12-16 10:42:41 dovecot_login authenticator failed for (nsg-corporate-175.229.187.122.airtel.in) [122.187.229.175]:33425: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-12-16 10:42:14 dovecot_login authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:54555: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.104
country_id: 130758
description:
2025-12-16 10:42:17 dovecot_plain authenticator failed for (localhost) [62.60.135.104]:56486: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.108.174.12
country_id: 1269750
description:
2025-12-16 10:44:07 dovecot_login authenticator failed for (ADMIN) [103.108.174.12]:13617: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 10:44:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<UYFTzQpGyo4+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Dec 16 10:46:21 host2 sshd[808195]: Disconnected from invalid user amin 124.155.125.131 port 55316 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.106
country_id: 130758
description:
2025-12-16 10:47:54 dovecot_plain authenticator failed for (localhost) [62.60.135.106]:49030: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 16 10:49:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<a9YK3wpGfNQ+PIdn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 10:49:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<ugKb3wpGStk+PIdp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.155.125.131
country_id: 1861060
description:
Dec 16 10:50:51 host2 sshd[810937]: Disconnected from invalid user csserver 124.155.125.131 port 59402 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 10:50:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<HnUB5ApGIL0+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.108.112
country_id: 798544
description:
Dec 16 10:52:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=85.202.108.112, lip=66.85.158.91, TLS, session=<oafu5wpG3ZRVymxw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 10:51:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<mmue5wpG+oM+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.159.82
country_id: 690791
description:
Dec 16 10:51:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=37.221.159.82, lip=66.85.158.91, TLS, session=<ddLZ5gpG1aEl3Z9S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.69.66
country_id: 1269750
description:
Dec 16 10:52:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<designdpt>, method=PLAIN, rip=103.56.69.66, lip=66.85.158.91, TLS, session=</R9K6gpGhbZnOEVC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.104.107
country_id: 3175395
description:
Dec 16 10:52:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=185.208.104.107, lip=66.85.158.91, TLS, session=<f9sl6QpGt4i50Ghr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 16 10:53:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS, session=<ow2N7gpGCqu58uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.103
country_id: 130758
description:
2025-12-16 10:54:39 dovecot_plain authenticator failed for (localhost) [62.60.135.103]:44676: 535 Incorrect authentication data (set_id=admin@essenceceylontea.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 10:55:33 host2 sshd[814455]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-16 10:56:27 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (unpens) [69.142.126.37]:42526: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.28
country_id: 130758
description:
2025-12-16 10:58:55 dovecot_plain authenticator failed for (localhost) [62.60.135.28]:40390: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.223
country_id: 3469034
description:
Dec 16 10:59:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.44.96.223, lip=66.85.158.91, TLS, session=<P49fAgtGT46xLGDf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.91
country_id: 798544
description:
Dec 16 10:59:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=178.216.29.91, lip=66.85.158.91, TLS, session=<hcOGAwtGM6ay2B1b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.226.113.255
country_id: 3057568
description:
Dec 16 11:00:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=91.226.113.255, lip=66.85.158.91, TLS, session=<F4k6BAtG/6Fb4nH/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.47.136.76
country_id: 3175395
description:
Dec 16 10:59:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.47.136.76, lip=66.85.158.91, TLS, session=<ontSAgtGAca5L4hM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.29
country_id: 130758
description:
2025-12-16 10:59:40 dovecot_plain authenticator failed for (localhost) [62.60.135.29]:36460: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.239.246
country_id: 798544
description:
Dec 16 10:59:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=109.125.239.246, lip=66.85.158.91, TLS, session=<ZtThAgtGxqdtfe/2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.231.91.71
country_id: 3469034
description:
Dec 16 11:00:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=45.231.91.71, lip=66.85.158.91, TLS, session=<MlrEAwtGFYYt51tH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.81
country_id: 3865483
description:
Dec 16 10:59:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.250.81, lip=66.85.158.91, TLS, session=<Tv1VAgtGr5mzAPpR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec 16 11:00:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS, session=<eTS4BQtGLMK58uIh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.31
country_id: 3469034
description:
Dec 16 11:00:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=177.8.251.31, lip=66.85.158.91, TLS, session=<ti60BAtGHO2xCPsf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-16 11:00:19 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:44156: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.78
country_id: 1269750
description:
2025-12-16 11:00:32 dovecot_login authenticator failed for (nsg-corporate-78.225.187.122.airtel.in) [122.187.225.78]:37875: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.197.71
country_id: 6251999
description:
2025-12-16 11:01:04 dovecot_login authenticator failed for (ADMIN) [179.61.197.71]:16599: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-16 11:02:02 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (nocomipht) [71.235.225.181]:44918: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 11:03:05 host2 sshd[819217]: Disconnected from invalid user hillary 62.60.131.157 port 11949 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.105
country_id: 3144096
description:
2025-12-16 11:02:40 dovecot_login authenticator failed for (ADMIN) [46.246.122.105]:35728: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.135.37
country_id: 130758
description:
2025-12-16 11:02:52 dovecot_plain authenticator failed for (localhost) [62.60.135.37]:50158: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-16 11:03:00 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (aeacked) [144.64.157.244]:50780: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-16 11:03:33 dovecot_plain authenticator failed for (averagor) [5.11.141.74]:54930: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Dec 16 11:05:03 host2 sshd[820927]: Disconnected from invalid user gaurav 50.232.189.209 port 42198 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-16 11:04:47 dovecot_plain authenticator failed for (troostrans) [65.20.153.146]:39225: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-16 11:04:50 dovecot_plain authenticator failed for (unize) [24.187.213.29]:60316: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 11:06:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<01X3GwtGhKo+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-16 11:06:54 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:54678: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.232.189.209
country_id: 6252001
description:
Dec 16 11:06:18 host2 sshd[822420]: Disconnected from invalid user ftpuser 50.232.189.209 port 41920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 11:07:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<lrgsIQtGCLU+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-16 11:07:17 dovecot_login authenticator failed for 210.0.90.82.static.nexnet.net.au [210.0.90.82]:42700: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.232.189.209
country_id: 6252001
description:
Dec 16 11:08:13 host2 sshd[824753]: Disconnected from invalid user kingbase 50.232.189.209 port 55602 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 87.125.29.1
country_id: 2510769
description:
Dec 16 11:09:46 host2 sshd[826087]: Disconnected from invalid user sk 87.125.29.1 port 39754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 87.125.29.1
country_id: 2510769
description:
Dec 16 11:10:20 host2 sshd[826722]: Disconnected from invalid user admin 87.125.29.1 port 41054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 16 11:10:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<7aboKQtGwNk+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.188
country_id: 3996063
description:
2025-12-16 11:11:33 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:42891: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-16 11:11:48 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (criesceple) [24.23.125.83]:56162: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-12-16 11:11:52 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:53510: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 11:11:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<TNSoLQtGRqk+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 11:11:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<7sO2LQtGXOQ+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 11:13:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<vykwNgtGStA+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.205
country_id: 6252001
description:
Dec 16 11:17:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.149.205, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<FmwJRAtGUcyi2JXN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.205
country_id: 6252001
description:
Dec 16 11:18:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.205, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<iy6WRwtGuPqi2JXN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 11:19:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<D0ZGSwtGnpQ+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.33
country_id: 6252001
description:
2025-12-16 11:21:42 dovecot_login authenticator failed for (ADMIN) [173.244.56.33]:35701: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.194.70.250
country_id: 934292
description:
Dec 16 11:22:24 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.194.70.250, lip=66.85.158.91, session=<3a8AVQtG1NAtwkb6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-16 11:22:40 dovecot_plain authenticator failed for (mogda) [75.97.190.237]:41674: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.194.70.250
country_id: 934292
description:
Dec 16 11:22:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.194.70.250, lip=66.85.158.91, session=<CdntVAtGfs8twkb6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Dec 16 11:24:52 host2 sshd[836226]: Disconnected from invalid user arnaldo 20.123.146.93 port 64685 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.205
country_id: 6252001
description:
Dec 16 11:26:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.149.205, lip=66.85.158.92, TLS, session=<ftWJYgtGKuyi2JXN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.78
country_id: 6252001
description:
Dec 16 11:26:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.78, lip=66.85.158.91, TLS, session=<IS1wZAtG3v/G6xhO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 16 11:28:57 host2 sshd[838697]: Disconnected from invalid user dev 20.123.146.92 port 65481 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-16 11:31:18 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (sedely) [73.197.236.163]:48250: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 11:35:34 host2 sshd[843487]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 16 11:35:32 host2 sshd[843413]: Disconnected from invalid user steam 4.210.186.201 port 7018 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.45
country_id: 3865483
description:
2025-12-16 11:39:09 dovecot_login authenticator failed for (ADMIN) [146.70.38.45]:50420: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Dec 16 11:39:30 host2 sshd[846496]: Disconnected from invalid user jb 20.123.146.95 port 47104 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.62.87.27
country_id: 3469034
description:
Dec 16 11:41:32 host2 sshd[848279]: Disconnected from invalid user jing 187.62.87.27 port 39204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-12-16 11:43:26 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:60425: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.22.204.23
country_id: 1210997
description:
2025-12-16 11:43:39 dovecot_login authenticator failed for ([202.22.204.23]) [202.22.204.23]:36385: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 11:44:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<1ECqogtG9N8+PIcs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.183.74.214
country_id: 1643084
description:
Dec 16 11:45:32 host2 sshd[850884]: Disconnected from invalid user maria 103.183.74.214 port 40780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.183.74.214
country_id: 1643084
description:
Dec 16 11:46:13 host2 sshd[851391]: Disconnected from invalid user proxyuser 103.183.74.214 port 55928 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Dec 16 11:46:46 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.92, session=<DTsfrAtGSIQDWgzA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.229.225.38
country_id: 1269750
description:
Dec 16 11:47:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=43.229.225.38, lip=66.85.158.91, TLS, session=<HulvrgtGnNsr5eEm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 80.82.23.194
country_id: 798544
description:
Dec 16 11:48:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=80.82.23.194, lip=66.85.158.91, TLS, session=<6hqnrwtGlcZQUhfC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Dec 16 11:48:17 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<xg2DsQtGgsssyhQX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.64
country_id: 1880251
description:
Dec 16 11:48:39 host2 sshd[853392]: Disconnected from invalid user behnam 45.78.228.64 port 57168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Dec 16 11:49:34 host2 sshd[853878]: Disconnected from invalid user ec2-user 20.123.146.93 port 49941 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.168
country_id: 798544
description:
Dec 16 11:50:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=178.216.29.168, lip=66.85.158.91, TLS, session=<1D8mugtG6+ay2B2o>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.228.64
country_id: 1880251
description:
Dec 16 11:52:03 host2 sshd[855783]: Disconnected from invalid user jing 45.78.228.64 port 56244 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 79.110.117.214
country_id: 732800
description:
Dec 16 11:51:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts>, method=PLAIN, rip=79.110.117.214, lip=66.85.158.91, TLS, session=<GJA5uwtGIJxPbnXW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2025-12-16 11:53:25 dovecot_login authenticator failed for 27-124-111-122.static.as58511.net [27.124.111.122]:42433: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-12-16 11:53:49 dovecot_login authenticator failed for (182.239.78.124.hk.chinamobile.com) [182.239.78.124]:46486: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 16 11:54:27 host2 sshd[857862]: Disconnected from invalid user user 4.210.186.201 port 59779 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-16 11:56:12 dovecot_login authenticator failed for ([128.185.23.89]) [125.19.160.206]:40304: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 11:56:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<YJQOzgtGYN8+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-12-16 11:56:34 dovecot_login authenticator failed for ([152.52.210.118]) [152.52.210.118]:60080: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.246
country_id: 6252001
description:
2025-12-16 11:56:45 dovecot_login authenticator failed for wsip-184-191-242-246.fv.ks.cox.net [184.191.242.246]:50912: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.108
country_id: 6252001
description:
2025-12-16 11:56:57 dovecot_login authenticator failed for wsip-184-191-250-108.fv.ks.cox.net [184.191.250.108]:52511: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 11:59:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<ytjP1wtGrpM+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.8
country_id: 1227603
description:
2025-12-16 11:59:16 dovecot_login authenticator failed for (ADMIN) [95.181.239.8]:21480: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.63.158
country_id: 3017382
description:
2025-12-16 11:59:35 dovecot_login authenticator failed for (ADMIN) [156.146.63.158]:54075: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 12:00:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<IeKG2wtGprU+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 12:01:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<5ARh4QtGUrA+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 12:04:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ts9h7AtGep4+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 12:04:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<QMIY7QtGYI0+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.207
country_id: 6252001
description:
Dec 16 12:04:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.207, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<t/gy7QtGBNrN0h/P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 12:05:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Bb337gtGqIs+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 12:06:49 host2 sshd[865856]: Disconnected from invalid user kinsey 62.60.131.157 port 16589 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Dec 16 12:09:33 host2 sshd[867518]: Disconnected from invalid user remoto 20.123.146.95 port 23164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Dec 16 12:12:16 host2 sshd[869390]: Disconnected from invalid user karthavya 4.210.186.201 port 34755 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.51.226.101
country_id: 3175395
description:
Dec 16 12:14:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=93.51.226.101, lip=66.85.158.91, TLS, session=<exe2DQxG8IxdM+Jl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.51.226.115
country_id: 3175395
description:
Dec 16 12:14:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=93.51.226.115, lip=66.85.158.91, TLS, session=<krHJDgxGkKpdM+Jz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.220.67
country_id: 6252001
description:
2025-12-16 12:18:28 dovecot_login authenticator failed for (ADMIN) [37.19.220.67]:36772: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 12:19:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<1RgzIQxG5pk+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.228
country_id: 953987
description:
Dec 16 12:22:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=102.64.47.228, lip=66.85.158.91, TLS, session=<12g6KgxGdqFmQC/k>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.134.99.130
country_id: 3057568
description:
Dec 16 12:22:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=31.134.99.130, lip=66.85.158.91, TLS, session=<7e5xKwxG38gfhmOC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Dec 16 12:23:28 host2 pure-ftpd[877355]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.68
country_id: 1668284
description:
2025-12-16 12:23:15 dovecot_login authenticator failed for (ADMIN) [173.244.49.68]:56640: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.146.92
country_id: 2750405
description:
Dec 16 12:26:46 host2 sshd[879786]: Disconnected from invalid user xiao 20.123.146.92 port 15772 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 12:29:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<zCCIQwxGRo8+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 16 12:30:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<ZaHKSAxGJsQ+PIdn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 12:32:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<4+PmTQxG0qE+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 16 12:33:05 host2 sshd[883505]: Disconnected from invalid user share 138.248.168.20 port 50302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 16 12:36:01 host2 sshd[885272]: Disconnected from invalid user arif 138.248.168.20 port 47646 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 16 12:37:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<CiD9YAxGAok+PIdg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.94
country_id: 2750405
description:
Dec 16 12:39:08 host2 sshd[887766]: Disconnected from invalid user tester 20.123.146.94 port 46472 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.31
country_id: 614540
description:
2025-12-16 12:39:15 dovecot_login authenticator failed for (ADMIN) [95.181.236.31]:64131: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 16 12:39:25 host2 sshd[887939]: Disconnected from invalid user cheeki 138.248.168.20 port 61738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 16 12:40:46 host2 sshd[888776]: Disconnected from invalid user esearch 138.248.168.20 port 61738 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.91
country_id: 6252001
description:
Dec 16 12:41:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<D6kLcAxGC9qTuYRb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.90.207.105
country_id: 2750405
description:
Dec 16 12:41:43 host2 sshd[889420]: Disconnected from invalid user jbernal 164.90.207.105 port 41156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Dec 16 12:42:41 host2 sshd[890142]: Disconnected from invalid user master 118.26.39.178 port 51108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.207.105
country_id: 2750405
description:
Dec 16 12:43:52 host2 sshd[890758]: Disconnected from invalid user ubuntu 164.90.207.105 port 59248 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 12:44:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<4mVTeQxGTN8+PIMh>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 164.90.207.105
country_id: 2750405
description:
Dec 16 12:43:21 host2 sshd[890488]: Received disconnect from 164.90.207.105 port 45256:11: Bye Bye [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 12:45:18 host2 sshd[892171]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.230.3
country_id: 1880251
description:
Dec 16 12:45:16 host2 sshd[892035]: Disconnected from invalid user jose 45.78.230.3 port 36238 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.112
country_id: 6252001
description:
Dec 16 12:47:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.112, lip=66.85.158.92, session=<hWN1hQxGPOWTuYRw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.53.180
country_id: 6252001
description:
2025-12-16 12:48:51 dovecot_login authenticator failed for (ADMIN) [212.56.53.180]:44132: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Dec 16 12:49:37 host2 sshd[894708]: Disconnected from invalid user server 103.172.154.255 port 60094 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.154.255
country_id: 1269750
description:
Dec 16 12:50:18 host2 sshd[895243]: Disconnected from invalid user ethan 103.172.154.255 port 42806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 12:50:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<T2JukQxGptY+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.5.133
country_id: 2077456
description:
2025-12-16 12:51:59 dovecot_login authenticator failed for ([101.168.5.133]) [101.168.5.133]:43534: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.34.137
country_id: 6252001
description:
2025-12-16 12:52:12 dovecot_login authenticator failed for ([74.196.34.137]) [74.196.34.137]:58313: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-12-16 12:54:10 dovecot_login authenticator failed for ([125.19.175.152]) [182.78.241.102]:40332: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.63.135
country_id: 3017382
description:
2025-12-16 12:53:42 dovecot_login authenticator failed for (ADMIN) [156.146.63.135]:11993: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Dec 16 12:53:53 host2 sshd[897441]: Disconnected from invalid user ghost 118.26.39.178 port 34198 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.26.39.178
country_id: 1819730
description:
Dec 16 12:54:39 host2 sshd[898218]: Disconnected from invalid user botuser 118.26.39.178 port 59230 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-12-16 12:54:59 dovecot_login authenticator failed for ([203.193.147.41]) [203.193.147.37]:59320: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-16 12:55:05 dovecot_login authenticator failed for ([102.38.3.179]) [102.38.3.179]:51758: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.150
country_id: 1269750
description:
2025-12-16 12:55:19 dovecot_login authenticator failed for (nsg-corporate-150.230.187.122.airtel.in) [122.187.230.150]:43447: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 16 12:58:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<rK4krQxGENnBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.58.35
country_id: 1269750
description:
Dec 16 12:59:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=103.237.58.35, lip=66.85.158.91, TLS, session=<hyJGsAxGn6ln7Toj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.79.19.9
country_id: 953987
description:
Dec 16 13:00:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=41.79.19.9, lip=66.85.158.91, TLS, session=<FU+HsQxGgospTxMJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.217
country_id: 3996063
description:
2025-12-16 13:00:47 dovecot_login authenticator failed for (201.173.92.217-clientes-izzi.mx) [201.173.92.217]:39600: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-16 13:01:01 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:41019: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.200.34.20
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 5.200.34.20: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.200.33.20
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 5.200.33.20: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 37.9.80.236
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 37.9.80.236: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 119.28.22.86
country_id: 1819730
description:
Denial of Service (DoS) attack was discovered from 119.28.22.86: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.200.33.20
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 5.200.33.20: 332 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 59.18.54.71
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 59.18.54.71: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 59.18.54.73
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 59.18.54.73: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 43.159.160.52
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 43.159.160.52: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 197.155.92.21
country_id: 192950
description:
Denial of Service (DoS) attack was discovered from 197.155.92.21: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 88.198.139.2
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 88.198.139.2: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 154.126.203.249
country_id: 953987
description:
Denial of Service (DoS) attack was discovered from 154.126.203.249: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 37.140.169.108
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 37.140.169.108: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 188.135.0.26
country_id: 286963
description:
Denial of Service (DoS) attack was discovered from 188.135.0.26: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 59.18.54.68
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 59.18.54.68: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.238.131.65
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 193.238.131.65: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 220.245.47.2
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 220.245.47.2: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.200.34.20
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 5.200.34.20: 317 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 94.41.80.31
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 94.41.80.31: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 220.245.47.66
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 220.245.47.66: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 59.18.54.70
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 59.18.54.70: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.203.61.22
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 193.203.61.22: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 177.12.163.7
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 177.12.163.7: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 177.12.163.6
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 177.12.163.6: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 59.18.54.72
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 59.18.54.72: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 43.159.160.86
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 43.159.160.86: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 177.12.163.6
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 177.12.163.6: 576 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 213.167.248.9
country_id: 3017382
description:
Denial of Service (DoS) attack was discovered from 213.167.248.9: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 43.159.160.86
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 43.159.160.86: 490 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 43.133.166.202
country_id: 1861060
description:
Denial of Service (DoS) attack was discovered from 43.133.166.202: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.200.34.20
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 5.200.34.20: 2534 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.45.240.187
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 5.45.240.187: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.30.254.100
country_id: 690791
description:
Denial of Service (DoS) attack was discovered from 78.30.254.100: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.68.33.220
country_id: 3608932
description:
Denial of Service (DoS) attack was discovered from 45.68.33.220: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 88.198.139.2
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 88.198.139.2: 398 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 85.114.2.174
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 85.114.2.174: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.239.25.252
country_id: 690791
description:
Denial of Service (DoS) attack was discovered from 193.239.25.252: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.131.0.114
country_id: 719819
description:
Denial of Service (DoS) attack was discovered from 78.131.0.114: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.68.35.205
country_id: 3608932
description:
Denial of Service (DoS) attack was discovered from 45.68.35.205: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 101.33.68.193
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 101.33.68.193: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 37.140.169.108
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 37.140.169.108: 358 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.203.61.22
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 193.203.61.22: 334 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 220.245.47.131
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 220.245.47.131: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.45.240.165
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 5.45.240.165: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 89.163.155.202
country_id: 2921044
description:
Denial of Service (DoS) attack was discovered from 89.163.155.202: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 37.140.164.231
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 37.140.164.231: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 177.12.163.7
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 177.12.163.7: 476 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 119.28.22.86
country_id: 1819730
description:
Denial of Service (DoS) attack was discovered from 119.28.22.86: 395 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 220.245.47.66
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 220.245.47.66: 897 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 72.44.20.27
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 72.44.20.27: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 213.140.228.252
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 213.140.228.252: 250 connections per 30 seconds to 53 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 13:03:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<Xp67vgxGatg+PIdp>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 197.155.92.21
country_id: 192950
description:
Denial of Service (DoS) attack was discovered from 197.155.92.21: 354 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.68.35.203
country_id: 3608932
description:
Denial of Service (DoS) attack was discovered from 45.68.35.203: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 178.235.153.59
country_id: 798544
description:
Denial of Service (DoS) attack was discovered from 178.235.153.59: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 78.131.1.14
country_id: 719819
description:
Denial of Service (DoS) attack was discovered from 78.131.1.14: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.21.230.27
country_id: 286963
description:
Denial of Service (DoS) attack was discovered from 5.21.230.27: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 192.166.144.111
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 192.166.144.111: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.238.131.65
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 193.238.131.65: 546 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 188.135.0.26
country_id: 286963
description:
Denial of Service (DoS) attack was discovered from 188.135.0.26: 361 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 59.18.54.73
country_id: 1835841
description:
Denial of Service (DoS) attack was discovered from 59.18.54.73: 254 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 147.53.137.85
country_id: 3175395
description:
Denial of Service (DoS) attack was discovered from 147.53.137.85: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 213.87.2.106
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 213.87.2.106: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 220.245.47.34
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 220.245.47.34: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 5.200.33.20
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 5.200.33.20: 1712 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 37.140.169.106
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 37.140.169.106: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 210.193.2.65
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 210.193.2.65: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 81.93.64.131
country_id: 3277605
description:
Denial of Service (DoS) attack was discovered from 81.93.64.131: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 37.140.164.216
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 37.140.164.216: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 213.234.192.10
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 213.234.192.10: 250 connections per 30 seconds to 53 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.94.176
country_id: 2750405
description:
Dec 16 13:04:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.94.176, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pqCWwAxGgJZo+F6w>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 95.161.191.46
country_id: 1522867
description:
Denial of Service (DoS) attack was discovered from 95.161.191.46: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 220.245.47.2
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 220.245.47.2: 465 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 43.159.160.52
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 43.159.160.52: 558 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 119.28.65.167
country_id: 1819730
description:
Denial of Service (DoS) attack was discovered from 119.28.65.167: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 85.114.3.250
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 85.114.3.250: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 94.41.80.31
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 94.41.80.31: 671 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 43.135.219.225
country_id: 3469034
description:
Denial of Service (DoS) attack was discovered from 43.135.219.225: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 193.238.131.93
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 193.238.131.93: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 220.245.47.98
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 220.245.47.98: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 154.126.203.249
country_id: 953987
description:
Denial of Service (DoS) attack was discovered from 154.126.203.249: 476 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 220.245.47.130
country_id: 2077456
description:
Denial of Service (DoS) attack was discovered from 220.245.47.130: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 212.56.129.228
country_id: 2562770
description:
Denial of Service (DoS) attack was discovered from 212.56.129.228: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 37.9.80.236
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 37.9.80.236: 361 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 45.68.33.221
country_id: 3608932
description:
Denial of Service (DoS) attack was discovered from 45.68.33.221: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 83.102.180.36
country_id: 2017370
description:
Denial of Service (DoS) attack was discovered from 83.102.180.36: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 178.235.153.38
country_id: 798544
description:
Denial of Service (DoS) attack was discovered from 178.235.153.38: 250 connections per 30 seconds to 53 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 102.89.1.191
country_id: 2328926
description:
Denial of Service (DoS) attack was discovered from 102.89.1.191: 250 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.14.194.128
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.14.194.128 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-12-16 13:05:26 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:54802: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.142.131
country_id: 1819730
description:
2025-12-16 13:05:55 dovecot_login authenticator failed for 14-0-142-131.static.pccw-hkt.com [14.0.142.131]:14317: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-16 13:09:17 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (licrity) [174.169.224.27]:51690: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 13:11:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<uzX+2wxGeKg+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.118.22
country_id: 3469034
description:
Dec 16 13:12:14 host2 sshd[911293]: Disconnected from invalid user ftpusr 186.233.118.22 port 58412 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.225.118.84
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 200.225.118.84 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.235.233.91
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.235.233.91 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.194.170.241
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.194.170.241 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.171.112.135
country_id: 3625428
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.171.112.135 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.57.254.180
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.57.254.180 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.123.24.25
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.123.24.25 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.236.98.73
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 162.236.98.73 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 13:13:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<tUXZ4wxGWoQ+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.106
country_id: 6252001
description:
2025-12-16 13:17:00 dovecot_login authenticator failed for ([98.185.120.106]) [98.185.120.106]:49920: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.194
country_id: 1733045
description:
2025-12-16 13:16:37 dovecot_login authenticator failed for ([49.124.159.194]) [49.124.159.194]:46762: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.190.89.127
country_id: 6252001
description:
Dec 16 13:17:49 host2 sshd[915483]: Disconnected from invalid user satis 172.190.89.127 port 39172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.199
country_id: 3469034
description:
2025-12-16 13:17:53 dovecot_login authenticator failed for (ADMIN) [188.241.177.199]:56544: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.103
country_id: 6252001
description:
Dec 16 13:17:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.103, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<PxNd8QxGJtiH7X5n>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.89.127
country_id: 6252001
description:
Dec 16 13:18:22 host2 sshd[915770]: Disconnected from invalid user zenith 172.190.89.127 port 50232 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 16 13:18:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<7wVF9AxGXqsD7r/l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 16 13:18:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<ee589AxGVJ0+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.175.39
country_id: 6252001
description:
Dec 16 13:19:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.175.39, lip=66.85.158.91, TLS, session=<sTUz+AxGEKsofK8n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-16 13:20:14 dovecot_login authenticator failed for ([27.123.105.234]) [128.185.192.166]:40426: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-12-16 13:20:55 dovecot_login authenticator failed for ([125.19.175.152]) [182.78.241.102]:58510: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.42
country_id: 6252001
description:
2025-12-16 13:21:31 dovecot_login authenticator failed for ([70.174.168.42]) [70.174.168.42]:45505: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.36.4
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.189.36.4 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 13:22:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<oZAxAQ1GmrQ+PIcg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.233.118.22
country_id: 3469034
description:
Dec 16 13:22:16 host2 sshd[918332]: Disconnected from invalid user runner 186.233.118.22 port 55464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.195.83.210
country_id: 1269750
description:
Dec 16 13:23:54 host2 sshd[919619]: Disconnected from invalid user markus 14.195.83.210 port 52998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.51.43.58
country_id: 298795
description:
Dec 16 13:24:55 host2 sshd[920105]: Disconnected from invalid user factura 84.51.43.58 port 42179 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 13:25:16 host2 sshd[920479]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 84.51.43.58
country_id: 298795
description:
Dec 16 13:25:34 host2 sshd[920748]: Disconnected from invalid user manoj 84.51.43.58 port 47176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.6.61.189
country_id: 6252001
description:
2025-12-16 13:26:05 dovecot_plain authenticator failed for 99-6-61-189.lightspeed.livnmi.sbcglobal.net (oeolledium) [99.6.61.189]:44068: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-16 13:26:50 dovecot_plain authenticator failed for (turustlite) [75.97.190.237]:34958: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 13:26:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<51whEg1G+Jk+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 16 13:26:58 host2 sshd[921522]: Disconnected from invalid user steam 200.118.99.170 port 59644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.207.245.72
country_id: 1269750
description:
Dec 16 13:27:05 host2 sshd[921621]: Disconnected from invalid user git 49.207.245.72 port 55056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2025-12-16 13:27:33 dovecot_login authenticator failed for (136-56-34-147.googlefiber.net) [136.56.34.147]:39028: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.113
country_id: 3996063
description:
2025-12-16 13:27:14 dovecot_login authenticator failed for ([201.173.250.113]) [201.173.250.113]:56117: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec 16 13:28:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<zGDbFg1G7pbJqAle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.5.141
country_id: 798544
description:
Dec 16 13:28:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=89.186.5.141, lip=66.85.158.91, TLS, session=<0HX9Fw1GD+xZugWN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 16 13:29:48 host2 sshd[923282]: Disconnected from invalid user postgres 200.118.99.170 port 51780 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-16 13:30:02 dovecot_plain authenticator failed for (subaliter) [176.113.155.132]:55954: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-16 13:30:04 dovecot_login authenticator failed for (dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:58664: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.195.83.210
country_id: 1269750
description:
Dec 16 13:29:11 host2 sshd[922954]: Disconnected from invalid user user 14.195.83.210 port 57311 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.207.245.72
country_id: 1269750
description:
Dec 16 13:29:56 host2 sshd[923335]: Disconnected from invalid user test1 49.207.245.72 port 54041 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Dec 16 13:29:41 host2 sshd[923217]: Disconnected from invalid user dc 107.173.160.152 port 48334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.242.190.187
country_id: 298795
description:
2025-12-16 13:30:46 dovecot_login authenticator failed for ([178.242.190.187]) [178.242.190.187]:36862: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-16 13:31:06 dovecot_login authenticator failed for ([84.210.192.240]) [84.210.192.240]:58914: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.223
country_id: 1643084
description:
Dec 16 13:30:13 host2 sshd[923708]: Disconnected from invalid user markus 27.112.78.223 port 46252 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 13:30:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<r3Q8Hg1GfLA+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 16 13:30:26 host2 sshd[923860]: Disconnected from invalid user traccar 200.118.99.170 port 37328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.207.245.72
country_id: 1269750
description:
Dec 16 13:31:14 host2 sshd[924281]: Disconnected from invalid user user 49.207.245.72 port 55173 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 16 13:31:36 host2 sshd[924476]: Disconnected from invalid user adc 200.118.99.170 port 36644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.223
country_id: 1643084
description:
Dec 16 13:32:38 host2 sshd[925174]: Disconnected from invalid user test1 27.112.78.223 port 52326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.8.108.39
country_id: 3469034
description:
Dec 16 13:32:58 host2 sshd[925340]: Disconnected from invalid user kamera 189.8.108.39 port 53764 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.8.108.39
country_id: 3469034
description:
Dec 16 13:33:38 host2 sshd[925873]: Disconnected from invalid user seekcy 189.8.108.39 port 50206 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.34
country_id: 6252001
description:
2025-12-16 13:35:49 dovecot_login authenticator failed for (ADMIN) [173.244.56.34]:57284: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.139
country_id: 3865483
description:
Dec 16 13:37:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.250.139, lip=66.85.158.91, TLS, session=<S6r+Ng1GKMCzAPqL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.58.16.172
country_id: 298795
description:
Dec 16 13:38:02 host2 sshd[929194]: Disconnected from invalid user alex 37.58.16.172 port 47620 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.60
country_id: 798544
description:
Dec 16 13:38:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=128.127.94.60, lip=66.85.158.91, TLS, session=<R/L4OA1Gw6SAf148>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.58.16.172
country_id: 298795
description:
Dec 16 13:39:16 host2 sshd[929932]: Disconnected from invalid user rafael 37.58.16.172 port 54750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.131.13.93
country_id: 3175395
description:
Dec 16 13:39:56 host2 sshd[930232]: Disconnected from invalid user ubuntu 57.131.13.93 port 34876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.244.23.211
country_id: 3865483
description:
Dec 16 13:41:52 host2 sshd[931446]: Disconnected from invalid user webuser 190.244.23.211 port 60256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.200
country_id: 798544
description:
2025-12-16 13:42:46 dovecot_login authenticator failed for (ADMIN) [138.199.59.200]:58244: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 13:43:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<xdeDTQ1Gcs0+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 112.134.213.132
country_id: 1227603
description:
Dec 16 13:44:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=112.134.213.132, lip=66.85.158.91, TLS, session=<80aeUg1GJGBwhtWE>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 57.131.13.93
country_id: 3175395
description:
Dec 16 13:46:03 host2 sshd[934439]: Disconnected from invalid user rock 57.131.13.93 port 40952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.131.13.93
country_id: 3175395
description:
Dec 16 13:46:32 host2 sshd[934697]: Disconnected from invalid user user1 57.131.13.93 port 44086 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-16 13:48:02 dovecot_plain authenticator failed for (insach) [65.20.233.110]:56876: 535 Incorrect authentication data (set_id=ksoft.lk@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.102
country_id: 1733045
description:
2025-12-16 13:47:27 dovecot_login authenticator failed for ([49.124.147.102]) [49.124.147.102]:51950: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-16 13:47:42 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:55340: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 112.134.213.132
country_id: 1227603
description:
Dec 16 13:47:55 host2 dovecot[1284858]: imap-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=112.134.213.132, lip=66.85.158.91, TLS, session=<MeFcXQ1GxVtwhtWE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 13:48:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ZcZzXg1Gpo4+PIde>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 58.10.79.208
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 58.10.79.208 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.181.26.90
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 223.181.26.90 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.203.29.37
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.203.29.37 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.165.0
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.165.0 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.43.127.30
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.43.127.30 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.191.186.162
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 180.191.186.162 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.9.52.102
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 82.9.52.102 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.58
country_id: 2963597
description:
2025-12-16 13:52:08 dovecot_login authenticator failed for (ADMIN) [155.2.194.58]:58935: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.241.95.66
country_id: 1269750
description:
Dec 16 13:53:42 host2 sshd[939933]: Disconnected from invalid user tecmint 117.241.95.66 port 55532 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Dec 16 13:53:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS handshaking: Connection closed, session=<LYjDcg1GVr5ChJmF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.241.95.66
country_id: 1269750
description:
Dec 16 13:56:06 host2 sshd[942162]: Disconnected from invalid user dev 117.241.95.66 port 41894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-16 13:57:30 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:60670: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-12-16 13:57:42 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:43082: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.9.217
country_id: 1880251
description:
Dec 16 13:59:06 host2 sshd[944449]: Disconnected from invalid user kkk 43.163.9.217 port 53224 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.9.217
country_id: 1880251
description:
Dec 16 14:02:46 host2 sshd[947663]: Disconnected from invalid user username 43.163.9.217 port 58990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.24
country_id: 2635167
description:
2025-12-16 14:02:17 dovecot_login authenticator failed for (ADMIN) [45.133.172.24]:9824: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.158.147
country_id: 99237
description:
Dec 16 14:05:22 host2 sshd[949637]: Disconnected from invalid user matlab 138.124.158.147 port 58716 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.158.147
country_id: 99237
description:
Dec 16 14:05:58 host2 sshd[949925]: Disconnected from invalid user igor 138.124.158.147 port 46710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.9.217
country_id: 1880251
description:
Dec 16 14:05:15 host2 sshd[949563]: Disconnected from invalid user wy 43.163.9.217 port 41874 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.33
country_id: 2963597
description:
2025-12-16 14:09:10 dovecot_login authenticator failed for (ADMIN) [155.2.194.33]:2045: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-12-16 14:09:23 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:52490: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-16 14:10:11 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:39617: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.112.100.11
country_id: 3175395
description:
Dec 16 14:10:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=217.112.100.11, lip=66.85.158.91, TLS, session=<0Xx6rg1GEYvZcGQL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-12-16 14:11:57 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:60712: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.230.11.165
country_id: 2661886
description:
Dec 16 14:11:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=81.230.11.165, lip=66.85.158.91, TLS, session=<0lKLrw1GvYBR5gul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-16 14:11:41 dovecot_login authenticator failed for ([203.125.110.142]) [203.125.83.34]:61329: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.164.119
country_id: 2661886
description:
2025-12-16 14:12:27 dovecot_plain authenticator failed for 79.138.164.119.mobile.tre.se (slysivest) [79.138.164.119]:36518: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 14:13:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<365Uug1GVq8+PIcd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.9.82
country_id: 1168579
description:
Dec 16 14:16:49 host2 sshd[956445]: Disconnected from invalid user arcgis 103.164.9.82 port 36240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.178.94
country_id: 3175395
description:
2025-12-16 14:17:33 dovecot_plain authenticator failed for (dectrost) [151.3.178.94]:40392: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-12-16 14:19:01 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:47129: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2025-12-16 14:19:28 dovecot_login authenticator failed for (host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:53879: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 14:19:45 host2 sshd[957583]: Disconnected from invalid user anton 62.60.131.157 port 12721 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 14:19:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<jI2Szw1GCJ4+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-12-16 14:19:55 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:44284: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.20.137.134
country_id: 3865483
description:
[2025-12-16 14:20:16 +0530] info [cpaneld] 181.20.137.134 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.215.124.52
country_id: 1512440
description:
[2025-12-16 14:20:20 +0530] info [cpaneld] 82.215.124.52 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 210.87.86.190
country_id: 1643084
description:
[2025-12-16 14:20:22 +0530] info [whostmgrd] 210.87.86.190 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.145.36.48
country_id: 1694008
description:
[2025-12-16 14:20:30 +0530] info [cpaneld] 49.145.36.48 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.209.222.64
country_id: 2287781
description:
[2025-12-16 14:20:46 +0530] info [cpaneld] 102.209.222.64 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.44.178.1
country_id: 102358
description:
[2025-12-16 14:20:49 +0530] info [cpaneld] 176.44.178.1 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-16 14:20:20 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:60508: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.128.251.29
country_id: 3865483
description:
[2025-12-16 14:20:33 +0530] info [cpaneld] 186.128.251.29 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-12-16 14:20:42 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:44203: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.155.212
country_id: 6252001
description:
[2025-12-16 14:20:47 +0530] info [cpaneld] 74.244.155.212 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.51.88.95
country_id: 1282988
description:
[2025-12-16 14:20:43 +0530] info [cpaneld] 202.51.88.95 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.131.91.152
country_id: 6252001
description:
[2025-12-16 14:20:44 +0530] info [whostmgrd] 72.131.91.152 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.211.168.47
country_id: 6252001
description:
[2025-12-16 14:20:17 +0530] info [cpaneld] 72.211.168.47 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.98.86.220
country_id: 2186224
description:
[2025-12-16 14:20:24 +0530] info [cpaneld] 121.98.86.220 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.203.78.149
country_id: 290557
description:
[2025-12-16 14:20:40 +0530] info [cpaneld] 94.203.78.149 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.166.139.194
country_id: 3017382
description:
[2025-12-16 14:20:41 +0530] info [cpaneld] 88.166.139.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.191
country_id: 3017382
description:
Dec 16 14:21:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.191, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+i8Y1g1Gm4pbxJi/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 14:21:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<hfAp1g1GGpg+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.189
country_id: 3017382
description:
Dec 16 14:22:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.189, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<nzSH1w1GcYNbxJi9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-16 14:21:33 dovecot_plain authenticator failed for (bekiess) [65.20.233.110]:47811: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.9.82
country_id: 1168579
description:
Dec 16 14:22:06 host2 sshd[959153]: Disconnected from invalid user core 103.164.9.82 port 58164 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.189
country_id: 3017382
description:
Dec 16 14:22:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.189, lip=66.85.158.92, TLS: Connection closed, session=<aDO31w1GJbNbxJi9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.247.105.174
country_id: 6251999
description:
2025-12-16 14:23:08 dovecot_login authenticator failed for (ADMIN) [84.247.105.174]:21702: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-16 14:23:36 dovecot_plain authenticator failed for (abstings) [154.144.243.93]:54658: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.101
country_id: 6252001
description:
2025-12-16 14:24:55 dovecot_login authenticator failed for (ADMIN) [158.173.153.101]:55796: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.105.110.146
country_id: 3865483
description:
[2025-12-16 14:27:49 +0530] info [cpaneld] 200.105.110.146 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.215.142.153
country_id: 3895114
description:
[2025-12-16 14:27:34 +0530] info [cpaneld] 190.215.142.153 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.62.241.11
country_id: 3469034
description:
[2025-12-16 14:27:37 +0530] info [cpaneld] 187.62.241.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.64.42
country_id: 3895114
description:
[2025-12-16 14:27:39 +0530] info [cpaneld] 179.60.64.42 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.253.246
country_id: 933860
description:
[2025-12-16 14:27:42 +0530] info [whostmgrd] 143.105.253.246 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.13.209.93
country_id: 3865483
description:
[2025-12-16 14:27:44 +0530] info [cpaneld] 186.13.209.93 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.255.184.98
country_id: 290291
description:
[2025-12-16 14:27:47 +0530] info [cpaneld] 84.255.184.98 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-16 14:28:13 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52036: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-16 14:28:15 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (piteric) [73.197.194.98]:38710: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-12-16 14:28:54 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:34451: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.206
country_id: 1269750
description:
2025-12-16 14:29:15 dovecot_login authenticator failed for ([182.95.63.206]) [182.95.63.206]:57704: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 14:35:00 host2 sshd[964960]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.214.83.136
country_id: 6252001
description:
[2025-12-16 14:36:04 +0530] info [cpaneld] 66.214.83.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.108.192.32
country_id: 3865483
description:
[2025-12-16 14:36:02 +0530] info [cpaneld] 190.108.192.32 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.185.255.102
country_id: 6252001
description:
[2025-12-16 14:36:08 +0530] info [cpaneld] 24.185.255.102 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.20.183.33
country_id: 3865483
description:
[2025-12-16 14:36:09 +0530] info [whostmgrd] 181.20.183.33 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.189.148.166
country_id: 3865483
description:
[2025-12-16 14:36:11 +0530] info [cpaneld] 190.189.148.166 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.75.225.253
country_id: 99237
description:
[2025-12-16 14:36:13 +0530] info [cpaneld] 185.75.225.253 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.182.60.29
country_id: 3469034
description:
[2025-12-16 14:36:15 +0530] info [cpaneld] 45.182.60.29 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 16 14:37:16 host2 sshd[966336]: Disconnected from invalid user ansible 43.133.148.170 port 41176 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 14:39:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<mkZpFg5Gwqs+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.37.72.46
country_id: 3469034
description:
Dec 16 14:39:49 host2 sshd[967338]: Disconnected from invalid user jj 191.37.72.46 port 43130 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 14:39:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<rkIvFw5GdJI+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-16 14:40:00 dovecot_login authenticator failed for (nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:48978: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-16 14:40:14 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:44268: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 16 14:43:03 host2 sshd[969222]: Disconnected from invalid user rootuser 43.133.148.170 port 38358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 16 14:43:44 host2 sshd[969563]: Disconnected from invalid user root1 43.133.148.170 port 54326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.32
country_id: 1880251
description:
Dec 16 14:43:06 host2 sshd[969242]: Disconnected from invalid user magento 45.78.228.32 port 33434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.37.72.46
country_id: 3469034
description:
Dec 16 14:44:15 host2 sshd[969783]: Disconnected from invalid user webadm 191.37.72.46 port 4239 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 16 14:44:19 host2 sshd[969809]: Disconnected from invalid user azure 70.54.182.130 port 38961 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.139.191.44
country_id: 130758
description:
Dec 16 14:46:00 host2 sshd[971508]: Disconnected from invalid user magento 94.139.191.44 port 53132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.211.21.213
country_id: 1269750
description:
2025-12-16 14:47:27 dovecot_login authenticator failed for (213-21.211.103.static.gtplkcbpl.in) [103.211.21.213]:59789: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.27.116.226
country_id: 2635167
description:
2025-12-16 14:47:50 dovecot_login authenticator failed for ([92.27.116.226]) [92.27.116.226]:36916: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 16 14:47:53 host2 sshd[972474]: Disconnected from invalid user alex 43.133.148.170 port 55586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 14:47:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<MR4MMQ5Gcp4+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 16 14:47:30 host2 sshd[972290]: Disconnected from invalid user admin 70.54.182.130 port 36734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 16 14:50:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<wgvKOw5GNrM+PIds>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.107.88.97
country_id: 3469034
description:
Dec 16 14:50:24 host2 sshd[973933]: Disconnected from invalid user admin123 187.107.88.97 port 3554 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.187
country_id: 1694008
description:
2025-12-16 14:51:00 dovecot_login authenticator failed for (ADMIN) [188.214.125.187]:25993: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Dec 16 14:52:07 host2 sshd[975079]: Disconnected from invalid user ftpuser 187.107.88.97 port 3559 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 14:54:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<wM6GTA5GiNY+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.32
country_id: 1880251
description:
Dec 16 14:58:13 host2 sshd[979296]: Disconnected from invalid user elastic 45.78.228.32 port 55586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-16 14:59:36 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (syclinging) [174.166.153.20]:56354: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.216
country_id: 6252001
description:
2025-12-16 15:01:03 dovecot_login authenticator failed for (ADMIN) [102.129.153.216]:33984: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-16 15:00:56 dovecot_plain authenticator failed for (ading) [176.113.155.132]:58655: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.202
country_id: 6252001
description:
Dec 16 15:05:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.202, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</G8KdA5G287G6xjK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-16 15:06:03 dovecot_login authenticator failed for ([1.7.229.162]) [136.232.73.130]:56590: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-16 15:06:15 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:59681: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 15:06:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<D4l1dw5GgoQ+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 15:09:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<AnJRgA5G3N4+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 16 15:11:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<PpSQiA5GktM+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 15:11:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<3h9HiQ5G6KE+PIcm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 15:15:06 host2 sshd[993433]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.44
country_id: 6251999
description:
2025-12-16 15:15:23 dovecot_login authenticator failed for (ADMIN) [66.56.80.44]:16904: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 15:15:58 host2 sshd[994004]: Disconnected from invalid user chaz 62.60.131.157 port 45181 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 16 15:17:45 host2 sshd[995217]: Disconnected from invalid user bot 200.69.236.207 port 33205 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 15:17:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<uNZBnw5G0Ns+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.98.20
country_id: 3469034
description:
2025-12-16 15:19:39 dovecot_login authenticator failed for (ADMIN) [146.70.98.20]:55087: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-16 15:19:43 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (hynemle) [76.31.164.124]:57922: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.50.179.74
country_id: 1694008
description:
Dec 16 15:20:23 host2 sshd[996982]: Disconnected from invalid user test 116.50.179.74 port 38740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-16 15:19:28 dovecot_plain authenticator failed for (huarte) [65.20.133.4]:33856: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 15:21:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Vghyqg5GGtg+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Dec 16 15:21:43 host2 sshd[998133]: Disconnected from invalid user hydra 212.154.234.9 port 31552 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.220.202
country_id: 3865483
description:
Dec 16 15:26:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=181.191.220.202, lip=66.85.158.91, TLS, session=<ZR32vA5GQY61v9zK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.167
country_id: 3175395
description:
Dec 16 15:26:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=185.197.8.167, lip=66.85.158.91, TLS, session=<Pr0tvg5GybC5xQin>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-16 15:27:50 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:46305: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 15:27:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<rIoaww5G5OI+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.190.86.24
country_id: 3686110
description:
2025-12-16 15:28:05 dovecot_login authenticator failed for ([45.190.86.24]) [45.190.86.24]:43697: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 16 15:28:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<uDDfww5GdpY+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 15:28:26 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ruperves) [87.103.126.54]:47485: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-12-16 15:31:53 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:42759: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.246
country_id: 6252001
description:
2025-12-16 15:32:15 dovecot_login authenticator failed for wsip-184-191-242-246.fv.ks.cox.net [184.191.242.246]:34556: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.116
country_id: 1831722
description:
2025-12-16 15:32:29 dovecot_login authenticator failed for (ADMIN) [188.215.235.116]:23720: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-16 15:32:50 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:42328: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-16 15:32:29 dovecot_login authenticator failed for ([102.38.3.179]) [102.38.3.179]:35494: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 16 15:34:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<pnHV2Q5GLtM+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Dec 16 15:35:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.91, TLS: Connection closed, session=<8RBX3w5Gdpsiemm2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-16 15:36:56 dovecot_plain authenticator failed for (woont) [102.53.15.56]:36867: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 15:37:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<cvD/4w5G/KU+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-16 15:39:26 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (saltaly) [98.227.25.115]:52650: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 16 15:38:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<VUkE6Q5G8NkD7r/l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 16 15:39:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<qs5n7A5GxOg+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.130
country_id: 3865483
description:
Dec 16 15:41:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=190.181.101.130, lip=66.85.158.91, TLS, session=<Aii38Q5GgYu+tWWC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-16 15:41:23 dovecot_login authenticator failed for (cm-178.232.147.85.get.no) [178.232.147.85]:33137: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-16 15:41:44 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:55994: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-16 15:42:20 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:53557: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.202
country_id: 3175395
description:
Dec 16 15:41:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=171.22.233.202, lip=66.85.158.91, TLS, session=<8dP78g5G896rFunK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 15:43:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<LmtY+Q5GPKU+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Dec 16 15:43:19 host2 sshd[1014544]: Disconnected from invalid user xh 45.249.245.22 port 39996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.77.30.178
country_id: 1269750
description:
Dec 16 15:42:52 host2 sshd[1014184]: Disconnected from invalid user josh 182.77.30.178 port 49030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Dec 16 15:43:56 host2 sshd[1014943]: Disconnected from invalid user postgres 45.249.245.22 port 40904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.87.213.85
country_id: 2017370
description:
Dec 16 15:43:44 host2 sshd[1014841]: Disconnected from invalid user gameserver 194.87.213.85 port 34996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Dec 16 15:43:50 host2 sshd[1014902]: Disconnected from invalid user jira 178.128.92.222 port 60814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Dec 16 15:44:31 host2 sshd[1015250]: Disconnected from invalid user hyper 178.128.92.222 port 60680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.87.213.85
country_id: 2017370
description:
Dec 16 15:44:50 host2 sshd[1015414]: Disconnected from invalid user weblogic 194.87.213.85 port 33858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.3.175
country_id: 6252001
description:
Dec 16 15:44:35 host2 sshd[1015300]: Disconnected from invalid user git 206.81.3.175 port 50444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.68.222
country_id: 3932488
description:
Dec 16 15:44:57 host2 sshd[1015493]: Disconnected from invalid user postgres 161.132.68.222 port 42314 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 15:46:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<aZLDBA9Gts0+PIM0>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 206.81.3.175
country_id: 6252001
description:
Dec 16 15:47:05 host2 sshd[1017673]: Received disconnect from 206.81.3.175 port 34670:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.3.175
country_id: 6252001
description:
Dec 16 15:47:05 host2 sshd[1017673]: Disconnected from invalid user postgres 206.81.3.175 port 34670 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.77.30.178
country_id: 1269750
description:
Dec 16 15:47:44 host2 sshd[1017969]: Disconnected from invalid user ubuntu 182.77.30.178 port 43514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 15:49:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<4H5QDg9GFsM+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.66
country_id: 6252001
description:
2025-12-16 15:51:18 dovecot_login authenticator failed for (ADMIN) [95.181.238.66]:24277: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 16 15:50:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<KdIXFQ9G8NU+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-16 15:53:07 dovecot_plain authenticator failed for (gonon) [38.248.111.238]:44434: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.146.254.92
country_id: 6252001
description:
[2025-12-16 15:55:37 +0530] info [cpaneld] 47.146.254.92 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.7.96.161
country_id: 3469034
description:
[2025-12-16 15:55:40 +0530] info [cpaneld] 191.7.96.161 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.62.160.65
country_id: 6252001
description:
[2025-12-16 15:55:45 +0530] info [cpaneld] 38.62.160.65 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.242.51.15
country_id: 3469034
description:
[2025-12-16 15:55:47 +0530] info [cpaneld] 191.242.51.15 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.139.9.120
country_id: 6252001
description:
[2025-12-16 15:55:46 +0530] info [cpaneld] 73.139.9.120 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-12-16 15:56:15 dovecot_login authenticator failed for ([46.210.94.61]) [46.210.94.61]:44788: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.124.2.7
country_id: 3865483
description:
[2025-12-16 15:55:39 +0530] info [cpaneld] 190.124.2.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.237.153.103
country_id: 1819730
description:
[2025-12-16 15:55:43 +0530] info [whostmgrd] 119.237.153.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.67
country_id: 1814991
description:
2025-12-16 15:56:03 dovecot_login authenticator failed for (ADMIN) [188.241.80.67]:39669: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.4
country_id: 1733045
description:
2025-12-16 15:56:35 dovecot_login authenticator failed for ([49.124.151.4]) [49.124.151.4]:55298: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 16 15:59:00 host2 pure-ftpd[1025636]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-16 15:59:28 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:55572: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 15:59:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<khdXNA9GUqo+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-16 15:59:40 dovecot_login authenticator failed for (187.161.198.68-clientes-izzi.mx) [187.161.198.68]:53925: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-16 16:01:23 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (snern) [196.47.172.253]:44266: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-16 16:02:21 dovecot_login authenticator failed for ([27.123.102.122]) [27.123.102.122]:48890: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-16 16:01:26 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:37178: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-12-16 16:05:17 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:40890: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 16 16:05:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<NpH5SA9GhoQ+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-16 16:04:31 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:47993: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 16:11:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=</C1/Xg9GWJc+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 16:11:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<jf8AXw9G4Ms+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 16:13:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<e5H2Zg9Grsg+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2025-12-16 16:14:10 dovecot_plain authenticator failed for c-98-196-209-55.hsd1.tx.comcast.net (ractisess) [98.196.209.55]:45360: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.61.162
country_id: 6252001
description:
2025-12-16 16:14:37 dovecot_login authenticator failed for (ADMIN) [191.101.61.162]:43561: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 45.15.226.44
country_id: 617790
description:
Dec 16 16:17:01 host2 sshd[1038518]: error: maximum authentication attempts exceeded for root from 45.15.226.44 port 40354 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.15.226.44
country_id: 617790
description:
Dec 16 16:17:21 host2 sshd[1038719]: Disconnecting invalid user admin 45.15.226.44 port 54376: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.39
country_id: 2629691
description:
2025-12-16 16:16:49 dovecot_login authenticator failed for (ADMIN) [45.133.193.39]:25400: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 45.15.226.44
country_id: 617790
description:
Dec 16 16:17:01 host2 sshd[1038518]: Disconnecting authenticating user root 45.15.226.44 port 40354: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 16:18:35 host2 sshd[1039315]: Disconnected from invalid user caleigh 62.60.131.157 port 20143 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 16 16:20:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<4mr0fw9GMLk+PIdi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.179.243
country_id: 2921044
description:
Dec 16 16:21:44 host2 sshd[1041104]: Invalid user Can't open edapass from 167.172.179.243 port 41580


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 16:22:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<wYPRhw9GfKQ+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 16:23:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<X7vphw9GYOE+PIdp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 16:24:59 host2 sshd[1042928]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.142
country_id: 1269750
description:
Dec 16 16:25:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=103.18.166.142, lip=66.85.158.91, TLS, session=<7PXnkA9GmuFnEqaO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.244.196
country_id: 798544
description:
Dec 16 16:26:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=109.125.244.196, lip=66.85.158.91, TLS, session=<sswrkg9Gx7FtffTE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-16 16:27:28 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (chent) [68.40.189.43]:49922: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 16:27:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=</oicmQ9GkNc+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.132.199.196
country_id: 1819730
description:
Dec 16 16:28:54 host2 sshd[1045157]: Disconnected from invalid user 123 43.132.199.196 port 59282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 16 16:28:34 host2 sshd[1045011]: Disconnected from invalid user github 190.60.51.173 port 42924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 16 16:30:12 host2 sshd[1046057]: Disconnected from invalid user sdtdserver 190.60.51.173 port 47300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.24.213.28
country_id: 6252001
description:
2025-12-16 16:31:05 dovecot_login authenticator failed for (ADMIN) [216.24.213.28]:41450: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 16 16:30:49 host2 sshd[1046386]: Disconnected from invalid user administrator 190.60.51.173 port 49006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 16:31:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ZtmSpA9GyLs+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 16 16:32:03 host2 sshd[1046968]: Disconnected from invalid user nabi 190.60.51.173 port 36304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.215
country_id: 6252001
description:
Dec 16 16:33:06 host2 sshd[1047738]: Disconnected from invalid user mt 107.174.67.215 port 49982 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.75.54
country_id: 1819730
description:
Dec 16 16:34:17 host2 sshd[1048484]: Disconnected from invalid user dev02 156.236.75.54 port 40560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-16 16:34:30 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:58326: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.215
country_id: 6252001
description:
Dec 16 16:34:40 host2 sshd[1048623]: Disconnected from invalid user postgres 107.174.67.215 port 42612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.17.174
country_id: 2017370
description:
2025-12-16 16:34:44 dovecot_login authenticator failed for ([155.212.17.174]) [155.212.17.174]:39206: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 16 16:35:48 host2 sshd[1049396]: Disconnected from invalid user ubuntu 51.89.166.236 port 50142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.215
country_id: 6252001
description:
Dec 16 16:35:48 host2 sshd[1049412]: Disconnected from invalid user sasha 107.174.67.215 port 38738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.54
country_id: 1819730
description:
Dec 16 16:35:35 host2 sshd[1049261]: Disconnected from invalid user mt 156.236.75.54 port 40826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 16 16:37:18 host2 sshd[1050349]: Disconnected from invalid user ubuntu 51.89.166.236 port 36448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.215
country_id: 6252001
description:
Dec 16 16:36:51 host2 sshd[1050074]: Disconnected from invalid user site 107.174.67.215 port 34864 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 16 16:36:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<lL9muQ9GmIc+PIcr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.226.150.85
country_id: 1880251
description:
Dec 16 16:37:02 host2 sshd[1050209]: Disconnected from invalid user adv 129.226.150.85 port 44476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.150.56
country_id: 6252001
description:
Dec 16 16:37:30 host2 sshd[1050457]: Disconnected from invalid user sasha 198.23.150.56 port 35238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 16 16:37:48 host2 sshd[1050635]: Disconnected from invalid user postgres 102.88.137.80 port 1335 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.152.37
country_id: 1269750
description:
Dec 16 16:38:31 host2 sshd[1051149]: Disconnected from invalid user mt 106.51.152.37 port 34874 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 16 16:39:16 host2 sshd[1051578]: Disconnected from invalid user noc 102.88.137.80 port 1319 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 16 16:40:21 host2 sshd[1052357]: Disconnected from invalid user mt 160.251.197.41 port 50576 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Dec 16 16:41:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.91, session=<Uuu5yA9GhOxAPsUR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.150.85
country_id: 1880251
description:
Dec 16 16:41:29 host2 sshd[1052905]: Disconnected from invalid user deploy 129.226.150.85 port 52782 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Dec 16 16:41:31 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.91, session=<Nck8yg9Gwk1APsUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-16 16:44:10 dovecot_plain authenticator failed for (tatife) [65.20.129.28]:50883: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 16:44:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<euKC1A9G+Ko+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 16:47:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<JVDD3Q9GwOk+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.60
country_id: 2802361
description:
2025-12-16 16:48:35 dovecot_login authenticator failed for (ADMIN) [181.214.218.60]:41392: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-16 16:49:40 dovecot_plain authenticator failed for (fratuped) [65.20.233.110]:50644: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 16 16:49:41 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, session=<hpxz5w9Ggrc26lCA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 16 16:50:50 host2 sshd[1060332]: Disconnected from invalid user user1 160.251.197.41 port 46378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-16 16:51:17 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:33424: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.22
country_id: 6252001
description:
2025-12-16 16:51:38 dovecot_login authenticator failed for ([98.181.46.22]) [98.181.46.22]:44525: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.188.156
country_id: 99237
description:
2025-12-16 16:52:59 dovecot_plain authenticator failed for (sinas) [65.20.188.156]:59610: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 16 16:52:57 host2 sshd[1061700]: Disconnected from invalid user noc 160.251.197.41 port 42970 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 16:53:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<IBB19Q9GwLE+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.51
country_id: 6252001
description:
2025-12-16 16:54:21 dovecot_login authenticator failed for ([98.181.46.51]) [98.181.46.51]:38630: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 16:54:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<5FNq+A9GmLI+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-16 16:54:37 dovecot_login authenticator failed for ([152.52.14.137]) [182.79.89.14]:57986: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.226.154.124
country_id: 3469034
description:
Dec 16 16:55:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=45.226.154.124, lip=66.85.158.91, TLS, session=<AQed+g9GQw8t4pp8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.213.141
country_id: 99237
description:
Dec 16 16:55:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=65.20.213.141, lip=66.85.158.91, TLS, session=<whvR+w9Gu6VBFNWN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.106
country_id: 3469034
description:
Dec 16 16:55:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.216.88.106, lip=66.85.158.91, TLS, session=<0Kwy/A9GbYO62Fhq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.192.97.106
country_id: 3469034
description:
Dec 16 16:56:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=200.192.97.106, lip=66.85.158.91, TLS, session=<qeZs/Q9GqYvIwGFq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-16 16:57:12 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (priffets) [73.0.235.30]:35154: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-16 16:57:56 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (coscalas) [76.16.7.82]:37737: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2025-12-16 16:57:56 dovecot_login authenticator failed for (31-154-85-196.orange.net.il) [2.55.85.196]:37968: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-16 16:58:33 dovecot_login authenticator failed for ([84.210.149.45]) [84.210.149.45]:60664: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.45
country_id: 6252001
description:
Dec 16 17:00:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.5.45, lip=66.85.158.91, TLS handshaking: Connection closed, session=<s76tDRBG9NkSYQUt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.40.213
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 159.223.40.213 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 17:03:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<4WRmGRBGUOg+PIM0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 17:05:14 host2 sshd[1072653]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.15
country_id: 3996063
description:
2025-12-16 17:04:40 dovecot_login authenticator failed for (ADMIN) [77.81.142.15]:31011: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 16 17:05:37 host2 sshd[1072932]: Disconnected from invalid user admin 160.251.197.41 port 54240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.203.135
country_id: 2077456
description:
2025-12-16 17:07:40 dovecot_login authenticator failed for (ADMIN) [173.239.203.135]:57150: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-16 17:09:08 dovecot_plain authenticator failed for (morilte) [12.150.243.22]:44583: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 16 17:11:26 host2 sshd[1077110]: Disconnected from invalid user fengkai 103.174.114.50 port 45028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 183.82.126.193
country_id: 1269750
description:
Dec 16 17:10:34 host2 sshd[1076447]: Disconnected from invalid user alex 183.82.126.193 port 54624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.101.224.61
country_id: 1605651
description:
2025-12-16 17:11:11 dovecot_login authenticator failed for cm-171-101-224-61.revip11.asianet.co.th [171.101.224.61]:57986: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-12-16 17:11:36 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:36312: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-16 17:11:53 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:34226: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 16 17:13:55 host2 sshd[1078954]: Disconnected from invalid user zhangxin 37.59.110.4 port 57214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 16 17:14:29 host2 sshd[1079363]: Disconnected from invalid user user 37.59.110.4 port 60540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 16 17:14:43 host2 sshd[1079592]: Disconnected from invalid user app 103.174.114.50 port 49826 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 16 17:16:00 host2 sshd[1080751]: Disconnected from invalid user user 37.59.110.4 port 53592 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 16 17:18:51 host2 sshd[1083107]: Disconnected from invalid user joe 103.174.114.50 port 42706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 16 17:20:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<qBDRVBBGzuM+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.10
country_id: 2993457
description:
2025-12-16 17:23:45 dovecot_login authenticator failed for (ADMIN) [95.181.233.10]:2062: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 17:27:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<ETvYbBBGvuI+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.14
country_id: 3703430
description:
2025-12-16 17:28:06 dovecot_login authenticator failed for (ADMIN) [91.90.126.14]:46386: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-16 17:28:56 dovecot_plain authenticator failed for (gragy) [154.144.243.93]:49910: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.35
country_id: 2542007
description:
Dec 16 17:31:18 host2 sshd[1091713]: Disconnected from invalid user nico 81.192.46.35 port 45542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-16 17:31:25 dovecot_plain authenticator failed for (faissofria) [102.53.15.18]:54404: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 16 17:31:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<3XOlfBBGALQ+PIds>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.192.46.35
country_id: 2542007
description:
Dec 16 17:32:48 host2 sshd[1092522]: Disconnected from invalid user xjy 81.192.46.35 port 48556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-16 17:32:31 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (suasal) [174.58.87.108]:35158: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.30.117.80
country_id: 3469034
description:
Dec 16 17:34:55 host2 sshd[1093955]: Disconnected from invalid user ash 189.30.117.80 port 35544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.228.68.232
country_id: 3865483
description:
Dec 16 17:36:46 host2 sshd[1095436]: Disconnected from invalid user iqbal 181.228.68.232 port 36378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.35
country_id: 2542007
description:
Dec 16 17:36:44 host2 sshd[1095403]: Disconnected from invalid user www 81.192.46.35 port 33900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Dec 16 17:38:04 host2 sshd[1096096]: Disconnected from invalid user vncuser 103.49.239.184 port 44392 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.228.68.232
country_id: 3865483
description:
Dec 16 17:37:31 host2 sshd[1095776]: Disconnected from invalid user xjy 181.228.68.232 port 48522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.72
country_id: 1643084
description:
Dec 16 17:37:37 host2 sshd[1095830]: Disconnected from invalid user user9 103.187.146.72 port 53634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Dec 16 17:38:55 host2 sshd[1096607]: Disconnected from invalid user adrian 103.49.239.184 port 36766 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.146.72
country_id: 1643084
description:
Dec 16 17:38:58 host2 sshd[1096632]: Disconnected from invalid user maxim 103.187.146.72 port 39110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.27
country_id: 798544
description:
Dec 16 17:39:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=178.216.30.27, lip=66.85.158.91, TLS, session=<jYVKlxBGXdSy2B4b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.30.117.80
country_id: 3469034
description:
Dec 16 17:38:18 host2 sshd[1096314]: Disconnected from invalid user vishal 189.30.117.80 port 50196 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.60.192.121
country_id: 2963597
description:
Dec 16 17:38:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=92.60.192.121, lip=66.85.158.91, TLS, session=<Ntg5lhBG379cPMB5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-16 17:40:01 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (delcars) [24.1.200.187]:36476: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Dec 16 17:39:44 host2 sshd[1097063]: Disconnected from invalid user user1 103.49.239.184 port 57678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.228.68.232
country_id: 3865483
description:
Dec 16 17:43:07 host2 sshd[1099009]: Disconnected from invalid user student 181.228.68.232 port 60930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.228.68.232
country_id: 3865483
description:
Dec 16 17:43:50 host2 sshd[1099494]: Disconnected from invalid user nico 181.228.68.232 port 44834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 17:44:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<KNunqhBG5Ic+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 17:45:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<nvo1rRBG7qM+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 16 17:47:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<1kDOtRBGNJQ+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-16 17:48:22 dovecot_plain authenticator failed for (basiass) [65.20.133.208]:46164: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-16 17:48:25 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (calogalne) [71.235.225.181]:53178: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 17:49:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<huzDvBBGjuk+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.134.63.224
country_id: 2921044
description:
2025-12-16 17:51:46 dovecot_login authenticator failed for (ADMIN) [95.134.63.224]:36337: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-16 17:52:03 dovecot_plain authenticator failed for (tudorine) [154.144.243.93]:53136: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 17:51:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<WH+HxBBGHLE+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 17:58:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<VZD13RBGPoc+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-16 18:00:11 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:39736: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-16 18:00:53 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:48422: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-16 18:01:15 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:38306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.128.108
country_id: 6252001
description:
Dec 16 18:03:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.249.128.108, lip=66.85.158.92, session=<06H/8BBGxNpK+YBs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-16 18:05:15 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (claccously) [71.62.34.216]:41770: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.165
country_id: 6252001
description:
2025-12-16 18:05:54 dovecot_login authenticator failed for (ADMIN) [191.96.37.165]:41567: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-16 18:07:01 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (poeusubia) [73.224.171.101]:47222: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.8.243
country_id: 6252001
description:
Dec 16 18:10:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.168.8.243, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Die6BxFGDqoUqAjz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 18:10:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<lyzlBxFGVtM+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-16 18:12:34 dovecot_plain authenticator failed for (cring) [102.53.15.17]:33711: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 18:15:23 host2 sshd[1120270]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-16 18:16:22 dovecot_plain authenticator failed for (canostacad) [80.227.102.242]:33785: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.38.35.154
country_id: 6252001
description:
Dec 16 18:16:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.38.35.154, lip=66.85.158.91, TLS handshaking: Connection closed, session=</mHEHhFGpOUUJiOa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 16 18:18:52 host2 sshd[1121966]: Disconnected from invalid user aman 34.39.58.191 port 44542 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 16 18:19:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS handshaking: Connection closed, session=<32ztJhFG7vFChJmL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.35
country_id: 2963597
description:
2025-12-16 18:19:50 dovecot_login authenticator failed for (ADMIN) [155.2.194.35]:40605: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.86.122
country_id: 1269750
description:
Dec 16 18:21:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=139.59.86.122, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xv8CMBFGcoaLO1Z6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 16 18:23:56 host2 sshd[1124908]: Disconnected from invalid user wangke 34.39.58.191 port 37126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:24:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DlSPORFGcrkDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-12-16 18:24:23 dovecot_plain authenticator failed for (forphy) [88.149.153.106]:56742: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 16 18:24:25 host2 sshd[1125298]: Disconnected from invalid user admin1 34.39.58.191 port 54938 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:24:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5FnPOhFGEM4DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-16 18:24:55 dovecot_plain authenticator failed for (unaste) [65.20.149.93]:39125: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-16 18:24:58 dovecot_plain authenticator failed for (buddet) [96.85.104.2]:56390: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 16 18:25:31 host2 sshd[1125992]: Disconnected from invalid user teste 181.116.220.11 port 57990 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:25:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<59pSPhFGZIwDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-16 18:25:57 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60836: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.247
country_id: 3469034
description:
2025-12-16 18:27:11 dovecot_login authenticator failed for (ADMIN) [188.241.177.247]:50759: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 16 18:26:22 host2 sshd[1126438]: Disconnected from invalid user william 34.39.58.191 port 42618 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:27:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<fqVBRhFG0p0DiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 16 18:28:46 host2 sshd[1127620]: Disconnected from invalid user sri 137.184.30.179 port 59976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 18:29:45 host2 sshd[1128361]: Disconnected from invalid user asha 62.60.131.157 port 10925 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:29:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<eDdxTRFGlucDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 16 18:30:59 host2 sshd[1129569]: Disconnected from invalid user pelias 181.116.220.11 port 37139 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 16 18:31:09 host2 sshd[1129694]: Disconnected from invalid user newusername 137.184.30.179 port 33624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:30:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vAn5UBFGjoYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 18:30:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Z8vbUBFGpIM+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 16 18:31:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<wEd+UxFGeprBHmEh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:32:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<33iDVhFGrOEDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.78
country_id: 6252001
description:
Dec 16 18:32:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.78, lip=66.85.158.91, session=<9tiXVxFGwsaH7X1O>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-16 18:32:40 dovecot_plain authenticator failed for (enreakeede) [176.113.155.132]:42728: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 16 18:33:50 host2 sshd[1131148]: Disconnected from invalid user amin 137.184.30.179 port 35480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Dec 16 18:34:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.91, session=<YhViXRFGyv7CpRCl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:34:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<mpdKXRFGmOADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:34:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<tmsLXhFGpsoDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 16 18:36:12 host2 sshd[1132954]: Disconnected from invalid user max 181.116.220.11 port 39350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 16 18:36:18 host2 sshd[1133017]: Disconnected from invalid user rustserver 51.195.138.37 port 57742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 16 18:37:23 host2 sshd[1133534]: Disconnected from invalid user test1 51.195.138.37 port 44460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-16 18:37:38 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (eatic) [72.241.202.216]:45201: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 16 18:37:54 host2 sshd[1133886]: Disconnected from invalid user odoo 51.195.138.37 port 59166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.102.85.71
country_id: 390903
description:
2025-12-16 18:39:14 dovecot_plain authenticator failed for (unfult) [147.102.85.71]:33269: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-16 18:38:18 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (press) [73.213.237.28]:52620: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.34
country_id: 3017382
description:
2025-12-16 18:42:11 dovecot_login authenticator failed for (ADMIN) [191.101.31.34]:52004: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 18:45:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<h9figxFGhMo+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 18:45:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ysNWhBFGhNY+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.143
country_id: 3865483
description:
Dec 16 18:45:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.181.109.143, lip=66.85.158.91, TLS, session=<P4Y2hRFG9o6+tW2P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.159.184.166
country_id: 798544
description:
Dec 16 18:45:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=93.159.184.166, lip=66.85.158.91, TLS, session=<DCdbhhFG969dn7im>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 16 18:46:05 host2 sshd[1139494]: Disconnected from invalid user svn 198.12.85.136 port 40764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.173.10
country_id: 2635167
description:
2025-12-16 18:45:27 dovecot_login authenticator failed for (ADMIN) [45.133.173.10]:41873: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 16 18:45:33 host2 sshd[1138786]: Disconnected from invalid user ftpuser1 198.12.85.136 port 37440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 16 18:47:11 host2 sshd[1140142]: Disconnected from invalid user li 198.12.85.136 port 46086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 18:47:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<7bbcjRFGNqs+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 16 18:48:15 host2 sshd[1140742]: Disconnected from invalid user test_user 198.12.85.136 port 49106 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 18:49:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=</2VdkxFGqr0+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.123
country_id: 3996063
description:
2025-12-16 18:50:12 dovecot_plain authenticator failed for (gamity) [201.173.57.123]:35632: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 18:51:42 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (cowly) [87.103.126.54]:48542: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 18:55:51 host2 sshd[1145437]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.164.119
country_id: 2661886
description:
2025-12-16 18:55:56 dovecot_plain authenticator failed for 79.138.164.119.mobile.tre.se (chrootoce) [79.138.164.119]:60766: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.238
country_id: 192950
description:
Dec 16 18:56:24 host2 sshd[1145705]: Disconnected from invalid user ftpuser 102.220.23.238 port 37948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.220.23.238
country_id: 192950
description:
Dec 16 18:57:08 host2 sshd[1146200]: Disconnected from invalid user backend 102.220.23.238 port 52068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.27.187
country_id: 3996063
description:
Dec 16 18:58:25 host2 sshd[1147233]: Disconnected from invalid user User 187.212.27.187 port 49430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.238
country_id: 192950
description:
Dec 16 18:59:20 host2 sshd[1147916]: Disconnected from invalid user deployer 102.220.23.238 port 37960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.210
country_id: 6252001
description:
2025-12-16 19:00:23 dovecot_login authenticator failed for (ADMIN) [181.215.182.210]:64699: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.212.27.187
country_id: 3996063
description:
Dec 16 19:01:53 host2 sshd[1150082]: Disconnected from invalid user vncuser 187.212.27.187 port 60774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.167.105
country_id: 2635167
description:
Dec 16 19:01:59 host2 sshd[1150155]: Disconnected from invalid user appadmin 178.128.167.105 port 34894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.27.187
country_id: 3996063
description:
Dec 16 19:02:59 host2 sshd[1150970]: Disconnected from invalid user alpha 187.212.27.187 port 54378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.6.61.189
country_id: 6252001
description:
2025-12-16 19:04:11 dovecot_plain authenticator failed for 99-6-61-189.lightspeed.livnmi.sbcglobal.net (bourism) [99.6.61.189]:56726: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 16 19:05:32 host2 sshd[1153685]: Disconnected from invalid user user 2.57.121.25 port 47732 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-12-16 19:06:23 dovecot_plain authenticator failed for (sinder) [88.149.153.106]:57062: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 19:07:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<CodI0xFGGLY+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-16 19:07:59 dovecot_plain authenticator failed for (extagent) [105.72.176.66]:41620: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-16 19:09:11 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (gyine) [68.82.141.145]:56812: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 16 19:10:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<u0yf3RFGlpk+PIcq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.167.105
country_id: 2635167
description:
Dec 16 19:09:54 host2 sshd[1156520]: Disconnected from invalid user user3 178.128.167.105 port 35460 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 19:14:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<P9KG7RFGqt4+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.73
country_id: 6252001
description:
Dec 16 19:15:20 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.208.73, lip=66.85.158.92, session=<mbZL8BFGbM2YINBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.18
country_id: 798549
description:
Dec 16 19:17:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=212.73.148.18, lip=66.85.158.91, TLS: Connection closed, session=<vXKD9xFGnJDUSZQS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.16
country_id: 798549
description:
Dec 16 19:19:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.16, lip=66.85.158.91, TLS: Connection closed, session=<JY2JABJGBuVV2ZUQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.172.131
country_id: 2658434
description:
Dec 16 19:20:51 host2 pure-ftpd[1163620]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.172.131
country_id: 2658434
description:
Dec 16 19:20:55 host2 pure-ftpd[1163696]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.11
country_id: 146669
description:
2025-12-16 19:21:55 dovecot_login authenticator failed for (ADMIN) [185.253.162.11]:39544: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-16 19:22:56 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (totridgric) [66.177.30.53]:48982: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Dec 16 19:23:19 host2 sshd[1165334]: Disconnected from invalid user ubuntu 101.47.135.95 port 39576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 16 19:23:32 host2 sshd[1165460]: Disconnected from invalid user manuel 154.124.97.102 port 34493 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Dec 16 19:25:00 host2 sshd[1166283]: Disconnected from invalid user odoo 103.172.112.192 port 50578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 16 19:25:34 host2 sshd[1166854]: Disconnected from invalid user yskim 165.227.3.79 port 41744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 19:26:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<aqpiFxJG0tQ+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.17.45.24
country_id: 6252001
description:
2025-12-16 19:26:19 dovecot_login authenticator failed for (ADMIN) [84.17.45.24]:49568: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-16 19:26:53 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:50142: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.247.158.242
country_id: 2510769
description:
Dec 16 19:27:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=188.247.158.242, lip=66.85.158.91, TLS, session=<B1iFGRJGMu28957y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.16
country_id: 3175395
description:
Dec 16 19:27:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.208.106.16, lip=66.85.158.91, TLS, session=</aKcGhJGucu50GoQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.181.149
country_id: 130758
description:
Dec 16 19:27:26 host2 sshd[1167847]: Invalid user Can't open edapass from 185.208.181.149 port 39488


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.205.8
country_id: 1269750
description:
2025-12-16 19:27:19 dovecot_login authenticator failed for ([103.250.160.76]) [59.96.205.8]:40852: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 16 19:27:19 host2 sshd[1167771]: Disconnected from invalid user ncc 165.227.3.79 port 59978 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.67.161.175
country_id: 6252001
description:
Dec 16 19:28:22 host2 pure-ftpd[1168384]: (?@40.67.161.175) [INFO] New connection from 40.67.161.175


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 16 19:28:50 host2 sshd[1168672]: Disconnected from invalid user lfs 165.227.3.79 port 49953 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 19:28:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<C8uXIBJGCJM+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 16 19:29:44 host2 sshd[1169334]: Disconnected from invalid user yusuf 154.124.97.102 port 36531 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.113.246.124
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.113.246.124 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.156.188.7
country_id: 3439705
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 152.156.188.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.185.224.48
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.185.224.48 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.161.178.23
country_id: 290291
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.161.178.23 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 19:30:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<8+nbJBJGJNY+PIdj>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.97.109.70
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 138.97.109.70 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.83.132.147
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 170.83.132.147 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.79.49.84
country_id: 6290252
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.79.49.84 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.205.151.134
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 112.205.151.134 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Dec 16 19:32:11 host2 sshd[1171050]: Disconnected from invalid user testuser 103.172.112.192 port 57904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 19:31:41 host2 sshd[1170704]: Disconnected from invalid user dayana 62.60.131.157 port 61036 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.179.252.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.179.252.16 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.135.36.145
country_id: 3439705
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.135.36.145 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.83.43.98
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 170.83.43.98 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.4.216.8
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.4.216.8 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.33.39.100
country_id: 690791
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.33.39.100 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.129.44.216
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.129.44.216 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 16 19:33:16 host2 sshd[1171926]: Disconnected from invalid user aa 154.124.97.102 port 50889 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Dec 16 19:34:29 host2 sshd[1172635]: Disconnected from invalid user artin 103.172.112.192 port 58124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 16 19:35:30 host2 sshd[1173468]: Disconnected from invalid user manager 154.124.97.102 port 53777 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 19:35:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Qti2ORJGfqs+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.117
country_id: 6252001
description:
2025-12-16 19:37:41 dovecot_login authenticator failed for (ADMIN) [102.129.252.117]:44998: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 19:38:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<U5a5QRJGDNE+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-16 19:39:27 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (misacism) [74.218.95.154]:48560: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.125.78
country_id: 6252001
description:
Dec 16 19:39:54 host2 pure-ftpd[1176525]: (?@135.237.125.78) [INFO] New connection from 135.237.125.78


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-16 19:43:03 dovecot_plain authenticator failed for (thosin) [65.20.250.163]:42642: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.73
country_id: 6252001
description:
Dec 16 19:45:16 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.208.73, lip=66.85.158.91, session=<IgZeWxJGjtuYINBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.73
country_id: 6252001
description:
Dec 16 19:45:34 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.208.73, lip=66.85.158.91, session=<f6Z3XBJGKOGYINBJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.197
country_id: 6252001
description:
Dec 16 19:45:51 host2 pure-ftpd[1181868]: (?@91.230.168.197) [INFO] New connection from 91.230.168.197


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.196
country_id: 6252001
description:
Dec 16 19:45:51 host2 pure-ftpd[1181872]: (?@91.230.168.196) [INFO] New connection from 91.230.168.196


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 19:46:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<uPbnXhJGvuA+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 19:48:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<oVaJZhJG4Jg+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-16 19:49:33 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:48389: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-16 19:49:51 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:53964: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 19:50:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<h6WObBJGytY+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.227.10
country_id: 6252001
description:
2025-12-16 19:50:53 dovecot_login authenticator failed for (ADMIN) [191.96.227.10]:41542: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.232.237
country_id: 6252001
description:
2025-12-16 19:52:13 dovecot_login authenticator failed for (ADMIN) [102.129.232.237]:49310: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 19:51:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<LF7gchJGJJI+PIde>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 16 19:54:49 host2 pure-ftpd[1193712]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.78
country_id: 1880251
description:
Dec 16 19:55:00 host2 sshd[1193881]: Disconnected from invalid user foundry 45.78.221.78 port 53228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.78
country_id: 1880251
description:
Dec 16 19:56:09 host2 sshd[1196222]: Disconnected from invalid user gitlab-runner 45.78.221.78 port 40914 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 19:58:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<cgQsiRJGANQ+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 20:00:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<fZsNkhJGNJI+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2025-12-16 20:01:46 dovecot_plain authenticator failed for c-98-196-209-55.hsd1.tx.comcast.net (posculs) [98.196.209.55]:36702: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 20:05:54 host2 sshd[1204972]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 20:08:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<q//BrRJG+JI+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 20:08:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<mhjFrhJGkpo+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 20:09:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<n8tvsBJGiMc+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-16 20:10:38 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:53231: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-16 20:10:55 dovecot_login authenticator failed for ([188.124.139.77]) [188.124.139.77]:37068: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-16 20:11:33 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (nahorl) [50.74.136.134]:50734: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.32.159
country_id: 3469034
description:
Dec 16 20:11:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.39.32.159, lip=66.85.158.91, TLS, session=<DLTVuRJGF5+xJyCf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.17
country_id: 3865483
description:
Dec 16 20:12:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=179.0.251.17, lip=66.85.158.91, TLS, session=<zVkJuxJGJo6zAPsR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Dec 16 20:13:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.56, lip=66.85.158.92, TLS: Connection closed, session=<acYzwRJGns2nXpI4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-16 20:14:58 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (acopercy) [73.183.74.177]:50832: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 20:19:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=</OB+1BJGxOY+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 16 20:20:56 host2 sshd[1215237]: Disconnected from invalid user exploit 101.36.117.148 port 52510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.35
country_id: 3625428
description:
2025-12-16 20:20:51 dovecot_login authenticator failed for (ADMIN) [95.181.237.35]:49934: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec 16 20:22:32 host2 sshd[1216404]: Disconnected from invalid user user 193.106.245.20 port 49303 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.44
country_id: 953987
description:
2025-12-16 20:22:50 dovecot_login authenticator failed for (ADMIN) [154.47.30.44]:6438: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 20:22:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<H2BA4RJGpoE+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.188.156
country_id: 99237
description:
2025-12-16 20:23:58 dovecot_plain authenticator failed for (lactic) [65.20.188.156]:54694: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-16 20:24:00 dovecot_plain authenticator failed for (piesopily) [92.62.243.174]:56810: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.106.245.20
country_id: 798544
description:
Dec 16 20:24:23 host2 sshd[1217440]: Disconnected from invalid user ubuntu 193.106.245.20 port 39949 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 20:24:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<Sjvx5xJGRNA+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.181
country_id: 3017382
description:
Dec 16 20:24:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.181, lip=66.85.158.92, session=<FEV36BJGjbZb51m1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.178
country_id: 3017382
description:
Dec 16 20:24:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.178, lip=66.85.158.92, session=<BXQU6RJGneVb51my>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec 16 20:24:59 host2 sshd[1217704]: Disconnected from invalid user applmgr 193.106.245.20 port 40009 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.179
country_id: 3017382
description:
Dec 16 20:25:05 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.179, lip=66.85.158.92, session=<pPG86RJG94Jb51mz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.62
country_id: 3017382
description:
Dec 16 20:25:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.62, lip=66.85.158.92, session=<63jv6RJGUcdb51k+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 16 20:26:43 host2 sshd[1218906]: Disconnected from invalid user applmgr 103.123.53.88 port 36652 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-16 20:26:48 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:54829: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-16 20:27:04 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:33296: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 20:27:06 host2 sshd[1219140]: Disconnected from invalid user nikita 62.60.131.157 port 43281 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.135
country_id: 6252001
description:
Dec 16 20:27:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.135, lip=66.85.158.91, TLS: Connection closed, session=<N7vp8RJGTNTHLZqH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec 16 20:28:14 host2 sshd[1219866]: Disconnected from invalid user imran 193.106.245.20 port 43249 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 16 20:28:24 host2 sshd[1219983]: Disconnected from invalid user alex 101.36.117.148 port 40114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-16 20:28:50 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (dammuloss) [73.145.107.251]:59226: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 16 20:29:36 host2 sshd[1221061]: Disconnected from invalid user vikas 101.36.117.148 port 32838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 20:30:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ateolly) [87.103.126.54]:36690: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 16 20:30:25 host2 sshd[1221731]: Disconnected from invalid user acs 103.123.53.88 port 55422 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 20:30:46 host2 sshd[1221940]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 16 20:31:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<r//+/hJGMLI+PIdn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Dec 16 20:31:44 host2 sshd[1222629]: Disconnected from invalid user admin 36.64.68.99 port 58280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 16 20:31:48 host2 sshd[1222654]: Disconnected from invalid user ftpuser 202.157.176.165 port 51142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 20:33:30 host2 sshd[1223650]: Disconnected from invalid user nikita 62.60.131.157 port 52941 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 16 20:33:50 host2 sshd[1223844]: Disconnected from invalid user admin 202.157.176.165 port 38350 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 20:34:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<jdu3ChNGpI4+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 20:35:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<FQznDhNGAus+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 16 20:35:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<p/uCDxNGJuU+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.174
country_id: 6252001
description:
2025-12-16 20:37:39 dovecot_login authenticator failed for (ADMIN) [181.41.206.174]:29997: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 16 20:37:41 host2 sshd[1226528]: Disconnected from invalid user david 202.157.176.165 port 40516 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-16 20:38:12 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (preave) [37.150.8.174]:36571: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-16 20:38:17 dovecot_plain authenticator failed for (aphas) [5.31.15.108]:57657: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 20:40:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<zvgpIRNGaKU+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-16 20:39:40 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:38460: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.5.133
country_id: 2077456
description:
2025-12-16 20:40:05 dovecot_login authenticator failed for ([101.168.5.133]) [101.168.5.133]:52876: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec 16 20:40:14 host2 sshd[1228257]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 51515


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.41.217.74
country_id: 6252001
description:
Dec 16 20:42:24 host2 sshd[1229566]: Disconnected from invalid user web 34.41.217.74 port 39344 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.78.89.26
country_id: 298795
description:
Dec 16 20:43:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=94.78.89.26, lip=66.85.158.91, TLS, session=<z7nvKhNGkIleTlka>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 16 20:42:43 host2 sshd[1229731]: Disconnected from invalid user user1 103.153.190.105 port 56834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.41.217.74
country_id: 6252001
description:
Dec 16 20:43:51 host2 sshd[1230511]: Disconnected from invalid user geo 34.41.217.74 port 46144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.15.88
country_id: 798544
description:
Dec 16 20:43:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=89.186.15.88, lip=66.85.158.91, TLS, session=<0OkELBNGn9ZZug9Y>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 167.172.203.52
country_id: 6252001
description:
Dec 16 20:44:39 host2 sshd[1231003]: Received disconnect from 167.172.203.52 port 34586:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 20:45:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<V85cMRNGkog+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-12-16 20:45:16 dovecot_login authenticator failed for ([61.2.44.54]) [61.2.44.54]:42336: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 20:46:07 host2 sshd[1232896]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 16 20:46:18 host2 pure-ftpd[1233054]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.172.203.52
country_id: 6252001
description:
Dec 16 20:46:49 host2 sshd[1233382]: Disconnected from invalid user user1 167.172.203.52 port 35968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-16 20:49:09 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:33468: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-16 20:49:28 dovecot_login authenticator failed for ([125.19.174.244]) [128.185.201.138]:32968: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-16 20:50:46 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (jingeate) [73.144.27.228]:56564: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 20:52:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<DSRISxNGxqU+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 16 20:52:25 host2 sshd[1239031]: Disconnected from invalid user develop 103.153.190.105 port 60586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.151
country_id: 798549
description:
2025-12-16 20:52:30 dovecot_login authenticator failed for (ADMIN) [91.90.120.151]:37318: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 8.222.222.91
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 8.222.222.91: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.65.175
country_id: 6252001
description:
Dec 16 20:53:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.65.175, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<3JsITxNG9ucv+0Gv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 16 20:53:51 host2 sshd[1240262]: Disconnected from invalid user ubuntu 103.153.190.105 port 43336 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Dec 16 20:53:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<EK7TUBNGEqMv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.65.175
country_id: 6252001
description:
Dec 16 20:53:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=47.251.65.175, lip=66.85.158.91, TLS, session=<M8jSUBNGAOgv+0Gv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.134.63.219
country_id: 2921044
description:
2025-12-16 20:54:05 dovecot_login authenticator failed for (ADMIN) [95.134.63.219]:60579: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 20:56:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<bGJ6WBNGLNA+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 20:56:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<cRe/WxNGbog+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.67.39
country_id: 3996063
description:
2025-12-16 20:57:29 dovecot_login authenticator failed for ([201.160.67.39]) [201.160.67.39]:48522: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-16 20:57:49 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:58188: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.181.152
country_id: 130758
description:
Dec 16 21:00:23 host2 sshd[1245288]: Invalid user Can't open edapass from 185.208.181.152 port 42054


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 21:00:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<SFnxaRNGwpQ+PIcs>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 16 21:01:12 host2 pure-ftpd[1246046]: (?@66.132.153.138) [INFO] New connection from 66.132.153.138


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.109
country_id: 6252001
description:
Dec 16 21:00:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.109, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<CRf7aBNGg8ai2JZt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.109
country_id: 6252001
description:
Dec 16 21:01:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.109, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<PzvLbBNGwOCi2JZt>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.158.166
country_id: 6252001
description:
Dec 16 21:01:58 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.158.166, lip=66.85.158.92, TLS, session=<PHirbRNGqM5HBp6m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.158.166
country_id: 6252001
description:
Dec 16 21:01:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.158.166, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<QMSsbRNG/M5HBp6m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.109.18
country_id: 6252001
description:
Dec 16 21:03:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=45.33.109.18, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<ZjthcxNGUpktIW0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 16 21:03:51 host2 sshd[1247888]: Disconnected from invalid user yassine 202.165.22.246 port 39176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 16 21:05:16 host2 sshd[1248766]: Disconnected from invalid user control 202.165.22.246 port 39074 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-16 21:04:45 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (safraniher) [24.91.103.202]:38944: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-16 21:04:52 dovecot_plain authenticator failed for (oversalian) [80.227.102.242]:40620: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Dec 16 21:06:22 host2 sshd[1249392]: Disconnected from invalid user andy 201.124.23.196 port 39227 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 16 21:06:43 host2 sshd[1249536]: Disconnected from invalid user ubuntu 202.165.22.246 port 38972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 16 21:07:51 host2 sshd[1250043]: Disconnected from invalid user ubuntu 102.88.137.213 port 33775 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.13
country_id: 3042058
description:
2025-12-16 21:09:28 dovecot_login authenticator failed for (ADMIN) [91.90.122.13]:5755: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-16 21:09:03 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (juntomel) [144.64.157.244]:45862: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.109
country_id: 6252001
description:
Dec 16 21:09:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.109, lip=66.85.158.91, TLS, session=<zukZiBNGcOKi2JZt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.109
country_id: 6252001
description:
Dec 16 21:09:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.109, lip=66.85.158.91, TLS, session=<wc/liRNGKuqi2JZt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.124.23.196
country_id: 3996063
description:
Dec 16 21:10:28 host2 sshd[1252258]: Disconnected from invalid user erpnext 201.124.23.196 port 52348 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.171
country_id: 3469034
description:
Dec 16 21:10:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=177.44.96.171, lip=66.85.158.91, TLS, session=<IDJPixNGpcuxLGCr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.78.89.45
country_id: 298795
description:
Dec 16 21:10:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt>, method=PLAIN, rip=94.78.89.45, lip=66.85.158.91, TLS, session=<eKWXjBNGsuBeTlkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-16 21:11:00 dovecot_login authenticator failed for (nsg-corporate-161.229.186.122.airtel.in) [182.79.86.102]:34018: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 16 21:12:28 host2 sshd[1253258]: Disconnected from invalid user superset 102.88.137.213 port 1439 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 16 21:12:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<KBdQkxNGmibUZija>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 16 21:11:43 host2 sshd[1252877]: Disconnected from invalid user me 102.88.137.213 port 1111 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-12-16 21:11:45 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:50093: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-16 21:12:52 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (orist) [174.169.224.27]:52290: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.255.38.183
country_id: 6252001
description:
Dec 16 21:13:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=38.255.38.183, lip=66.85.158.91, session=<CMy1lRNGuMUm/ya3>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.10
country_id: 798549
description:
Dec 16 21:14:31 host2 pure-ftpd[1254509]: (?@85.217.140.10) [INFO] New connection from 85.217.140.10


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.13
country_id: 798549
description:
Dec 16 21:14:04 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.140.13, lip=66.85.158.92, TLS, session=<GML0mBNGdq9V2YwN>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.10
country_id: 798549
description:
Dec 16 21:14:53 host2 pure-ftpd[1254690]: (?@85.217.140.10) [INFO] New connection from 85.217.140.10


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.140.10
country_id: 798549
description:
Dec 16 21:14:58 host2 pure-ftpd[1254746]: (?@85.217.140.10) [INFO] New connection from 85.217.140.10


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.190
country_id: 6252001
description:
Dec 16 21:15:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.190, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<w9FVnBNG5MSTuYW+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.190
country_id: 6252001
description:
Dec 16 21:15:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.133.190, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<p0fVnhNGPPWTuYW+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.235.40.131
country_id: 6252001
description:
Dec 16 21:17:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.235.40.131, lip=66.85.158.92, TLS, session=<JvMIpRNGLF2s6yiD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.218
country_id: 294640
description:
2025-12-16 21:21:01 dovecot_login authenticator failed for (ADMIN) [149.88.26.218]:36418: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-16 21:22:15 dovecot_login authenticator failed for (nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:51990: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.190
country_id: 6252001
description:
Dec 16 21:22:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.190, lip=66.85.158.92, TLS, session=<0aaJthNGnuCTuYW+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-16 21:22:35 dovecot_login authenticator failed for ([49.0.40.238]) [49.0.40.238]:59770: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.240.192.138
country_id: 6252001
description:
Dec 16 21:22:56 host2 pure-ftpd[1259722]: (?@66.240.192.138) [INFO] New connection from 66.240.192.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-16 21:23:33 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (boldne) [73.145.107.251]:33620: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.192.138
country_id: 6252001
description:
Dec 16 21:22:48 host2 pure-ftpd[1259653]: (?@66.240.192.138) [INFO] New connection from 66.240.192.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.217
country_id: 798549
description:
2025-12-16 21:23:51 dovecot_login authenticator failed for (ADMIN) [91.90.120.217]:59831: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:24:11 host2 sshd[1260374]: Disconnected from invalid user vlad 154.57.216.142 port 27822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 16 21:24:18 host2 sshd[1260427]: Disconnected from invalid user peertube 201.76.120.30 port 55906 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.81.146.106
country_id: 3469034
description:
2025-12-16 21:24:33 dovecot_plain authenticator failed for ([31.57.166.48]) [177.81.146.106]:60956: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-16 21:25:25 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:47314: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.175.30.38
country_id: 3144096
description:
2025-12-16 21:24:44 dovecot_plain authenticator failed for 38.51-175-30.customer.lyse.net ([31.57.166.48]) [51.175.30.38]:56998: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-16 21:24:54 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (gratint) [81.225.30.107]:33260: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-16 21:25:09 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:52180: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2025-12-16 21:25:47 dovecot_login authenticator failed for ([59.145.84.169]) [182.95.176.122]:58758: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.219
country_id: 1643084
description:
Dec 16 21:25:49 host2 sshd[1261551]: Disconnected from invalid user hadoop 103.172.204.219 port 56280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.91
country_id: 3996063
description:
2025-12-16 21:26:20 dovecot_login authenticator failed for (201.173.250.91-clientes-izzi.mx) [201.173.250.91]:55672: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:26:39 host2 sshd[1261933]: Disconnected from invalid user angel 154.57.216.142 port 62260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.219
country_id: 1643084
description:
Dec 16 21:26:43 host2 sshd[1261949]: Disconnected from invalid user ljh 103.172.204.219 port 42424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 16 21:28:28 host2 sshd[1263134]: Disconnected from invalid user ruan 201.76.120.30 port 44478 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-16 21:27:56 dovecot_plain authenticator failed for (whannia) [80.227.102.242]:37624: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-12-16 21:28:10 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:54740: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-16 21:28:40 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:48485: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-16 21:28:46 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (inapezine) [68.52.119.193]:42922: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.219
country_id: 1643084
description:
Dec 16 21:28:53 host2 sshd[1263413]: Disconnected from invalid user admin 103.172.204.219 port 48914 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 21:29:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<WZd20BNGkIQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.72.184.111
country_id: 6252001
description:
2025-12-16 21:30:17 dovecot_plain authenticator failed for ([31.57.166.48]) [73.72.184.111]:55680: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.115.135.128
country_id: 3895114
description:
2025-12-16 21:30:29 dovecot_plain authenticator failed for ([31.57.166.48]) [191.115.135.128]:40472: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 16 21:29:47 host2 sshd[1263996]: Disconnected from invalid user test10 201.76.120.30 port 40656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.68.107.91
country_id: 1168579
description:
Dec 16 21:30:04 host2 sshd[1264250]: Disconnected from invalid user kube 111.68.107.91 port 59168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.122.127.91
country_id: 690791
description:
2025-12-16 21:30:40 dovecot_plain authenticator failed for ([31.57.166.48]) [176.122.127.91]:54760: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec 16 21:31:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7SSW1xNGtgm4affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec 16 21:31:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TuCu2BNGpMi4affC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 21:31:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<k1bd2BNGsqo+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 21:33:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<allG3hNG2Jc+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:35:18 host2 sshd[1268229]: Disconnected from invalid user user 154.57.216.142 port 25967 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:36:05 host2 sshd[1268759]: Disconnected from invalid user carlos 154.57.216.142 port 58245 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:41:03 host2 sshd[1272344]: Disconnected from invalid user app 154.57.216.142 port 62916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 21:41:05 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (lilic) [87.103.126.54]:43395: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 21:41:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<OaMt+xNGroA+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.25
country_id: 146669
description:
2025-12-16 21:41:48 dovecot_login authenticator failed for (ADMIN) [185.253.162.25]:40445: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:41:50 host2 sshd[1272831]: Disconnected from invalid user app 154.57.216.142 port 46010 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 21:43:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<+VQoARRGxo0+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 21:43:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<9o7QAhRGvKs+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.142
country_id: 1694008
description:
2025-12-16 21:43:58 dovecot_login authenticator failed for (ADMIN) [188.214.125.142]:47318: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:44:11 host2 sshd[1274102]: Disconnected from invalid user aryan 154.57.216.142 port 54526 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 21:44:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Cfx1BhRGVLo+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 21:46:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<uZ2mDRRGRq4+PIcf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 16 21:48:48 host2 pure-ftpd[1276846]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 21:50:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<DneeGhRGOp4+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 21:54:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Dy0+KBRGPts+PIcd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 21:56:09 host2 sshd[1282339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.124
country_id: 6252001
description:
Dec 16 21:56:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.124, lip=66.85.158.92, session=<NTMWMRRGuU1APpx8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Dec 16 21:56:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS: Connection closed, session=<0+rSMRRGbFJAPpx6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.47
country_id: 3175395
description:
Dec 16 21:57:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=217.26.178.47, lip=66.85.158.91, TLS, session=<msb7MhRGgafZGrIv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.183.92.238
country_id: 3469034
description:
Dec 16 21:57:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=45.183.92.238, lip=66.85.158.91, TLS, session=<pF8HMxRG1p0tt1zu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.56.46
country_id: 1269750
description:
Dec 16 21:57:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=103.237.56.46, lip=66.85.158.91, TLS, session=<EOIQMxRGv7hn7Tgu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.12
country_id: 3469034
description:
Dec 16 21:57:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.44.71.12, lip=66.85.158.91, TLS, session=<V68OMxRGU9mxLEcM>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 5.187.97.40
country_id: 3579143
description:
Dec 16 21:58:06 host2 sshd[1284028]: Disconnecting authenticating user root 5.187.97.40 port 46891: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.187.97.40
country_id: 3579143
description:
Dec 16 21:58:13 host2 sshd[1284143]: Disconnecting invalid user admin 5.187.97.40 port 47519: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.50
country_id: 798544
description:
Dec 16 21:57:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=77.65.142.50, lip=66.85.158.91, TLS, session=<q59VNBRGu4JNQY4y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.97.73.17
country_id: 3469034
description:
Dec 16 21:57:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=138.97.73.17, lip=66.85.158.91, TLS, session=<qLJdNBRGvoiKYUkR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.134.54
country_id: 1269750
description:
Dec 16 21:57:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<careers>, method=PLAIN, rip=103.59.134.54, lip=66.85.158.91, TLS, session=<4J1TNBRG3uBnO4Y2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.66
country_id: 1269750
description:
Dec 16 21:58:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<careers>, method=PLAIN, rip=103.18.166.66, lip=66.85.158.91, TLS, session=<sxHGNBRGR5xnEqZC>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 5.187.97.40
country_id: 3579143
description:
Dec 16 21:58:06 host2 sshd[1284028]: error: maximum authentication attempts exceeded for root from 5.187.97.40 port 46891 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.189
country_id: 1694008
description:
2025-12-16 21:59:15 dovecot_login authenticator failed for (ADMIN) [188.214.125.189]:46969: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 16 22:01:17 host2 sshd[1287460]: Disconnected from invalid user user 2.57.121.25 port 53942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.0.158
country_id: 1269750
description:
2025-12-16 22:04:59 dovecot_plain authenticator failed for (I7QG1XB55L1Y) [163.223.0.158]:51762: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.22
country_id: 2029969
description:
2025-12-16 22:06:15 dovecot_login authenticator failed for (ADMIN) [173.244.58.22]:50386: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-16 22:10:14 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (bartic) [68.52.119.193]:39928: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 22:10:13 host2 sshd[1293675]: Disconnected from invalid user guadalupe 62.60.131.157 port 62688 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-16 22:11:16 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:38025: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.83
country_id: 6252001
description:
Dec 16 22:11:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=98.80.4.83, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ohibZRRGJpNiUART>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 16 22:12:22 host2 sshd[1296246]: Disconnected from invalid user username 209.141.43.77 port 59162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-12-16 22:12:27 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:49235: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-16 22:12:00 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3854: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 16 22:12:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<dOQNaRRGENk+PIdn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 16 22:14:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<Mq1XcRRGkJc+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 22:15:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<hFL6dRRGcJk+PIMh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 16 22:16:28 host2 sshd[1311803]: Disconnected from invalid user ipfs 209.141.43.77 port 56250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 16 22:18:18 host2 sshd[1313012]: Disconnected from invalid user postgres 209.141.43.77 port 41476 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 16 22:19:47 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.5, lip=66.85.158.92, TLS handshaking: Connection closed, session=<oFHwgxRGpjtKUi8F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-16 22:20:40 dovecot_plain authenticator failed for (trunhic) [94.206.93.90]:35445: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2025-12-16 22:20:44 dovecot_plain authenticator failed for c-73-27-33-174.hsd1.fl.comcast.net (ditis) [73.27.33.174]:54594: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec 16 22:21:17 host2 sshd[1315425]: Disconnected from invalid user doc 179.125.24.202 port 52464 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.230
country_id: 6252001
description:
Dec 16 22:22:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.230, lip=66.85.158.91, TLS: Connection closed, session=<7mcAjBRG2IFHBobm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-16 22:23:24 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52447: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:23:29 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<0rsxkRRGmKMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.22
country_id: 3194884
description:
2025-12-16 22:22:55 dovecot_login authenticator failed for (ADMIN) [176.125.229.22]:38937: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 22:23:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<e5a+kBRGdso+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:24:41 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<kp+DlRRGAr8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:24:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<4++xlRRGvuADhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec 16 22:25:21 host2 sshd[1317850]: Disconnected from invalid user alex 179.125.24.202 port 44798 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.125.24.202
country_id: 3469034
description:
Dec 16 22:26:02 host2 sshd[1318211]: Disconnected from invalid user admin 179.125.24.202 port 58504 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.227.193.105
country_id: 6252001
description:
Dec 16 22:26:23 host2 pure-ftpd[1318396]: (?@34.227.193.105) [INFO] New connection from 34.227.193.105


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:26:33 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<AXklnBRGUJkDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 16 22:27:00 host2 sshd[1318689]: Disconnected from invalid user guest 36.37.122.175 port 38626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec 16 22:27:21 host2 sshd[1318979]: Disconnected from invalid user devops 179.125.24.202 port 39132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 16 22:26:48 host2 sshd[1318629]: Disconnected from invalid user admin 172.200.228.35 port 58554 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:26:54 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<XOpqnRRGNowDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:27:45 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<NTx7oBRGZLMDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:28:03 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<qwqEoRRGct4DhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 16 22:28:17 host2 sshd[1319558]: Disconnected from invalid user kirill 36.37.122.175 port 54362 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:29:17 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<MwHzpRRGxIoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.52
country_id: 798549
description:
2025-12-16 22:29:23 dovecot_login authenticator failed for (ADMIN) [143.244.52.52]:24419: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 16 22:28:57 host2 sshd[1319915]: Disconnected from invalid user api 36.37.122.175 port 36194 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:29:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<c9LTpRRGtIoDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 16 22:29:48 host2 sshd[1320526]: Disconnected from invalid user admin 172.200.228.35 port 54026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:30:25 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<XUL7qRRGmuwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:31:37 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<W41CrhRGQMoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-16 22:32:53 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (ectomyclia) [24.15.216.41]:41370: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec 16 22:33:17 host2 sshd[1323257]: Disconnected from invalid user minecraft 179.125.24.202 port 53430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-16 22:34:10 dovecot_plain authenticator failed for (docon) [5.11.140.219]:57200: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-16 22:34:14 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (nonesses) [76.157.219.158]:41306: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 22:35:20 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (cania) [87.103.126.54]:15518: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 22:34:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<wWSiuRRGZKM+PIdp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 22:36:19 host2 sshd[1325250]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 22:36:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<4KNhvhRGPOw+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.81.82
country_id: 6251999
description:
2025-12-16 22:38:24 dovecot_login authenticator failed for (ADMIN) [66.56.81.82]:33568: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-16 22:40:15 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (tesiones) [98.204.134.124]:43276: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Dec 16 22:42:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<c2XS1RRG/Ays7OTF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-12-16 22:44:04 dovecot_plain authenticator failed for c-73-53-254-168.hsd1.fl.comcast.net (buganal) [73.53.254.168]:35718: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-16 22:45:51 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (tercily) [73.196.144.25]:49670: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 22:46:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<8pJN5BRGcqc+PIcm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.104
country_id: 3017382
description:
Dec 16 22:47:04 host2 pure-ftpd[1332579]: (?@91.196.152.104) [INFO] New connection from 91.196.152.104


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.21
country_id: 3017382
description:
Dec 16 22:47:04 host2 pure-ftpd[1332570]: (?@91.196.152.21) [INFO] New connection from 91.196.152.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-16 22:50:54 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (preae) [98.40.101.10]:42886: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 16 22:51:17 host2 pure-ftpd[1335517]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-16 22:51:38 dovecot_plain authenticator failed for (candess) [96.85.104.2]:41058: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 16 22:51:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<q78S9hRGTtc+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.44
country_id: 2635167
description:
2025-12-16 22:54:58 dovecot_login authenticator failed for (ADMIN) [45.133.172.44]:47658: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.10
country_id: 1522867
description:
2025-12-16 22:56:49 dovecot_login authenticator failed for (ADMIN) [62.133.47.10]:55541: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-16 22:57:52 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (logly) [50.74.136.134]:60778: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 22:59:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<QkFmExVG4Lo+PIcg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.85
country_id: 6252001
description:
Dec 16 23:00:18 host2 pure-ftpd[1342500]: (?@198.235.24.85) [INFO] New connection from 198.235.24.85


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.208.108.166
country_id: 1819730
description:
Dec 16 23:00:22 host2 sshd[1342544]: Disconnected from invalid user localhost 104.208.108.166 port 30810 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.172.21
country_id: 6252001
description:
Dec 16 23:01:25 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=45.79.172.21, lip=66.85.158.92, session=<avvUGBVGroktT6wV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 23:00:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<zWkWFxVGVrk+PIM0>


