# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 09:55:33 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<1wLmQMhE0ugDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.174.18
country_id: 3865483
description:
Nov 30 09:55:45 host2 sshd[3496486]: Disconnected from invalid user admin123 200.89.174.18 port 36832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Nov 30 09:56:38 host2 sshd[3497123]: Disconnected from invalid user supermaint 103.255.147.244 port 54864 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 09:57:01 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<BU4vRshE7t0DiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 09:57:02 host2 dovecot[3366265]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<3mczRshE/N0DiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.89.174.18
country_id: 3865483
description:
Nov 30 09:57:08 host2 sshd[3497396]: Disconnected from invalid user bob 200.89.174.18 port 50994 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 09:58:33 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<vuGlS8hE4NMDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 09:59:46 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<59wBUMhEdIwDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 09:59:49 host2 dovecot[3366265]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<VaUwUMhEGp0DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.7
country_id: 6252001
description:
Nov 30 10:00:14 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=162.216.149.7, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ZO2lUchEd9ei2JUH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.7
country_id: 6252001
description:
Nov 30 10:01:55 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.149.7, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<QQqyV8hEBuei2JUH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-11-30 10:01:21 dovecot_login authenticator failed for ([125.19.93.105]) [182.95.50.154]:59158: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.7
country_id: 6252001
description:
Nov 30 10:02:18 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 23 secs): user=<>, rip=162.216.149.7, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<umUJWchEHOei2JUH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Nov 30 10:02:35 host2 sshd[3501361]: Disconnected from invalid user ir 143.58.211.64 port 39280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Nov 30 10:04:32 host2 sshd[3503122]: Disconnected from invalid user gerrit 152.32.218.149 port 59018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Nov 30 10:05:14 host2 sshd[3503763]: Disconnected from invalid user grid 143.58.211.64 port 35520 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.138
country_id: 2782113
description:
2025-11-30 10:05:48 dovecot_login authenticator failed for (ADMIN) [156.146.60.138]:9932: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.58.211.64
country_id: 2635167
description:
Nov 30 10:06:15 host2 sshd[3504338]: Disconnected from invalid user david 143.58.211.64 port 46236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Nov 30 10:07:17 host2 sshd[3504977]: Disconnected from invalid user asterisk 143.58.211.64 port 37840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.158
country_id: 1269750
description:
2025-11-30 10:07:38 dovecot_login authenticator failed for (smtp4.cpc.gov.in) [27.123.104.158]:51890: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-11-30 10:07:52 dovecot_login authenticator failed for ([152.52.19.49]) [125.23.202.194]:37094: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Nov 30 10:09:24 host2 sshd[3506365]: Disconnected from invalid user alex 143.58.211.64 port 57630 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.7
country_id: 6252001
description:
Nov 30 10:09:27 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.7, lip=66.85.158.92, TLS, session=<yaGacshE0uii2JUH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Nov 30 10:09:37 host2 sshd[3506458]: Disconnected from invalid user sopuser 152.32.218.149 port 49356 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.7
country_id: 6252001
description:
Nov 30 10:10:14 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.7, lip=66.85.158.92, TLS, session=<rUJpdchEtuOi2JUH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.149
country_id: 1880251
description:
Nov 30 10:10:51 host2 sshd[3507204]: Disconnected from invalid user hamed 152.32.218.149 port 59902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 10:12:54 host2 sshd[3508145]: Disconnected from invalid user  2.57.121.112 port 62624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.24
country_id: 6252001
description:
Nov 30 10:13:07 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.24, lip=66.85.158.91, session=<xyK8f8hE2odBMQEY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.253.242
country_id: 3382998
description:
2025-11-30 10:13:30 dovecot_login authenticator failed for ([186.179.253.242]) [186.179.253.242]:44868: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-11-30 10:13:47 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:56614: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Nov 30 10:13:48 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<IW0ngshEGmlBMRRF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Nov 30 10:14:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Isxig8hEaOFBMRRF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-11-30 10:14:49 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:60960: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2025-11-30 10:14:59 dovecot_login authenticator failed for ([103.177.204.4]) [103.177.204.4]:52677: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.51.109
country_id: 1269750
description:
2025-11-30 10:15:04 dovecot_login authenticator failed for (abts-north-static-109.51.160.122.airtelbroadband.in) [122.160.51.109]:36321: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-11-30 10:15:25 dovecot_login authenticator failed for (techday.com.ua) [46.149.83.62]:39237: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.3.103
country_id: 2750405
description:
2025-11-30 10:18:54 dovecot_login authenticator failed for (ADMIN) [158.173.3.103]:41346: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 30 10:23:13 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<Eqa0o8hEbsqSOC+J>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.11.218.4
country_id: 1831722
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.11.218.4 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 30 10:31:28 host2 sshd[3519810]: Disconnected from invalid user user 2.57.121.25 port 38205 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Nov 30 10:32:53 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.53, lip=66.85.158.92, TLS: Connection closed, session=<1y10xshEcDGnXpI1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 30 10:32:55 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<MY1pxshEW1xRvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.85
country_id: 6252001
description:
Nov 30 10:35:06 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.85, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5KRYzshE0sCTuYRV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.190
country_id: 1269750
description:
2025-11-30 10:36:01 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:47524: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-11-30 10:36:15 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:45020: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.173.39
country_id: 1512440
description:
2025-11-30 10:37:23 dovecot_login authenticator failed for ([45.92.173.39]) [45.92.173.39]:58504: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-30 10:37:35 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:33306: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 10:40:47 host2 sshd[3525177]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 10:41:33 host2 sshd[3525677]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 10:43:51 host2 sshd[3526857]: Disconnected from invalid user admin 2.57.121.112 port 8257 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 30 10:47:49 host2 sshd[3530095]: Disconnected from invalid user zaire 62.60.131.157 port 19714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.102.10
country_id: 290557
description:
2025-11-30 10:52:37 dovecot_login authenticator failed for (ADMIN) [146.70.102.10]:50559: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.197.82
country_id: 2186224
description:
2025-11-30 10:57:33 dovecot_login authenticator failed for 219-89-197-82.adsl.xtra.co.nz [219.89.197.82]:44182: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-30 10:57:44 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:51944: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Nov 30 10:59:23 host2 sshd[3537070]: Disconnected from invalid user kiosk 79.168.139.28 port 51274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.56.149.193
country_id: 1269750
description:
Nov 30 11:02:06 host2 sshd[3538706]: Disconnected from invalid user actions 27.56.149.193 port 41552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.56.149.193
country_id: 1269750
description:
Nov 30 11:04:10 host2 sshd[3540079]: Disconnected from invalid user odin 27.56.149.193 port 33364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Nov 30 11:04:51 host2 sshd[3540409]: Disconnected from invalid user superadmin 51.75.27.166 port 54272 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Nov 30 11:05:30 host2 sshd[3540876]: Disconnected from invalid user autrede 79.168.139.28 port 34292 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.75.27.166
country_id: 3017382
description:
Nov 30 11:06:04 host2 sshd[3541185]: Disconnected from invalid user odin 51.75.27.166 port 35604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Nov 30 11:06:46 host2 sshd[3541523]: Disconnected from invalid user posiflex 79.168.139.28 port 53202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.56.149.193
country_id: 1269750
description:
Nov 30 11:07:13 host2 sshd[3541848]: Disconnected from invalid user kiosk 27.56.149.193 port 42186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Nov 30 11:07:54 host2 sshd[3542343]: Disconnected from invalid user fred 79.168.139.28 port 53994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.99
country_id: 6252001
description:
2025-11-30 11:08:06 dovecot_login authenticator failed for ([70.174.168.99]) [70.174.168.99]:36040: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-11-30 11:08:28 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:37632: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.168.139.28
country_id: 2264397
description:
Nov 30 11:08:59 host2 sshd[3543209]: Disconnected from invalid user production 79.168.139.28 port 56044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.56.149.193
country_id: 1269750
description:
Nov 30 11:09:49 host2 sshd[3543892]: Disconnected from invalid user superadmin 27.56.149.193 port 42422 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.216
country_id: 6251999
description:
2025-11-30 11:10:31 dovecot_login authenticator failed for (ADMIN) [37.120.205.216]:33422: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.56.149.193
country_id: 1269750
description:
Nov 30 11:11:08 host2 sshd[3544779]: Disconnected from invalid user bitnami 27.56.149.193 port 50224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.75.27.166
country_id: 3017382
description:
Nov 30 11:12:18 host2 sshd[3545345]: Disconnected from invalid user posiflex 51.75.27.166 port 33906 [preauth]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 103.21.166.103
country_id: 1227603
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.21.166.103 NEW veneelk:wmZW6vJv7tlmWv7Q address=103.21.166.103,app=cpaneld,creator=veneelk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.8.92
country_id: 6252001
description:
Nov 30 11:24:54 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.22.8.92, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<BBJ4gMlEysOlFghc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-11-30 11:25:09 dovecot_login authenticator failed for ([152.52.197.174]) [152.52.197.174]:51534: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-11-30 11:25:38 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:37834: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.229
country_id: 1733045
description:
2025-11-30 11:28:04 dovecot_login authenticator failed for ([49.124.152.229]) [49.124.152.229]:35188: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.58
country_id: 1814991
description:
2025-11-30 11:27:48 dovecot_login authenticator failed for (ADMIN) [188.241.80.58]:14540: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-11-30 11:28:38 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1246: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 30 11:29:31 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<dqzwkMlEzNkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 30 11:30:25 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<m0U0lMlE7NQDhBfJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.240
country_id: 6252001
description:
Nov 30 11:30:39 host2 pure-ftpd[3558003]: (?@147.185.132.240) [INFO] New connection from 147.185.132.240


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 11:31:35 host2 sshd[3559018]: Disconnected from invalid user  2.57.121.112 port 61209 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 30 11:32:39 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<sbUxnMlEEugDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 30 11:34:18 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<KckOoslE0JcDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.39
country_id: 298795
description:
2025-11-30 11:34:41 dovecot_login authenticator failed for (88.255.189.39.static.ttnet.com.tr) [88.255.189.39]:52320: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-11-30 11:35:03 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:46599: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 30 11:35:33 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dWWOpslEQqkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 30 11:36:17 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<ZJgmqclEyrYDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-11-30 11:37:22 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:33425: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.253.239
country_id: 1819730
description:
2025-11-30 11:38:19 dovecot_login authenticator failed for (161.81.253.239.hk.chinamobile.com) [161.81.253.239]:33808: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-11-30 11:38:34 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:37065: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-30 11:40:46 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:41556: 535 Incorrect authentication data (set_id=test@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.191
country_id: 2635167
description:
2025-11-30 11:42:56 dovecot_login authenticator failed for (ADMIN) [98.159.234.191]:32820: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 11:42:19 host2 sshd[3565536]: Disconnected from invalid user squid 2.57.121.112 port 61502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 30 11:53:40 host2 sshd[3572226]: Disconnected from invalid user user 2.57.121.25 port 39571 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-11-30 11:54:36 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:44152: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-30 11:54:56 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:38274: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-30 11:55:32 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:49090: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-30 11:58:38 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:56274: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-11-30 11:59:11 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:38076: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.45.6.197
country_id: 1819730
description:
2025-11-30 11:59:13 dovecot_login authenticator failed for (ADMIN) [89.45.6.197]:43722: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-11-30 12:06:11 dovecot_login authenticator failed for ([182.78.70.126]) [182.78.70.126]:51462: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.196
country_id: 1733045
description:
2025-11-30 12:06:38 dovecot_login authenticator failed for ([49.124.159.196]) [49.124.159.196]:36730: 535 Incorrect authentication data (set_id=parentscoignard111)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.3.96.178
country_id: 3175395
description:
Nov 30 12:08:29 host2 sshd[3582041]: Disconnected from invalid user gerrit 79.3.96.178 port 56944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.34.89
country_id: 6252001
description:
Nov 30 12:11:04 host2 sshd[3584025]: Disconnected from invalid user gerrit 107.175.34.89 port 41076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.34.89
country_id: 6252001
description:
Nov 30 12:13:58 host2 sshd[3585573]: Disconnected from invalid user administrator 107.175.34.89 port 48056 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.34.89
country_id: 6252001
description:
Nov 30 12:15:06 host2 sshd[3586437]: Disconnected from invalid user int 107.175.34.89 port 48710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.34.89
country_id: 6252001
description:
Nov 30 12:16:21 host2 sshd[3587239]: Disconnected from invalid user ftptest 107.175.34.89 port 59684 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.28.9
country_id: 798544
description:
Nov 30 12:17:04 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 34 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=178.216.28.9, lip=66.85.158.91, TLS, session=<ZCMDOcpER8Oy2BwJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.11.63
country_id: 3077311
description:
Nov 30 12:17:35 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<amila>, method=PLAIN, rip=31.222.11.63, lip=66.85.158.91, TLS, session=<Yh9yO8pEBI0f3gs/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.34.89
country_id: 6252001
description:
Nov 30 12:17:39 host2 sshd[3587997]: Disconnected from invalid user foundry 107.175.34.89 port 59506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-30 12:18:56 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:59654: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-11-30 12:19:08 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:38992: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-30 12:19:30 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:34032: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Nov 30 12:23:22 host2 sshd[3591315]: Disconnected from invalid user bitrix 152.32.206.160 port 43240 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.8.57
country_id: 3686110
description:
Nov 30 12:28:35 host2 sshd[3594463]: Disconnected from invalid user sammy 181.49.8.57 port 41072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Nov 30 12:29:25 host2 sshd[3594911]: Disconnected from invalid user odoo 152.32.206.160 port 56654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.50.169
country_id: 6252001
description:
Nov 30 12:30:14 host2 sshd[3595544]: Disconnected from invalid user devuser 107.174.50.169 port 57122 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.206.160
country_id: 6252001
description:
Nov 30 12:30:37 host2 sshd[3595724]: Disconnected from invalid user hdfs 152.32.206.160 port 34516 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 12:31:57 host2 sshd[3596485]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Nov 30 12:31:47 host2 sshd[3596404]: Disconnected from invalid user github 152.32.206.160 port 49718 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 12:32:43 host2 sshd[3597088]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.8.57
country_id: 3686110
description:
Nov 30 12:32:37 host2 sshd[3596995]: Disconnected from invalid user bob 181.49.8.57 port 53098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.50.169
country_id: 6252001
description:
Nov 30 12:32:45 host2 sshd[3597094]: Disconnected from invalid user khan 107.174.50.169 port 40070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.122.113
country_id: 6252001
description:
2025-11-30 12:32:51 dovecot_login authenticator failed for (ADMIN) [151.241.122.113]:26891: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.206.160
country_id: 6252001
description:
Nov 30 12:32:57 host2 sshd[3597197]: Disconnected from invalid user init 152.32.206.160 port 39752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.50.169
country_id: 6252001
description:
Nov 30 12:33:53 host2 sshd[3597775]: Disconnected from invalid user a 107.174.50.169 port 37674 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.110.36.125
country_id: 3508796
description:
2025-11-30 12:34:27 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.125]:57394: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.87.53
country_id: 6252001
description:
2025-11-30 12:34:39 dovecot_login authenticator failed for wsip-174-79-87-53.br.br.cox.net [174.79.87.53]:54483: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.8.57
country_id: 3686110
description:
Nov 30 12:36:06 host2 sshd[3599367]: Disconnected from invalid user radio 181.49.8.57 port 39628 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.50.169
country_id: 6252001
description:
Nov 30 12:36:12 host2 sshd[3599434]: Disconnected from invalid user github 107.174.50.169 port 40274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.8.57
country_id: 3686110
description:
Nov 30 12:37:11 host2 sshd[3599968]: Disconnected from invalid user toor 181.49.8.57 port 53954 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.8.57
country_id: 3686110
description:
Nov 30 12:39:21 host2 sshd[3601298]: Disconnected from invalid user bayu 181.49.8.57 port 54388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-11-30 12:44:32 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:35418: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.190
country_id: 1269750
description:
2025-11-30 12:44:48 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:40870: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-30 12:46:00 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:44241: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 12:46:30 host2 sshd[3605843]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-30 12:46:46 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:59163: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.139
country_id: 2328926
description:
2025-11-30 12:48:04 dovecot_login authenticator failed for (ADMIN) [146.70.65.139]:9863: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-11-30 12:51:31 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:34832: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-11-30 12:52:10 dovecot_login authenticator failed for 177-72-87-7.static.as262543.net.br [177.72.87.7]:37100: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.49.194
country_id: 6252001
description:
2025-11-30 12:52:33 dovecot_login authenticator failed for wsip-72-214-49-194.hr.hr.cox.net [72.214.49.194]:53356: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 12:55:18 host2 sshd[3612588]: Disconnected from invalid user admin 2.57.121.112 port 39149 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.20
country_id: 2635167
description:
Nov 30 13:02:22 host2 dovecot[3366265]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.20, lip=66.85.158.91, TLS, session=<lWgA3cpEseq594kU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.208
country_id: 2635167
description:
Nov 30 13:02:24 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.208, lip=66.85.158.91, TLS handshaking: Connection closed, session=<E40m3cpET8dX7LDQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.217
country_id: 2635167
description:
Nov 30 13:02:57 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.217, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Jr0h38pE8cS594nZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.195
country_id: 2635167
description:
Nov 30 13:03:31 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.195, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<mlgd4cpE5a+594nD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.182
country_id: 2635167
description:
Nov 30 13:04:04 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.182, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<56IY48pEvby594m2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-30 13:04:20 dovecot_login authenticator failed for ([122.187.227.199]) [122.187.227.199]:48485: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.207
country_id: 2635167
description:
Nov 30 13:05:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.207, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<u5sN58pE7ZG594nP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.205
country_id: 2635167
description:
Nov 30 13:04:37 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.205, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2RsU5cpE4YBX7LDN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-30 13:04:40 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:34910: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Nov 30 13:05:01 host2 sshd[3618691]: Disconnected from invalid user admin123 118.193.61.170 port 44766 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.184
country_id: 2635167
description:
Nov 30 13:06:17 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.184, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<QT8G68pEC6dX7LC4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.202
country_id: 2635167
description:
Nov 30 13:05:44 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.202, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<id8K6cpEPcy594nK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.187
country_id: 2635167
description:
Nov 30 13:07:23 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.187, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<hSL77spETYS594m7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.208
country_id: 2635167
description:
Nov 30 13:06:50 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.208, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<A8z/7MpE85RX7LDQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.104.142
country_id: 2077456
description:
2025-11-30 13:08:37 dovecot_login authenticator failed for ([123.209.104.142]) [123.209.104.142]:59700: 535 Incorrect authentication data (set_id=info@casa18villa.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.61.170
country_id: 1861060
description:
Nov 30 13:10:09 host2 sshd[3621815]: Disconnected from invalid user admin 118.193.61.170 port 49296 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-11-30 13:11:11 dovecot_login authenticator failed for ([125.17.236.223]) [125.17.233.246]:36694: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.28.138
country_id: 1269750
description:
2025-11-30 13:11:42 dovecot_login authenticator failed for ([125.17.28.112]) [125.17.28.138]:40974: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2025-11-30 13:11:29 dovecot_login authenticator failed for ([128.185.241.213]) [125.19.138.74]:40144: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.10.111
country_id: 927384
description:
2025-11-30 13:14:21 dovecot_login authenticator failed for ([196.216.10.111]) [196.216.10.111]:58033: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Nov 30 13:14:36 host2 sshd[3624353]: Disconnected from invalid user ranger 118.193.61.170 port 35260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 30 13:14:39 host2 sshd[3624367]: Disconnected from invalid user user 2.57.121.25 port 45991 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-11-30 13:14:42 dovecot_login authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:64618: 535 Incorrect authentication data (set_id=vinod)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Nov 30 13:15:54 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, session=<F+1pDctESEtKUi8D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-11-30 13:19:28 dovecot_login authenticator failed for ([185.101.16.250]) [185.101.16.250]:54233: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-30 13:19:01 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50317: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.61.170
country_id: 1861060
description:
Nov 30 13:19:10 host2 sshd[3627063]: Disconnected from invalid user ubuntu 118.193.61.170 port 50746 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.148.10.116
country_id: 1210997
description:
2025-11-30 13:20:23 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.116]:48722: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.90
country_id: 1269750
description:
2025-11-30 13:22:19 dovecot_login authenticator failed for ([182.66.81.153]) [27.123.112.90]:48396: 535 Incorrect authentication data (set_id=contacto@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-30 13:22:30 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:47872: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-30 13:22:56 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:40439: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.92.115.73
country_id: 6252001
description:
2025-11-30 13:26:44 dovecot_login authenticator failed for ([168.92.115.73]) [168.92.115.73]:57884: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-30 13:26:59 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:42902: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.109.81.123
country_id: 1605651
description:
2025-11-30 13:27:11 dovecot_login authenticator failed for ([183.89.250.247]) [101.109.81.123]:56144: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.78
country_id: 2264397
description:
Nov 30 13:31:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=45.156.129.78, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<WQzoQ8tEV4ItnIFO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.77
country_id: 2264397
description:
Nov 30 13:31:09 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 1 secs): user=<>, rip=45.156.129.77, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<VxnvQ8tEVZstnIFN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.76
country_id: 2264397
description:
Nov 30 13:31:06 host2 dovecot[3366265]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.76, lip=66.85.158.91, TLS, session=<RmTKQ8tEy4QtnIFM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.77
country_id: 2264397
description:
Nov 30 13:31:05 host2 dovecot[3366265]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.77, lip=66.85.158.91, session=<2Bm2Q8tEVZEtnIFN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.75
country_id: 2264397
description:
Nov 30 13:31:07 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.129.75, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lKbZQ8tEqektnIFL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.198.228.157
country_id: 6252001
description:
Nov 30 13:34:26 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=143.198.228.157, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Kru6T8tEzsuPxuSd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.159
country_id: 2328926
description:
2025-11-30 13:35:45 dovecot_login authenticator failed for (ADMIN) [146.70.65.159]:64755: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-11-30 13:41:18 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:42910: 535 Incorrect authentication data (set_id=admin@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-11-30 13:43:58 dovecot_login authenticator failed for ([125.23.203.114]) [125.23.203.114]:56458: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-11-30 13:43:29 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:45870: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.133.103
country_id: 1733045
description:
2025-11-30 13:43:48 dovecot_login authenticator failed for ([49.124.133.103]) [49.124.133.103]:34570: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-30 13:44:35 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:56747: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.186.215.58
country_id: 2077456
description:
2025-11-30 13:47:05 dovecot_login authenticator failed for ([115.186.215.58]) [115.186.215.58]:36407: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-30 13:46:50 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:53378: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-30 13:47:49 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:36142: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-11-30 13:48:07 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:48786: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.10
country_id: 1821275
description:
2025-11-30 13:55:03 dovecot_login authenticator failed for (ADMIN) [84.252.92.10]:20609: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.237
country_id: 6252001
description:
Nov 30 13:57:57 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.237, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PFDUo8tEDdyTuYTt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.122
country_id: 6252001
description:
Nov 30 14:01:41 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.122, lip=66.85.158.92, session=<M+gqsctE6OTG6xh6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-11-30 14:12:20 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:57034: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.60
country_id: 2629691
description:
2025-11-30 14:12:27 dovecot_login authenticator failed for (ADMIN) [45.133.193.60]:55115: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2025-11-30 14:14:06 dovecot_login authenticator failed for (223-197-145-114.static.imsbiz.com) [223.197.145.114]:59677: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-11-30 14:14:18 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:14438: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 30 14:16:45 host2 sshd[3661873]: Disconnected from invalid user solr 51.222.106.104 port 59570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 30 14:17:56 host2 sshd[3662531]: Disconnected from invalid user backup 51.222.106.104 port 35342 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2025-11-30 14:21:00 dovecot_login authenticator failed for ([207.188.158.216]) [207.188.158.216]:25274: 535 Incorrect authentication data (set_id=office@casa18villa.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 30 14:21:05 host2 sshd[3664689]: Disconnected from invalid user radio 51.222.106.104 port 38034 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-11-30 14:21:25 dovecot_login authenticator failed for (70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:33391: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 14:23:04 host2 sshd[3665779]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 30 14:22:12 host2 sshd[3665277]: Disconnected from invalid user user01 51.222.106.104 port 37092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-11-30 14:22:52 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1322: 535 Incorrect authentication data (set_id=contact@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-11-30 14:23:08 dovecot_login authenticator failed for ([182.95.54.10]) [182.95.54.10]:42386: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 14:23:51 host2 sshd[3666190]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 30 14:25:29 host2 sshd[3667350]: Disconnected from invalid user katlin 62.60.131.157 port 17766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-11-30 14:25:55 dovecot_login authenticator failed for ([125.17.17.201]) [27.123.113.86]:39954: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.29
country_id: 298795
description:
2025-11-30 14:26:14 dovecot_login authenticator failed for ([188.59.178.29]) [188.59.178.29]:54514: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.25
country_id: 2562770
description:
2025-11-30 14:28:09 dovecot_login authenticator failed for (ADMIN) [176.125.230.25]:55969: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 30 14:30:16 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<+R5BF8xE5V9RvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 14:30:33 host2 sshd[3670065]: Disconnected from invalid user  2.57.121.112 port 61768 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.206.223
country_id: 6252001
description:
Nov 30 14:34:19 host2 pure-ftpd[3671818]: (?@165.154.206.223) [INFO] New connection from 165.154.206.223


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov 30 14:34:33 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<n/O0JsxEzrYjygmF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 14:41:23 host2 sshd[3675709]: Disconnected from invalid user pritchard 2.57.121.112 port 61705 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.100
country_id: 6252001
description:
2025-11-30 14:43:22 dovecot_login authenticator failed for (ADMIN) [191.96.37.100]:55615: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.63.102.97
country_id: 2510769
description:
2025-11-30 14:56:53 dovecot_login authenticator failed for (212-63-102-97.static.electricasollerense.es) [212.63.102.97]:59554: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2025-11-30 14:56:33 dovecot_login authenticator failed for ns3241969.ip-57-129-90.eu [57.129.90.215]:53882: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.132
country_id: 1210997
description:
2025-11-30 14:59:30 dovecot_login authenticator failed for (ADMIN) [64.64.112.132]:12420: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 15:02:07 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<oCQoicxEhpAXXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 15:04:57 host2 sshd[3690105]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-11-30 15:06:56 dovecot_login authenticator failed for ([84.213.189.27]) [84.213.189.27]:57723: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.90
country_id: 1643084
description:
Nov 30 15:11:34 host2 sshd[3693941]: Disconnected from invalid user openvpn 103.187.146.90 port 48522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 15:13:15 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<mI7+sMxEgLoXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.90
country_id: 1643084
description:
Nov 30 15:15:17 host2 sshd[3696190]: Disconnected from invalid user jeremy 103.187.146.90 port 56906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 30 15:15:46 host2 sshd[3696392]: Invalid user visionsolutionshospital from 154.219.110.64 port 55238


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.203.85.81
country_id: 2963597
description:
Denial of Service (DoS) attack was discovered from 18.203.85.81: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.146.90
country_id: 1643084
description:
Nov 30 15:17:58 host2 sshd[3697479]: Disconnected from invalid user cat 103.187.146.90 port 59250 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-30 15:19:18 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:42363: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.10.111
country_id: 927384
description:
2025-11-30 15:19:29 dovecot_login authenticator failed for ([196.216.10.111]) [196.216.10.111]:56333: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 30 15:20:39 host2 sshd[3698935]: Disconnected from invalid user gg 46.101.206.166 port 59592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 30 15:21:42 host2 sshd[3699448]: Disconnected from invalid user liyang 46.101.206.166 port 48444 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.201
country_id: 6252001
description:
Nov 30 15:22:07 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.201, lip=66.85.158.92, TLS, session=<HL3J0MxEtvHG6xjJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.90
country_id: 1643084
description:
Nov 30 15:23:10 host2 sshd[3700201]: Disconnected from invalid user sftp 103.187.146.90 port 50248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.63.238
country_id: 337996
description:
Nov 30 15:23:18 host2 sshd[3700310]: Disconnected from invalid user user 196.188.63.238 port 59620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 30 15:23:47 host2 sshd[3700506]: Disconnected from invalid user kafka 46.101.206.166 port 52802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.206.166
country_id: 2921044
description:
Nov 30 15:25:47 host2 sshd[3701845]: Disconnected from invalid user copia 46.101.206.166 port 51896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.63.238
country_id: 337996
description:
Nov 30 15:29:07 host2 sshd[3703774]: Disconnected from invalid user onkar 196.188.63.238 port 35678 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.143
country_id: 3041565
description:
2025-11-30 15:33:14 dovecot_login authenticator failed for (ADMIN) [173.239.217.143]:27681: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.142.55.40
country_id: 1861060
description:
2025-11-30 15:35:20 dovecot_login authenticator failed for 40.55.142.133.rev.iijmobile.jp [133.142.55.40]:34025: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.154.129
country_id: 6252001
description:
Nov 30 15:45:11 host2 pure-ftpd[3713840]: (?@199.45.154.129) [INFO] New connection from 199.45.154.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-30 15:45:29 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:52904: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.250.132.49
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 160.250.132.49 - Itemid=480&amp "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-11-30 15:45:58 dovecot_login authenticator failed for (223-197-145-126.static.imsbiz.com) [223.197.145.126]:59159: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.17
country_id: 6252001
description:
2025-11-30 15:49:22 dovecot_login authenticator failed for (ADMIN) [173.244.56.17]:22169: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.27.176.228
country_id: 6252001
description:
2025-11-30 15:50:30 dovecot_login authenticator failed for (YkQUaMJ) [23.27.176.228]:61018: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.55.131.3
country_id: 6252001
description:
Nov 30 15:51:13 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=203.55.131.3, lip=66.85.158.91, session=<vAjgOM1E+qjLN4MD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.27.176.228
country_id: 6252001
description:
2025-11-30 15:51:20 dovecot_login authenticator failed for (7iy3t9gZ) [23.27.176.228]:63848: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.27.176.228
country_id: 6252001
description:
2025-11-30 15:54:20 dovecot_login authenticator failed for (jeEP1nHf) [23.27.176.228]:65258: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 30 15:56:47 host2 sshd[3720838]: Disconnected from invalid user student 178.128.147.10 port 58604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 15:59:48 host2 sshd[3722393]: Disconnected from invalid user guest 2.57.121.112 port 62434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 30 16:00:16 host2 sshd[3722976]: Disconnected from invalid user keri 62.60.131.157 port 17996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 30 16:00:20 host2 sshd[3723067]: Disconnected from invalid user django 178.128.147.10 port 35114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Nov 30 16:02:18 host2 sshd[3724011]: Disconnected from invalid user developer 154.83.15.200 port 50550 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 30 16:02:27 host2 sshd[3724103]: Disconnected from invalid user grid 178.128.147.10 port 49172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 30 16:03:28 host2 sshd[3725267]: Disconnected from invalid user ubuntu 178.128.147.10 port 37840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Nov 30 16:03:33 host2 sshd[3725302]: Disconnected from invalid user monitoring 154.83.15.200 port 49324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.147.10
country_id: 6252001
description:
Nov 30 16:04:30 host2 sshd[3725776]: Disconnected from invalid user oracle 178.128.147.10 port 40702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Nov 30 16:04:48 host2 sshd[3725939]: Disconnected from invalid user root1 154.83.15.200 port 48104 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov 30 16:05:21 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Wslua81EbE1ChJl1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.189.160
country_id: 6252001
description:
Nov 30 16:05:33 host2 sshd[3726637]: Disconnected from invalid user odoo15 64.23.189.160 port 35160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.148
country_id: 2782113
description:
2025-11-30 16:06:29 dovecot_login authenticator failed for (ADMIN) [156.146.60.148]:18769: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.200
country_id: 1819730
description:
Nov 30 16:07:17 host2 sshd[3727471]: Disconnected from invalid user oracle 154.83.15.200 port 45638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.189.160
country_id: 6252001
description:
Nov 30 16:08:48 host2 sshd[3728250]: Disconnected from invalid user dd 64.23.189.160 port 42284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 16:10:17 host2 sshd[3729531]: Disconnected from invalid user  2.57.121.112 port 62936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.189.160
country_id: 6252001
description:
Nov 30 16:11:02 host2 sshd[3730011]: Disconnected from invalid user desliga 64.23.189.160 port 58362 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Nov 30 16:10:09 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sysnytech.com>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<ynprfM1ElrJ283VD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Nov 30 16:11:50 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.92, session=<+i6jgs1EEnJBMRRE>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 16:14:04 host2 sshd[3732110]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 16:14:51 host2 sshd[3732719]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.204
country_id: 6252001
description:
2025-11-30 16:20:45 dovecot_login authenticator failed for (ADMIN) [91.124.17.204]:47030: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.147.46.240
country_id: 298795
description:
Nov 30 16:23:49 host2 sshd[3738541]: Disconnected from invalid user customer 45.147.46.240 port 54532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.123.134.194
country_id: 6252001
description:
Nov 30 16:27:49 host2 sshd[3741246]: Disconnected from invalid user terraria 34.123.134.194 port 58396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.123.134.194
country_id: 6252001
description:
Nov 30 16:30:36 host2 sshd[3743231]: Disconnected from invalid user ionadmin 34.123.134.194 port 33590 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.117.131
country_id: 3144096
description:
2025-11-30 16:32:04 dovecot_login authenticator failed for (cm-46.212.117.131.get.no) [46.212.117.131]:55156: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.123.134.194
country_id: 6252001
description:
Nov 30 16:31:58 host2 sshd[3743907]: Disconnected from invalid user server 34.123.134.194 port 35176 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 30 16:33:10 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<213lzs1EhMwDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.78.13.13
country_id: 732800
description:
2025-11-30 16:32:18 dovecot_login authenticator failed for inkas.networx-bg.com [77.78.13.13]:58366: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 30 16:33:36 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<EeV50M1EeJwDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.123.134.194
country_id: 6252001
description:
Nov 30 16:34:23 host2 sshd[3745263]: Disconnected from invalid user syncthing 34.123.134.194 port 38364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.178.67
country_id: 6252001
description:
Nov 30 16:36:04 host2 sshd[3746545]: Disconnected from invalid user fred 172.173.178.67 port 47962 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 30 16:35:20 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<nHGt1s1Egq4Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-30 16:36:00 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:35374: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-30 16:36:14 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:35483: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 30 16:37:05 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<3FHw3M1EONIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 30 16:37:27 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<fM043s1EXKYDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.70
country_id: 2658434
description:
2025-11-30 16:37:35 dovecot_login authenticator failed for (ADMIN) [158.173.152.70]:35217: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.147.46.240
country_id: 298795
description:
Nov 30 16:37:18 host2 sshd[3747175]: Disconnected from invalid user guest123 45.147.46.240 port 48832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.131.159
country_id: 6252001
description:
Nov 30 16:37:20 host2 sshd[3747192]: Invalid user cloudtourssrilan_travel from 124.198.131.159 port 51682


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 30 16:39:07 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<aGkz5M1EQsQDg9cm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.147.46.240
country_id: 298795
description:
Nov 30 16:39:02 host2 sshd[3748144]: Disconnected from invalid user fred 45.147.46.240 port 44056 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 30 16:39:19 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS, session=<Cz7g5M1EuKkDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 30 16:40:38 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<enSY6c1EluIDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 30 16:41:24 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9K5X7M1EMIUDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 30 16:42:24 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<TXDu781EBqIDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 30 16:42:37 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<yNmN8M1EOp6SOC+J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.178.67
country_id: 6252001
description:
Nov 30 16:46:14 host2 sshd[3752602]: Disconnected from invalid user sftpuser 172.173.178.67 port 48398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.201.96
country_id: 2750405
description:
Nov 30 16:48:53 host2 sshd[3753892]: Disconnected from invalid user superadmin 31.57.201.96 port 44624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 16:50:04 host2 sshd[3754553]: Disconnected from invalid user admin 2.57.121.112 port 17166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Nov 30 16:50:12 host2 sshd[3754686]: Disconnected from invalid user bitwarden 20.203.42.204 port 32782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Nov 30 16:51:46 host2 sshd[3755625]: Disconnected from invalid user es 20.203.42.204 port 36270 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.7
country_id: 174982
description:
2025-11-30 16:52:07 dovecot_login authenticator failed for (ADMIN) [185.253.160.7]:50785: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.46.57.54
country_id: 102358
description:
Nov 30 16:52:20 host2 sshd[3755889]: Disconnected from invalid user castle 101.46.57.54 port 59998 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.203.42.204
country_id: 290557
description:
Nov 30 16:52:59 host2 sshd[3756177]: Disconnected from invalid user bitrix 20.203.42.204 port 49136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Nov 30 16:54:18 host2 sshd[3757343]: Disconnected from invalid user asterisk 20.203.42.204 port 51402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.57.201.96
country_id: 2750405
description:
Nov 30 16:55:05 host2 sshd[3757992]: Disconnected from invalid user precio01 31.57.201.96 port 52146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.46.57.54
country_id: 102358
description:
Nov 30 16:55:52 host2 sshd[3758540]: Disconnected from invalid user tecnopos 101.46.57.54 port 49056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.178.67
country_id: 6252001
description:
Nov 30 16:55:58 host2 sshd[3758544]: Disconnected from invalid user guest123 172.173.178.67 port 52028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.57.201.96
country_id: 2750405
description:
Nov 30 16:56:07 host2 sshd[3758683]: Disconnected from invalid user dev 31.57.201.96 port 41778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.46.57.54
country_id: 102358
description:
Nov 30 16:57:08 host2 sshd[3759174]: Disconnected from invalid user dev 101.46.57.54 port 54992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Nov 30 17:02:16 host2 sshd[3762096]: Disconnected from invalid user student 199.195.248.191 port 57790 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.248.191
country_id: 6252001
description:
Nov 30 17:04:27 host2 sshd[3763816]: Disconnected from invalid user developer 199.195.248.191 port 55154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Nov 30 17:05:31 host2 sshd[3764644]: Disconnected from invalid user weblogic 199.195.248.191 port 53834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Nov 30 17:06:19 host2 sshd[3765148]: Disconnected from invalid user test 122.165.121.195 port 51140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Nov 30 17:06:36 host2 sshd[3765253]: Disconnected from invalid user tech 199.195.248.191 port 52514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 1819730
description:
Nov 30 17:07:41 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.100.48, lip=66.85.158.91, session=<Wk03Ss5ElOXE+2Qw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.142
country_id: 6251999
description:
2025-11-30 17:08:12 dovecot_login authenticator failed for (ADMIN) [66.56.80.142]:45521: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 30 17:08:18 host2 sshd[3766249]: Disconnected from invalid user sarahi 62.60.131.157 port 26048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Nov 30 17:09:23 host2 sshd[3766923]: Disconnected from invalid user 1 122.165.121.195 port 39082 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.165.121.195
country_id: 1269750
description:
Nov 30 17:10:50 host2 sshd[3767973]: Disconnected from invalid user tech 122.165.121.195 port 60648 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-30 17:11:48 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:36808: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-30 17:12:04 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:46298: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 17:12:26 host2 sshd[3768994]: Disconnected from invalid user admin 2.57.121.112 port 23809 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-30 17:12:16 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:40518: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-30 17:14:38 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49209: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 17:15:53 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ngOLZ85EjtYXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.119
country_id: 6252001
description:
Nov 30 17:16:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.119, lip=66.85.158.92, TLS: Connection closed, session=<5yKoaM5EEJHHLZp3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.165.121.195
country_id: 1269750
description:
Nov 30 17:18:14 host2 sshd[3772401]: Disconnected from invalid user redmine 122.165.121.195 port 54936 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.74
country_id: 1880251
description:
Nov 30 17:22:33 host2 sshd[3774830]: Disconnected from invalid user ben 45.78.229.74 port 35740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.141.40.187
country_id: 3469034
description:
Nov 30 17:25:06 host2 sshd[3776354]: Disconnected from invalid user deployer 200.141.40.187 port 44414 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.18
country_id: 1821275
description:
2025-11-30 17:25:47 dovecot_login authenticator failed for (ADMIN) [84.252.92.18]:7557: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Nov 30 17:26:26 host2 sshd[3777331]: Disconnected from invalid user zhangsan 186.30.115.187 port 55204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-11-30 17:27:05 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:51202: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 17:28:05 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<28suk85EgIkXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-11-30 17:27:19 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:37890: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.89.170.4
country_id: 3469034
description:
Nov 30 17:27:46 host2 sshd[3778138]: Disconnected from invalid user alma 177.89.170.4 port 58394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-11-30 17:28:50 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:43773: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-11-30 17:29:05 dovecot_login authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:44076: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.89.170.4
country_id: 3469034
description:
Nov 30 17:30:10 host2 sshd[3779900]: Disconnected from invalid user exx 177.89.170.4 port 60278 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.229.74
country_id: 1880251
description:
Nov 30 17:29:41 host2 sshd[3779416]: Disconnected from invalid user grid 45.78.229.74 port 36050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.141.40.187
country_id: 3469034
description:
Nov 30 17:30:59 host2 sshd[3780531]: Disconnected from invalid user localhost 200.141.40.187 port 46076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Nov 30 17:31:20 host2 sshd[3780791]: Disconnected from invalid user hamed 64.227.102.57 port 53374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.89.170.4
country_id: 3469034
description:
Nov 30 17:31:39 host2 sshd[3781002]: Disconnected from invalid user smart 177.89.170.4 port 55846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Nov 30 17:32:58 host2 sshd[3781877]: Disconnected from invalid user alex 118.194.230.250 port 36192 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.89.170.4
country_id: 3469034
description:
Nov 30 17:33:01 host2 sshd[3781900]: Disconnected from invalid user guest123 177.89.170.4 port 55184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.141.40.187
country_id: 3469034
description:
Nov 30 17:34:10 host2 sshd[3782685]: Disconnected from invalid user zhangsan 200.141.40.187 port 43096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Nov 30 17:33:54 host2 sshd[3782524]: Disconnected from invalid user javad 186.30.115.187 port 44620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.144
country_id: 1880251
description:
Nov 30 17:33:55 host2 sshd[3782529]: Disconnected from invalid user docker 45.78.229.144 port 55560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Nov 30 17:34:18 host2 sshd[3782787]: Disconnected from invalid user zhangsan 118.194.230.250 port 36292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Nov 30 17:35:31 host2 sshd[3783700]: Disconnected from invalid user deploy 118.194.230.250 port 36386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.141.40.187
country_id: 3469034
description:
Nov 30 17:35:38 host2 sshd[3783784]: Disconnected from invalid user admin 200.141.40.187 port 41790 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.250
country_id: 1861060
description:
Nov 30 17:36:42 host2 sshd[3784500]: Disconnected from invalid user admin 118.194.230.250 port 36480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Nov 30 17:37:28 host2 sshd[3785294]: Disconnected from invalid user hadoop 64.227.102.57 port 45526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.144
country_id: 1880251
description:
Nov 30 17:37:35 host2 sshd[3785408]: Disconnected from invalid user ansible 45.78.229.144 port 43490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.62
country_id: 1643084
description:
Nov 30 17:37:35 host2 sshd[3785449]: Disconnected from invalid user userb 103.59.94.62 port 56344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.30.115.187
country_id: 3686110
description:
Nov 30 17:38:20 host2 sshd[3786371]: Disconnected from invalid user hadoop 186.30.115.187 port 34054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Nov 30 17:39:53 host2 sshd[3787439]: Disconnected from invalid user stperez 64.227.102.57 port 47844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.62
country_id: 1643084
description:
Nov 30 17:40:42 host2 sshd[3788143]: Disconnected from invalid user dev 103.59.94.62 port 40484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.39
country_id: 2802361
description:
2025-11-30 17:40:45 dovecot_login authenticator failed for (ADMIN) [181.214.218.39]:57496: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.59.94.62
country_id: 1643084
description:
Nov 30 17:42:03 host2 sshd[3789137]: Disconnected from invalid user elsearch 103.59.94.62 port 45182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Nov 30 17:42:58 host2 sshd[3789608]: Disconnected from invalid user ansible 101.47.135.95 port 52346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.59.94.62
country_id: 1643084
description:
Nov 30 17:43:26 host2 sshd[3789965]: Disconnected from invalid user ghost 103.59.94.62 port 52312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 30 17:44:44 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=</y6/zs5ERnFRvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Nov 30 17:44:48 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.202.9.133, lip=66.85.158.92, TLS: Connection closed, session=<6Mccz85E8OgjygmF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.144
country_id: 1880251
description:
Nov 30 17:47:07 host2 sshd[3793116]: Disconnected from invalid user client 45.78.229.144 port 51086 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.64.98.14
country_id: 1655842
description:
Nov 30 17:48:07 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.64.98.14, lip=66.85.158.91, session=<CsPs2s5EoqtAQGIO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.154.153.30
country_id: 3923057
description:
Nov 30 17:48:06 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.154.153.30, lip=66.85.158.91, session=<oujo2s5Erqstmpke>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-30 17:51:49 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:52174: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-30 17:51:28 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:57409: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Nov 30 17:51:47 host2 sshd[3796500]: Disconnected from invalid user gitlab 101.47.135.95 port 50866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.144
country_id: 1880251
description:
Nov 30 17:54:05 host2 sshd[3798282]: Disconnected from invalid user seafile 45.78.229.144 port 45880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.21.226
country_id: 6251999
description:
2025-11-30 17:54:02 dovecot_login authenticator failed for (ADMIN) [140.228.21.226]:6216: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.135.95
country_id: 1880251
description:
Nov 30 18:00:36 host2 sshd[3803186]: Disconnected from invalid user sonarqube 101.47.135.95 port 51710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Nov 30 18:02:47 host2 sshd[3805003]: Disconnected from invalid user alex 101.47.135.95 port 39602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.144
country_id: 1880251
description:
Nov 30 18:04:04 host2 sshd[3806455]: Disconnected from invalid user tomcat 45.78.229.144 port 38848 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 18:05:18 host2 sshd[3807574]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 18:05:42 host2 sshd[3807804]: Disconnected from invalid user admin 2.57.121.112 port 46768 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 18:08:51 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<xU7nJM9EfuUXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.252
country_id: 6252001
description:
Nov 30 18:13:09 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.125.252, lip=66.85.158.91, session=<E0J5NM9EmqINWX38>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 18:14:41 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<U0XwOc9E3KYDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.17
country_id: 390903
description:
2025-11-30 18:14:43 dovecot_login authenticator failed for (ADMIN) [79.127.181.17]:1342: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 18:16:00 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<VBOrPs9EzIoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 18:17:53 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<F91mRc9ErqcDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.67.184
country_id: 2921044
description:
Nov 30 18:18:11 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.226.67.184, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<GVtzRs9EM69A4kO4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-11-30 18:18:29 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:56292: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.101.182
country_id: 2921044
description:
Nov 30 18:18:46 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=157.230.101.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8fqNSM9E0qKd5mW2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-11-30 18:19:13 dovecot_login authenticator failed for ([182.95.52.206]) [182.95.52.206]:56008: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 18:19:48 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<hK9BTM9EmroDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 18:20:42 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<NvxTT89E/M4XXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 18:21:42 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<er0GU89EEIMDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 18:21:48 host2 dovecot[3366265]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<qXxtU89E3owDiUnd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.241.218
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.55.241.218 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.225.54
country_id: 2921044
description:
Nov 30 18:23:22 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=46.101.225.54, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4ccAWc9EkJguZeE2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 30 18:24:43 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<XLXcXc9Elq4DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-11-30 18:25:53 dovecot_login authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:58900: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2025-11-30 18:25:28 dovecot_login authenticator failed for ([167.250.118.3]) [167.250.118.3]:43930: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 30 18:26:15 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<oxRMY89E/qOLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2025-11-30 18:26:24 dovecot_login authenticator failed for ([182.176.4.105]) [182.176.4.105]:49845: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.174.244.189
country_id: 6252001
description:
Nov 30 18:28:44 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.174.244.189, lip=66.85.158.91, session=<vc04bM9EIoesrvS9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.33.22
country_id: 6252001
description:
Nov 30 18:28:51 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.163.33.22, lip=66.85.158.92, session=<4yqZbM9E+KIUoyEW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.39.118
country_id: 2635167
description:
Nov 30 18:29:53 host2 sshd[3825603]: Disconnected from invalid user cumulus 157.245.39.118 port 43868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.136
country_id: 1210997
description:
2025-11-30 18:31:20 dovecot_login authenticator failed for (ADMIN) [64.64.112.136]:49540: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 30 18:32:19 host2 sshd[3826970]: Disconnected from invalid user tech 196.196.253.20 port 53814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 30 18:33:56 host2 sshd[3827779]: Disconnected from invalid user t3rr0r 196.196.253.20 port 53958 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 30 18:35:02 host2 sshd[3828462]: Disconnected from invalid user cumulus 196.196.253.20 port 54082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.39.118
country_id: 2635167
description:
Nov 30 18:34:52 host2 sshd[3828388]: Disconnected from invalid user kevin 157.245.39.118 port 35666 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.119.96.68
country_id: 6252001
description:
Nov 30 18:35:32 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.119.96.68, lip=66.85.158.92, session=<EqV/hM9EVI6Hd2BE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.210.22.123
country_id: 953987
description:
Nov 30 18:35:43 host2 sshd[3829035]: Disconnected from invalid user erpnext 168.210.22.123 port 33424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 30 18:36:06 host2 sshd[3829272]: Disconnected from invalid user openbravo 196.196.253.20 port 54206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.97.8
country_id: 1819730
description:
Nov 30 18:36:26 host2 sshd[3829416]: Disconnected from invalid user ubuntu 154.219.97.8 port 51180 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-11-30 18:37:18 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:64509: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-11-30 18:37:30 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:43814: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Nov 30 18:38:42 host2 sshd[3830675]: Disconnected from invalid user panda 42.200.66.164 port 56834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.196.253.20
country_id: 2635167
description:
Nov 30 18:38:17 host2 sshd[3830451]: Disconnected from invalid user cashier 196.196.253.20 port 54464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.39.118
country_id: 2635167
description:
Nov 30 18:38:21 host2 sshd[3830499]: Disconnected from invalid user teste 157.245.39.118 port 51750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-11-30 18:39:53 dovecot_login authenticator failed for ([65.20.150.36]) [65.20.150.36]:42612: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.97.8
country_id: 1819730
description:
Nov 30 18:40:06 host2 sshd[3831814]: Disconnected from invalid user roott 154.219.97.8 port 44962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.254.129
country_id: 1668284
description:
Nov 30 18:40:43 host2 sshd[3832189]: Disconnected from invalid user test 118.194.254.129 port 32320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.39.118
country_id: 2635167
description:
Nov 30 18:40:44 host2 sshd[3832203]: Disconnected from invalid user openbravo 157.245.39.118 port 50142 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.39.118
country_id: 2635167
description:
Nov 30 18:41:51 host2 sshd[3832727]: Disconnected from invalid user tomcat 157.245.39.118 port 58484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.97.8
country_id: 1819730
description:
Nov 30 18:44:32 host2 sshd[3834588]: Disconnected from invalid user bounce 154.219.97.8 port 45186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.210.22.123
country_id: 953987
description:
Nov 30 18:44:33 host2 sshd[3834591]: Disconnected from invalid user userm 168.210.22.123 port 49486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 30 18:44:48 host2 sshd[3834694]: Disconnected from invalid user jrodrig 198.1.117.220 port 48440 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.210.22.123
country_id: 953987
description:
Nov 30 18:46:58 host2 sshd[3836320]: Disconnected from invalid user bounce 168.210.22.123 port 55320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.254.129
country_id: 1668284
description:
Nov 30 18:46:13 host2 sshd[3835966]: Disconnected from invalid user jacob 118.194.254.129 port 30376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.254.129
country_id: 1668284
description:
Nov 30 18:47:32 host2 sshd[3836664]: Disconnected from invalid user bounce 118.194.254.129 port 57388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.254.129
country_id: 1668284
description:
Nov 30 18:48:52 host2 sshd[3837504]: Disconnected from invalid user teamspeak 118.194.254.129 port 29404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Nov 30 18:48:24 host2 sshd[3837237]: Disconnected from invalid user remote 42.200.66.164 port 52328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.210.22.123
country_id: 953987
description:
Nov 30 18:48:28 host2 sshd[3837278]: Disconnected from invalid user superset 168.210.22.123 port 52452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 30 18:49:13 host2 sshd[3837784]: Disconnected from invalid user toto 198.1.117.220 port 43568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.249.96.38
country_id: 3996063
description:
Nov 30 18:49:16 host2 sshd[3837808]: Disconnected from invalid user guest123 207.249.96.38 port 52808 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.1.117.220
country_id: 6252001
description:
Nov 30 18:50:24 host2 sshd[3838654]: Disconnected from invalid user test 198.1.117.220 port 42352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.249.96.38
country_id: 3996063
description:
Nov 30 18:50:30 host2 sshd[3838709]: Disconnected from invalid user ubuntu 207.249.96.38 port 59498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-30 18:50:56 dovecot_login authenticator failed for ([182.95.115.70]) [182.95.115.70]:54770: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.14
country_id: 102358
description:
2025-11-30 18:50:57 dovecot_login authenticator failed for (ADMIN) [95.181.235.14]:19484: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2025-11-30 18:51:54 dovecot_login authenticator failed for ([195.158.14.232]) [195.158.14.232]:55158: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 18:56:27 host2 sshd[3843322]: Disconnected from invalid user default 2.57.121.112 port 61845 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-30 18:59:05 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:49216: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 30 18:59:23 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<brmu2c9E3z5RvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.194.166
country_id: 1269750
description:
2025-11-30 18:59:31 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:44220: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.47.24
country_id: 6252001
description:
2025-11-30 19:02:31 dovecot_plain authenticator failed for ([10.21.18.223]) [84.239.47.24]:59072: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Nov 30 19:05:27 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.120, lip=66.85.158.92, TLS: Connection closed, session=<WySH789ESH5ChJl4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.140.111
country_id: 1819730
description:
2025-11-30 19:12:13 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:8394: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 30 19:21:32 host2 sshd[3859795]: Disconnected from invalid user admin 2.57.121.112 port 30188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-11-30 19:25:49 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:46537: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-11-30 19:26:23 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:59274: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-11-30 19:26:31 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:51296: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-11-30 19:26:52 dovecot_login authenticator failed for ([152.52.169.97]) [122.186.60.142]:44882: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.65
country_id: 6252001
description:
Nov 30 19:30:28 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.104.65, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<eZ/ySNBEdO0UQGhB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-11-30 19:30:55 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:41300: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-11-30 19:31:15 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:55466: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-11-30 19:39:01 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:44265: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.164
country_id: 1269750
description:
2025-11-30 19:39:14 dovecot_login authenticator failed for ([182.79.218.164]) [182.79.218.164]:50497: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.247.105.224
country_id: 6251999
description:
2025-11-30 19:39:18 dovecot_login authenticator failed for (ADMIN) [84.247.105.224]:55956: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 30 19:50:25 host2 sshd[3880008]: Disconnected from invalid user user 2.57.121.25 port 23905 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-30 19:53:15 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:35366: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.30.139.241
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 149.30.139.241 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-30 19:53:35 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:44690: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-11-30 19:54:06 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:34597: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2025-11-30 19:54:46 dovecot_login authenticator failed for ([125.23.125.209]) [122.187.59.26]:58182: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-30 19:55:15 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:39024: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-30 19:55:33 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:50625: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 19:57:48 host2 sshd[3884510]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 19:58:36 host2 sshd[3885034]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.130.148.125
country_id: 1512440
description:
Nov 30 20:07:57 host2 sshd[3890462]: Disconnected from invalid user share 45.130.148.125 port 53814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.119.75.60
country_id: 6252001
description:
Nov 30 20:10:05 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.119.75.60, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ipam1tBEPM8Ud0s8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.130.148.125
country_id: 1512440
description:
Nov 30 20:09:15 host2 sshd[3891491]: Disconnected from invalid user stperez 45.130.148.125 port 44386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.130.148.125
country_id: 1512440
description:
Nov 30 20:10:26 host2 sshd[3892485]: Disconnected from invalid user amssys 45.130.148.125 port 40308 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Nov 30 20:10:46 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<Xhn42NBEHN7Cw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-11-30 20:11:43 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:55902: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-30 20:11:17 dovecot_login authenticator failed for ([125.19.251.90]) [125.19.251.90]:43656: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 188.166.152.199
country_id: 2635167
description:
Nov 30 20:14:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=188.166.152.199, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xYMr5dBENMK8ppjH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.130.148.125
country_id: 1512440
description:
Nov 30 20:14:18 host2 sshd[3895175]: Disconnected from invalid user testadmin 45.130.148.125 port 46166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.41
country_id: 3625428
description:
2025-11-30 20:17:45 dovecot_login authenticator failed for (ADMIN) [95.181.237.41]:46354: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-11-30 20:19:25 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:63211: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.204.232.244
country_id: 1269750
description:
2025-11-30 20:19:11 dovecot_login authenticator failed for ([49.204.232.244]) [49.204.232.244]:39646: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.202
country_id: 6252001
description:
Nov 30 20:19:23 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=147.185.132.202, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<54Lt99BEb8iTuYTK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-11-30 20:20:19 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:33647: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-30 20:20:29 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:59236: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.202
country_id: 6252001
description:
Nov 30 20:20:29 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=147.185.132.202, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<scDb+9BE2uSTuYTK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.202
country_id: 6252001
description:
Nov 30 20:21:09 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.132.202, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<ohs//tBE3uOTuYTK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.245
country_id: 6252001
description:
Nov 30 20:22:21 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.245, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<MVqHAtFEScyi2Jb1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.202
country_id: 6252001
description:
Nov 30 20:28:34 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.202, lip=66.85.158.91, TLS, session=<SsLJGNFEXO6TuYTK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.245
country_id: 6252001
description:
Nov 30 20:30:02 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.245, lip=66.85.158.92, TLS, session=<0N/6HdFE4Pii2Jb1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.202
country_id: 6252001
description:
Nov 30 20:29:24 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.202, lip=66.85.158.91, TLS, session=<3Ny1G9FEqOGTuYTK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.229
country_id: 718075
description:
2025-11-30 20:33:35 dovecot_login authenticator failed for (ADMIN) [185.225.28.229]:8022: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-30 20:38:48 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:38458: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-30 20:41:08 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:42696: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-30 20:42:06 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:44489: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-30 20:48:52 dovecot_login authenticator failed for ([128.185.199.14]) [128.185.199.14]:40728: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
country_id: 3144096
description:
2025-11-30 20:49:06 dovecot_login authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:39669: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov 30 21:02:07 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, session=<UX28kNFEZf4t4/6Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Nov 30 21:03:15 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I7LNlNFEQKFAPpyE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.106.74.117
country_id: 719819
description:
2025-11-30 21:05:36 dovecot_login authenticator failed for (ADMIN) [86.106.74.117]:50083: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-30 21:08:04 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59515: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-11-30 21:17:03 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:36676: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-11-30 21:16:49 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:40646: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.34
country_id: 953987
description:
2025-11-30 21:21:17 dovecot_login authenticator failed for (ADMIN) [154.47.30.34]:11490: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.206.250
country_id: 6252001
description:
Nov 30 21:22:03 host2 pure-ftpd[3941164]: (?@165.154.206.250) [INFO] New connection from 165.154.206.250


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.206.250
country_id: 6252001
description:
Nov 30 21:22:07 host2 pure-ftpd[3941194]: (?@165.154.206.250) [INFO] New connection from 165.154.206.250


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.129.43
country_id: 2635167
description:
Nov 30 21:22:48 host2 dovecot[3366265]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.129.43, lip=66.85.158.92, session=<wB+y2tFE/oClmoEr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.129.43
country_id: 2635167
description:
Nov 30 21:22:47 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.129.43, lip=66.85.158.92, session=<YNOf2tFECIClmoEr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-11-30 21:31:43 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:58936: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 21:32:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<iXMZ/NFEAJQXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-30 21:32:21 dovecot_login authenticator failed for ([182.95.22.249]) [128.185.194.22]:53756: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov 30 21:33:31 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.254, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+OAJAdJEnkG4aff+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.28
country_id: 3194884
description:
2025-11-30 21:38:00 dovecot_login authenticator failed for (ADMIN) [176.125.229.28]:50417: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.22
country_id: 6252001
description:
Nov 30 21:39:26 host2 pure-ftpd[3953603]: (?@147.185.132.22) [INFO] New connection from 147.185.132.22


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 21:43:52 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<kUXuJdJEJNIXXz9j>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.144
country_id: 2635167
description:
Nov 30 21:51:22 host2 pure-ftpd[3974766]: (?@185.247.137.144) [INFO] New connection from 185.247.137.144


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-30 21:52:28 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:45067: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.194
country_id: 6252001
description:
Nov 30 21:52:28 host2 pure-ftpd[3975385]: (?@205.210.31.194) [INFO] New connection from 205.210.31.194


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.34
country_id: 3057568
description:
2025-11-30 21:53:55 dovecot_login authenticator failed for (ADMIN) [149.102.232.34]:42385: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 30 21:54:23 host2 sshd[3977035]: Disconnected from invalid user kelly 62.60.131.157 port 23456 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.102
country_id: 1269750
description:
2025-11-30 21:56:14 dovecot_login authenticator failed for ([182.95.112.102]) [182.95.112.102]:39824: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-30 21:56:28 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:55323: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-30 22:01:37 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:41750: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-11-30 22:02:10 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:37914: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-11-30 22:07:15 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:41754: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.89.170.72
country_id: 1522867
description:
2025-11-30 22:07:34 dovecot_login authenticator failed for 178.89.170.72.dynamic.telecom.kz [178.89.170.72]:46208: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-30 22:11:05 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:42528: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-11-30 22:11:31 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:43663: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-11-30 22:14:56 dovecot_login authenticator failed for ([127.0.0.1]) [178.232.120.182]:33585: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-30 22:14:25 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:38188: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-11-30 22:14:42 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:40738: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.125.238.198
country_id: 3865483
description:
2025-11-30 22:14:49 dovecot_login authenticator failed for host198.186-125-238.telecom.net.ar ([127.0.0.1]) [186.125.238.198]:41167: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.104.142
country_id: 2077456
description:
2025-11-30 22:16:59 dovecot_login authenticator failed for ([123.209.104.142]) [123.209.104.142]:60164: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.4.247
country_id: 6252001
description:
2025-11-30 22:17:19 dovecot_login authenticator failed for (mobile-166-195-004-247.mycingular.net) [166.195.4.247]:46882: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Nov 30 22:17:34 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<TZV2ntJEApdRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-11-30 22:17:42 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:54005: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.22.72.144
country_id: 2921044
description:
Nov 30 22:22:01 host2 pure-ftpd[4001221]: (?@165.22.72.144) [INFO] New connection from 165.22.72.144


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Nov 30 22:25:07 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IHGUudJEGm9BMQE0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.63
country_id: 6252001
description:
Nov 30 22:24:49 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OSiCuNJEg5RBMQE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Nov 30 22:25:22 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS: Connection closed, session=<9Vd5utJE3MpBMQE0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 30 22:25:34 host2 sshd[4004591]: Disconnected from invalid user user 2.57.121.25 port 24547 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.87.129.145
country_id: 6252001
description:
Nov 30 22:27:16 host2 pure-ftpd[4006031]: (?@54.87.129.145) [INFO] New connection from 54.87.129.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.99
country_id: 390903
description:
2025-11-30 22:30:01 dovecot_login authenticator failed for (ADMIN) [79.127.181.99]:50871: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-30 22:41:37 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:55684: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-11-30 22:42:20 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:34530: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-30 22:42:37 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:58148: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 22:44:59 host2 sshd[4018188]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.153.99
country_id: 6251999
description:
2025-11-30 22:44:53 dovecot_login authenticator failed for (ADMIN) [181.214.153.99]:43810: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 30 22:45:39 host2 sshd[4018674]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.193.149
country_id: 1643084
description:
2025-11-30 22:45:41 dovecot_login authenticator failed for ([127.0.0.1]) [103.186.193.149]:59734: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-11-30 22:45:52 dovecot_login authenticator failed for ([127.0.0.1]) [46.212.119.125]:33113: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.222.126.213
country_id: 6252001
description:
2025-11-30 22:46:21 dovecot_login authenticator failed for c-73-222-126-213.hsd1.ca.comcast.net [73.222.126.213]:56340: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2025-11-30 22:46:39 dovecot_login authenticator failed for (scz-190-104-24-00006.tigo.bo) [190.104.24.6]:36674: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.164.240
country_id: 2921044
description:
Nov 30 22:54:00 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.227.164.240, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<J7LZINNEL3Gl46Tw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.164.240
country_id: 2921044
description:
Nov 30 22:54:12 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=165.227.164.240, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ghqWIdNEmyGl46Tw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.72.52
country_id: 2921044
description:
Nov 30 22:54:35 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=134.122.72.52, lip=66.85.158.92, TLS handshaking: Connection closed, session=<4/rzItNErKiGekg0>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.143.65.196
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 108.143.65.196 - info@idesignvector.com "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.123.73
country_id: 2921044
description:
Nov 30 23:01:43 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.232.123.73, lip=66.85.158.91, session=<hSFxPNNE0zal6HtJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.72.52
country_id: 2921044
description:
Nov 30 23:01:43 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=134.122.72.52, lip=66.85.158.91, session=<THV3PNNEKLiGekg0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-30 23:02:37 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:34516: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.68
country_id: 783754
description:
2025-11-30 23:02:48 dovecot_login authenticator failed for (ADMIN) [31.171.154.68]:54344: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-30 23:03:04 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:44707: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 30 23:03:55 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<u78uRNNExOqSOC+J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.69
country_id: 6252001
description:
Nov 30 23:04:37 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.69, lip=66.85.158.91, session=<W3fTRtNEOO3Y2s5F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Nov 30 23:09:48 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<D5g7WdNEbK3Cw3NV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.15.129.26
country_id: 1269750
description:
Nov 30 23:12:30 host2 sshd[4036169]: Disconnected from invalid user guest 122.15.129.26 port 61497 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-11-30 23:12:37 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:56162: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-11-30 23:12:23 dovecot_login authenticator failed for ([89.140.17.22]) [81.0.54.119]:55174: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.19
country_id: 6252001
description:
2025-11-30 23:16:54 dovecot_login authenticator failed for (ADMIN) [95.181.238.19]:45184: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.109
country_id: 6252001
description:
2025-11-30 23:16:56 dovecot_login authenticator failed for ([127.0.0.1]) [98.185.120.109]:38436: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.201.31
country_id: 3144096
description:
2025-11-30 23:17:03 dovecot_login authenticator failed for ([127.0.0.1]) [178.232.201.31]:48517: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Nov 30 23:17:58 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.53, lip=66.85.158.91, TLS: Connection closed, session=<moeNdtNELr2nXpI1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-11-30 23:17:33 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:36490: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-30 23:17:52 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:45582: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.133.16
country_id: 1819730
description:
Nov 30 23:22:12 host2 pure-ftpd[4042781]: (?@152.32.133.16) [INFO] New connection from 152.32.133.16


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.197
country_id: 6252001
description:
Nov 30 23:22:47 host2 pure-ftpd[4043248]: (?@64.62.197.197) [INFO] New connection from 64.62.197.197


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.172
country_id: 6252001
description:
Nov 30 23:22:53 host2 pure-ftpd[4043295]: (?@64.62.156.172) [INFO] New connection from 64.62.156.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-30 23:22:59 dovecot_login authenticator failed for ([122.185.145.54]) [122.185.145.54]:33824: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 30 23:29:22 host2 sshd[4047318]: Disconnected from invalid user terence 62.60.131.157 port 58306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.32.217
country_id: 1643084
description:
Nov 30 23:31:45 host2 sshd[4048621]: Disconnected from invalid user sammy 157.20.32.217 port 39386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.32.217
country_id: 1643084
description:
Nov 30 23:33:28 host2 sshd[4049389]: Disconnected from invalid user tuan 157.20.32.217 port 39776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-11-30 23:34:08 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:33000: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-11-30 23:34:28 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:42643: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 23:35:36 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<vQKHtdNEupwXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-11-30 23:36:40 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:50036: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.20.32.217
country_id: 1643084
description:
Nov 30 23:37:46 host2 sshd[4051847]: Disconnected from invalid user admin 157.20.32.217 port 33000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Nov 30 23:37:38 host2 sshd[4051739]: Disconnected from invalid user botuser 181.46.131.55 port 33204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.32.217
country_id: 1643084
description:
Nov 30 23:39:12 host2 sshd[4052869]: Disconnected from invalid user ghost 157.20.32.217 port 58520 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.42
country_id: 3625428
description:
2025-11-30 23:45:54 dovecot_login authenticator failed for (ADMIN) [95.181.237.42]:33642: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Nov 30 23:46:42 host2 sshd[4057659]: Disconnected from invalid user under 181.46.131.55 port 33700 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 30 23:48:01 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<h//p4dNEQtsXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.84.236.222
country_id: 1269750
description:
Nov 30 23:48:17 host2 sshd[4058917]: Disconnected from invalid user training 103.84.236.222 port 50488 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.84.236.222
country_id: 1269750
description:
Nov 30 23:51:57 host2 sshd[4060864]: Disconnected from invalid user db2fenc1 103.84.236.222 port 34966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.207
country_id: 1880251
description:
Nov 30 23:59:16 host2 sshd[4065847]: Disconnected from invalid user t3rr0r 45.78.207.207 port 34750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Nov 30 23:59:24 host2 sshd[4065953]: Disconnected from invalid user testuser 181.46.131.55 port 39338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec  1 00:01:13 host2 sshd[4067117]: Disconnected from invalid user ftpadmin 181.46.131.55 port 56694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.77.172.159
country_id: 3996063
description:
Dec  1 00:04:04 host2 sshd[4069205]: Disconnected from invalid user mika 200.77.172.159 port 48406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.10.47.6
country_id: 1643084
description:
Dec  1 00:04:56 host2 sshd[4069655]: Disconnected from invalid user ctf 114.10.47.6 port 35466 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.231
country_id: 3996063
description:
2025-12-01 00:04:36 dovecot_login authenticator failed for (ADMIN) [77.81.142.231]:56143: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-01 00:04:50 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:41234: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.46.131.55
country_id: 3865483
description:
Dec  1 00:04:52 host2 sshd[4069630]: Disconnected from invalid user deploy 181.46.131.55 port 35134 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-12-01 00:05:11 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:40777: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-12-01 00:05:26 dovecot_login authenticator failed for ([128.185.252.110]) [128.185.252.110]:39238: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.240
country_id: 1880251
description:
Dec  1 00:05:37 host2 sshd[4070241]: Disconnected from invalid user gitea 45.78.227.240 port 43068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-12-01 00:05:09 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:33020: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.234.222
country_id: 6252001
description:
Dec  1 00:06:15 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.248.234.222, lip=66.85.158.91, TLS, session=<Pbk8I9REuuxo+Ore>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec  1 00:06:36 host2 sshd[4070754]: Disconnected from invalid user sens 203.150.107.244 port 53988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.10.47.6
country_id: 1643084
description:
Dec  1 00:07:51 host2 sshd[4071580]: Disconnected from invalid user tester 114.10.47.6 port 41693 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.165.17
country_id: 6251999
description:
Dec  1 00:07:56 host2 sshd[4071617]: Disconnected from invalid user vpn 54.39.165.17 port 38536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec  1 00:08:15 host2 sshd[4071830]: Disconnected from invalid user javad 203.150.107.244 port 55540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec  1 00:08:30 host2 sshd[4071937]: Disconnected from invalid user retag 181.46.131.55 port 34798 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 114.10.47.6
country_id: 1643084
description:
Dec  1 00:09:14 host2 sshd[4072436]: Disconnected from invalid user runner 114.10.47.6 port 35467 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.165.17
country_id: 6251999
description:
Dec  1 00:10:21 host2 sshd[4073180]: Disconnected from invalid user tester 54.39.165.17 port 38522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.77.172.159
country_id: 3996063
description:
Dec  1 00:10:47 host2 sshd[4073414]: Disconnected from invalid user vpn 200.77.172.159 port 49496 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.77.172.159
country_id: 3996063
description:
Dec  1 00:11:57 host2 sshd[4074523]: Disconnected from invalid user foundry 200.77.172.159 port 51618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec  1 00:12:07 host2 sshd[4074698]: Disconnected from invalid user bounce 203.150.107.244 port 50560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  1 00:11:28 host2 sshd[4073815]: Disconnected from invalid user mika 182.18.139.237 port 46652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Dec  1 00:11:48 host2 sshd[4074294]: Disconnected from invalid user crafty 59.97.205.137 port 20130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  1 00:12:29 host2 sshd[4074907]: Disconnected from invalid user crafty 182.18.139.237 port 42276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.165.17
country_id: 6251999
description:
Dec  1 00:12:30 host2 sshd[4074923]: Disconnected from invalid user deployer 54.39.165.17 port 54892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec  1 00:13:22 host2 sshd[4075594]: Disconnected from invalid user runner 203.150.107.244 port 48894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.165.17
country_id: 6251999
description:
Dec  1 00:13:36 host2 sshd[4075701]: Disconnected from invalid user vlad 54.39.165.17 port 42700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  1 00:14:33 host2 sshd[4076372]: Disconnected from invalid user gerrit 182.18.139.237 port 33518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.10.47.6
country_id: 1643084
description:
Dec  1 00:15:38 host2 sshd[4077191]: Disconnected from invalid user gerrit 114.10.47.6 port 35471 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-01 00:17:16 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:37966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-12-01 00:17:26 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:54505: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.19.10.129
country_id: 3865483
description:
Dec  1 00:17:33 host2 sshd[4078260]: Disconnected from invalid user testftp 190.19.10.129 port 56192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.240
country_id: 1880251
description:
Dec  1 00:18:13 host2 sshd[4078698]: Disconnected from invalid user es 45.78.227.240 port 59470 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.75
country_id: 2510769
description:
2025-12-01 00:21:02 dovecot_login authenticator failed for (ADMIN) [212.102.49.75]:2252: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.207
country_id: 1880251
description:
Dec  1 00:28:49 host2 sshd[4085425]: Disconnected from invalid user sonar 45.78.207.207 port 33506 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.207.207
country_id: 1880251
description:
Dec  1 00:31:19 host2 sshd[4086945]: Disconnected from invalid user user4 45.78.207.207 port 38150 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.210.228
country_id: 6251999
description:
Dec  1 00:33:03 host2 pure-ftpd[4087896]: (?@148.113.210.228) [INFO] New connection from 148.113.210.228


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.210.228
country_id: 6251999
description:
Dec  1 00:33:14 host2 pure-ftpd[4087987]: (?@148.113.210.228) [INFO] New connection from 148.113.210.228


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.210.228
country_id: 6251999
description:
Dec  1 00:33:18 host2 pure-ftpd[4088027]: (?@148.113.210.228) [INFO] New connection from 148.113.210.228


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 00:36:08 host2 sshd[4089862]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.18
country_id: 3042225
description:
2025-12-01 00:36:56 dovecot_login authenticator failed for (ADMIN) [91.90.124.18]:25680: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-12-01 00:37:47 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:38108: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-12-01 00:38:27 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:40388: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.244
country_id: 1819730
description:
Dec  1 00:38:56 host2 sshd[4091293]: Disconnected from invalid user mailuser 118.193.43.244 port 60452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-01 00:41:35 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:45406: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.43.244
country_id: 1819730
description:
Dec  1 00:41:40 host2 sshd[4093068]: Disconnected from invalid user airflow 118.193.43.244 port 37698 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.119
country_id: 6252001
description:
Dec  1 00:42:54 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.119, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2oBOptREa9XG6xh3>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.131
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.131: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.244
country_id: 1819730
description:
Dec  1 00:45:18 host2 sshd[4097584]: Disconnected from invalid user andy 118.193.43.244 port 51706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.244
country_id: 1819730
description:
Dec  1 00:46:33 host2 sshd[4098265]: Disconnected from invalid user vpn 118.193.43.244 port 56948 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Dec  1 00:49:54 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=34.122.105.182, lip=66.85.158.91, TLS: Connection closed, session=<s7FVv9REDKIiemm2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.54
country_id: 6252001
description:
2025-12-01 00:52:31 dovecot_login authenticator failed for (ADMIN) [173.244.56.54]:22417: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-12-01 00:57:15 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:42232: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-01 01:01:15 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:47310: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-01 01:01:15 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:41687: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-01 01:01:27 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:39820: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-01 01:01:49 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:53499: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-12-01 01:02:04 dovecot_login authenticator failed for ([125.19.171.126]) [152.52.197.174]:51756: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-01 01:02:04 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:48602: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 01:04:18 host2 sshd[4111112]: Disconnected from invalid user noor 62.60.131.157 port 34672 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.159
country_id: 6252001
description:
2025-12-01 01:09:22 dovecot_login authenticator failed for (ADMIN) [173.244.56.159]:40084: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-01 01:16:33 dovecot_login authenticator failed for ([27.123.119.235]) [122.185.176.126]:45234: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.247.80.227
country_id: 1269750
description:
2025-12-01 01:16:46 dovecot_login authenticator failed for ([47.247.80.227]) [47.247.80.227]:51288: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-01 01:16:53 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:44555: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.25
country_id: 1220409
description:
Dec  1 01:17:04 host2 sshd[4120974]: Disconnected from invalid user botuser 185.121.0.25 port 43238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-12-01 01:17:12 dovecot_login authenticator failed for ([203.193.168.136]) [203.193.168.136]:41698: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-01 01:17:27 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (dicalundyl) [76.31.164.124]:58654: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.25
country_id: 1220409
description:
Dec  1 01:18:28 host2 sshd[4121995]: Disconnected from invalid user hamed 185.121.0.25 port 45930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-01 01:19:51 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59999: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-01 01:19:55 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:56978: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-12-01 01:19:38 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:63898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.121.0.25
country_id: 1220409
description:
Dec  1 01:19:44 host2 sshd[4122692]: Disconnected from invalid user valheim 185.121.0.25 port 47916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.25
country_id: 1220409
description:
Dec  1 01:20:58 host2 sshd[4123686]: Disconnected from invalid user hu 185.121.0.25 port 34284 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.45.6.205
country_id: 1819730
description:
2025-12-01 01:23:02 dovecot_login authenticator failed for (ADMIN) [89.45.6.205]:37391: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.25
country_id: 1220409
description:
Dec  1 01:22:11 host2 sshd[4124314]: Disconnected from invalid user frontend 185.121.0.25 port 37312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-12-01 01:23:14 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:60060: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-01 01:24:15 dovecot_plain authenticator failed for (nonve) [102.53.15.180]:55504: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 01:33:06 host2 sshd[4132879]: Disconnected from invalid user noor 62.60.131.157 port 51345 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-01 01:33:13 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (chuman) [67.172.54.29]:49466: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-01 01:33:17 dovecot_plain authenticator failed for (astist) [65.20.133.208]:51469: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-01 01:33:20 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (lares) [68.40.189.43]:53408: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.184
country_id: 1880251
description:
Dec  1 01:35:40 host2 sshd[4134392]: Disconnected from invalid user elemental 101.47.143.184 port 51408 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.3
country_id: 2510769
description:
2025-12-01 01:37:04 dovecot_login authenticator failed for (ADMIN) [212.102.49.3]:63402: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.23
country_id: 3624060
description:
2025-12-01 01:37:52 dovecot_login authenticator failed for ([127.0.0.1]) [186.177.88.23]:40881: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.41.39.119
country_id: 2510769
description:
2025-12-01 01:38:04 dovecot_login authenticator failed for 119.red-83-41-39.dynamicip.rima-tde.net ([127.0.0.1]) [83.41.39.119]:44060: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.171.56
country_id: 2921044
description:
Dec  1 01:39:51 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=142.93.171.56, lip=66.85.158.91, session=<Ucj8cdVEwDSOXas4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec  1 01:42:58 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<6/v7fNVE1prCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2025-12-01 01:45:11 dovecot_login authenticator failed for ([122.185.246.177]) [122.184.127.150]:58998: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2025-12-01 01:45:24 dovecot_login authenticator failed for ([46.210.95.88]) [46.210.95.88]:42515: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.184
country_id: 1880251
description:
Dec  1 01:45:32 host2 sshd[4141919]: Disconnected from invalid user taibabi 101.47.143.184 port 55204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-12-01 01:47:38 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:59916: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.184
country_id: 1880251
description:
Dec  1 01:47:59 host2 sshd[4143396]: Disconnected from invalid user ftpuser 101.47.143.184 port 42614 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-01 01:47:15 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (prouryncy) [87.103.126.54]:56077: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-12-01 01:48:08 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:58403: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.106.74.123
country_id: 719819
description:
2025-12-01 01:54:22 dovecot_login authenticator failed for (ADMIN) [86.106.74.123]:49194: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 02:01:47 host2 sshd[4152131]: Disconnected from invalid user guy 62.60.131.157 port 17304 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.210.105
country_id: 6252001
description:
Dec  1 02:04:28 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=172.104.210.105, lip=66.85.158.92, session=<vPgMytVEAKesaNJp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 02:04:57 host2 sshd[4154704]: Disconnected from invalid user guy 62.60.131.157 port 53497 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.220.10.3
country_id: 1269750
description:
Dec  1 02:08:07 host2 sshd[4156861]: Disconnected from invalid user dd 117.220.10.3 port 37872 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.47.24
country_id: 6252001
description:
2025-12-01 02:08:25 dovecot_plain authenticator failed for ([10.21.18.223]) [84.239.47.24]:59354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.24.86
country_id: 2635167
description:
2025-12-01 02:09:15 dovecot_login authenticator failed for (ADMIN) [158.173.24.86]:36793: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.215
country_id: 6252001
description:
Dec  1 02:12:03 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.215, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Gnco5dVEWsXG6xjX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.7
country_id: 2750405
description:
Dec  1 02:12:33 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=31.14.32.7, lip=66.85.158.91, session=<UuXs5tVEjOIfDiAH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 02:13:48 host2 sshd[4161350]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.220.10.3
country_id: 1269750
description:
Dec  1 02:14:35 host2 sshd[4161858]: Disconnected from invalid user vncuser 117.220.10.3 port 33142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-01 02:15:12 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (agest) [98.227.25.115]:58714: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec  1 02:15:48 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=</+OL8tVEuqCLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.220.10.3
country_id: 1269750
description:
Dec  1 02:18:18 host2 sshd[4164426]: Disconnected from invalid user oracle 117.220.10.3 port 50552 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.169.142.214
country_id: 2963597
description:
Dec  1 02:23:22 host2 sshd[4167203]: Disconnected from invalid user sftp 52.169.142.214 port 35568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Dec  1 02:24:31 host2 sshd[4167976]: Disconnected from invalid user mc 52.169.142.214 port 53514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Dec  1 02:25:39 host2 sshd[4168961]: Disconnected from invalid user bot 52.169.142.214 port 57354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.106.74.126
country_id: 719819
description:
2025-12-01 02:25:42 dovecot_login authenticator failed for (ADMIN) [86.106.74.126]:24897: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec  1 02:26:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<wjugF9ZEyoqLonHU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 02:27:40 host2 sshd[4169999]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 02:28:26 host2 sshd[4170415]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.123
country_id: 1880251
description:
Dec  1 02:30:29 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=15.235.175.123, lip=66.85.158.91, session=<mPIWJ9ZE7ccP6697>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.116
country_id: 1880251
description:
Dec  1 02:30:43 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=15.235.175.116, lip=66.85.158.91, session=<5bDvJ9ZEJ5MP6690>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.2.249.160
country_id: 3469034
description:
Dec  1 02:33:37 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=186.2.249.160, lip=66.85.158.91, TLS, session=<0uEqMdZEbem6Avmg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.241.218
country_id: 2921044
description:
[2025-12-01 02:33:57 +0530] info [cpaneld] 185.55.241.218 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.179.189.184
country_id: 3469034
description:
Dec  1 02:33:57 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.179.189.184, lip=66.85.158.91, TLS, session=<YNRgMtZEe7gts724>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.251.178
country_id: 2921044
description:
Dec  1 02:33:59 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.251.178, lip=66.85.158.92, session=<ajKQM9ZE6aVo+Puy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.203.193
country_id: 2921044
description:
Dec  1 02:33:59 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=207.154.203.193, lip=66.85.158.92, session=<LEyeM9ZE2FTPmsvB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.129.64.237
country_id: 2921044
description:
Dec  1 02:35:06 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=57.129.64.237, lip=66.85.158.91, session=<pdyZN9ZEFOI5gUDt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.105.70.190
country_id: 3017382
description:
Dec  1 02:36:18 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=46.105.70.190, lip=66.85.158.91, TLS: Connection closed, session=<6aHnO9ZEd4YuaUa+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-01 02:38:57 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (ceadmont) [71.224.169.28]:41144: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.150
country_id: 1210997
description:
2025-12-01 02:40:28 dovecot_login authenticator failed for (ADMIN) [64.64.112.150]:6927: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 02:48:15 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<did+ZtZE/rVRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.48.25
country_id: 2750405
description:
2025-12-01 02:50:10 dovecot_login authenticator failed for (ADMIN) [212.56.48.25]:3714: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.117.167
country_id: 2921044
description:
Dec  1 02:55:56 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 29 secs): user=<>, rip=157.230.117.167, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gFoegtZEJmmd5nWn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.173
country_id: 294640
description:
2025-12-01 02:57:18 dovecot_login authenticator failed for (ADMIN) [149.88.26.173]:34352: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.50.147
country_id: 3175395
description:
Dec  1 03:00:05 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.77.50.147, lip=66.85.158.91, TLS, session=<vfvtj9ZEuOy5TTKT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.64.244.118
country_id: 690791
description:
Dec  1 02:59:47 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=195.64.244.118, lip=66.85.158.91, TLS, session=<kznRjtZEO6jDQPR2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.55
country_id: 6252001
description:
Dec  1 03:01:57 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.55, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1kOel9ZEhL8UQcE3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-01 03:03:50 dovecot_plain authenticator failed for (riemenness) [65.20.191.12]:42318: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec  1 03:16:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<iARQytZEvQnCpRCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.105
country_id: 6252001
description:
Dec  1 03:18:11 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.194.105, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<rKmn0dZE9NkUQcJp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-01 03:20:41 dovecot_plain authenticator failed for (antism) [94.201.22.158]:58297: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-01 03:20:44 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (toxic) [174.166.153.20]:50012: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.12
country_id: 3017382
description:
Dec  1 03:24:06 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.12, lip=66.85.158.91, session=<9gXO5tZEJ6he584M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.8
country_id: 3017382
description:
Dec  1 03:24:16 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.8, lip=66.85.158.91, session=<Axpv59ZEc4xe584I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.13
country_id: 3017382
description:
Dec  1 03:24:28 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.13, lip=66.85.158.91, session=<w18h6NZE3ale584N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.11
country_id: 3017382
description:
Dec  1 03:24:31 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.11, lip=66.85.158.91, session=<lNdU6NZEq45e584L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-12-01 03:25:34 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:51840: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-01 03:25:53 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:47942: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Dec  1 03:27:15 host2 sshd[20110]: Disconnected from invalid user ts1 161.132.68.222 port 33362 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.68.222
country_id: 3932488
description:
Dec  1 03:28:31 host2 sshd[21091]: Disconnected from invalid user dev 161.132.68.222 port 42038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.200.211
country_id: 1880251
description:
Dec  1 03:28:54 host2 sshd[21390]: Disconnected from invalid user master 43.160.200.211 port 38892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Dec  1 03:30:54 host2 sshd[23214]: Disconnected from invalid user master 161.132.68.222 port 53686 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.41
country_id: 617790
description:
2025-12-01 03:30:27 dovecot_login authenticator failed for (ADMIN) [178.175.128.41]:48496: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Dec  1 03:33:20 host2 sshd[25114]: Disconnected from invalid user hu 161.132.68.222 port 35852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 03:33:40 host2 sshd[25294]: Disconnected from invalid user admin 2.57.121.112 port 57901 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-01 03:34:14 dovecot_plain authenticator failed for (unworichin) [102.53.15.180]:35452: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.160.200.211
country_id: 1880251
description:
Dec  1 03:34:51 host2 sshd[26535]: Disconnected from invalid user hu 43.160.200.211 port 37098 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.179
country_id: 2264397
description:
Dec  1 03:36:34 host2 pure-ftpd[28458]: (?@45.156.129.179) [INFO] New connection from 45.156.129.179


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-01 03:41:33 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (clationont) [71.224.169.28]:52942: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.57
country_id: 3625428
description:
2025-12-01 03:44:22 dovecot_login authenticator failed for (ADMIN) [95.181.237.57]:58640: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Dec  1 03:46:05 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.92, session=<ARduNddEtDCs7OTF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.224.238
country_id: 1880251
description:
Dec  1 03:50:45 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=15.235.224.238, lip=66.85.158.92, session=<IZMlRtdEq80P6+Du>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.166
country_id: 3144096
description:
2025-12-01 04:00:21 dovecot_login authenticator failed for (ADMIN) [46.246.122.166]:7919: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.52.217.43
country_id: 3686110
description:
2025-12-01 04:03:27 dovecot_login authenticator failed for ([127.0.0.1]) [181.52.217.43]:35106: 535 Incorrect authentication data (set_id=inf@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.90
country_id: 1269750
description:
2025-12-01 04:03:36 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.228.90]:51672: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 04:04:26 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<RGPmdtdEq7RRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-12-01 04:06:10 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:35258: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-01 04:06:40 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:36580: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec  1 04:11:03 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3uC6jtdEvtFChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-12-01 04:11:18 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:33111: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-01 04:11:32 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (anness) [81.225.30.107]:48503: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-12-01 04:11:59 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:33310: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-12-01 04:13:49 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:51074: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.159
country_id: 1733045
description:
2025-12-01 04:14:48 dovecot_login authenticator failed for ([49.124.154.159]) [49.124.154.159]:39012: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-01 04:16:06 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (cricancola) [76.145.10.140]:58708: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.123.8.143
country_id: 1168579
description:
2025-12-01 04:16:17 dovecot_plain authenticator failed for (1J0G627F) [223.123.8.143]:8281: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 04:17:22 host2 sshd[83720]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.162
country_id: 798549
description:
2025-12-01 04:18:56 dovecot_login authenticator failed for (ADMIN) [91.90.120.162]:55689: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.72
country_id: 2510769
description:
2025-12-01 04:19:32 dovecot_login authenticator failed for (ADMIN) [212.102.49.72]:41035: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  1 04:20:42 host2 sshd[88328]: Disconnected from invalid user ansible 45.249.247.165 port 42950 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.173.54
country_id: 6252001
description:
Dec  1 04:21:50 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=134.209.173.54, lip=66.85.158.92, TLS: Connection closed, session=<FjlRtddE6bWG0a02>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  1 04:22:41 host2 sshd[91291]: Disconnected from invalid user testing 45.249.247.165 port 39774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-01 04:24:53 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:42163: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.226.192
country_id: 6251999
description:
2025-12-01 04:24:34 dovecot_login authenticator failed for host-24-224-226-192.public.eastlink.ca [24.224.226.192]:41208: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  1 04:25:10 host2 sshd[94510]: Disconnected from invalid user plex 45.249.247.165 port 60954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.173.54
country_id: 6252001
description:
Dec  1 04:25:35 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.209.173.54, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jqGywtdE9rqG0a02>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec  1 04:27:17 host2 sshd[97700]: Disconnected from invalid user a 200.69.236.207 port 59165 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  1 04:29:46 host2 sshd[100628]: Disconnected from invalid user ubuntu 45.249.247.165 port 51600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec  1 04:32:26 host2 sshd[103353]: Disconnected from invalid user sga 200.69.236.207 port 47316 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.85
country_id: 2264397
description:
Dec  1 04:32:46 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.85, lip=66.85.158.91, session=<wYZg3NdEIeBtadJV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.20
country_id: 6290252
description:
2025-12-01 04:33:55 dovecot_login authenticator failed for (ADMIN) [37.46.115.20]:59072: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 173.24.18.140
country_id: 6252001
description:
Dec  1 04:35:23 host2 sshd[106168]: Disconnecting authenticating user root 173.24.18.140 port 54224: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 173.24.18.140
country_id: 6252001
description:
Dec  1 04:35:23 host2 sshd[106168]: error: maximum authentication attempts exceeded for root from 173.24.18.140 port 54224 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 173.24.18.140
country_id: 6252001
description:
Dec  1 04:35:31 host2 sshd[106249]: Disconnecting invalid user admin 173.24.18.140 port 55676: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Dec  1 04:36:53 host2 sshd[107737]: Disconnected from invalid user intel 95.0.27.163 port 55934 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.204.195
country_id: 6251999
description:
Dec  1 04:37:00 host2 pure-ftpd[107850]: (?@128.203.204.195) [INFO] New connection from 128.203.204.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.249
country_id: 6252001
description:
2025-12-01 04:37:42 dovecot_login authenticator failed for ([127.0.0.1]) [98.185.121.249]:35726: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.204.195
country_id: 6251999
description:
Dec  1 04:37:10 host2 pure-ftpd[108017]: (?@128.203.204.195) [INFO] New connection from 128.203.204.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.46
country_id: 6252001
description:
2025-12-01 04:37:25 dovecot_login authenticator failed for ([127.0.0.1]) [98.181.46.46]:45797: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.176
country_id: 6252001
description:
Dec  1 04:37:25 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.176, lip=66.85.158.91, session=<aYsG7ddEPP7N0h+w>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.97.117.34
country_id: 1269750
description:
Dec  1 04:38:13 host2 sshd[108786]: Disconnected from invalid user azureuser 14.97.117.34 port 40483 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.112.8
country_id: 6252001
description:
Dec  1 04:38:46 host2 sshd[109155]: Disconnected from invalid user frontend 159.203.112.8 port 34718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.118.142.216
country_id: 3686110
description:
Dec  1 04:39:01 host2 sshd[109314]: Disconnected from invalid user hadoop 186.118.142.216 port 59428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.112.8
country_id: 6252001
description:
Dec  1 04:39:47 host2 sshd[109948]: Disconnected from invalid user halo 159.203.112.8 port 54494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.118.142.216
country_id: 3686110
description:
Dec  1 04:40:18 host2 sshd[110455]: Disconnected from invalid user old 186.118.142.216 port 33948 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-12-01 04:40:47 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:34720: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.97.117.34
country_id: 1269750
description:
Dec  1 04:40:52 host2 sshd[110890]: Disconnected from invalid user david 14.97.117.34 port 33806 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.0.27.163
country_id: 298795
description:
Dec  1 04:40:14 host2 sshd[110397]: Disconnected from invalid user test 95.0.27.163 port 54256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec  1 04:41:41 host2 sshd[111520]: Disconnected from invalid user deployer 200.69.236.207 port 56265 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec  1 04:41:45 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<ya5l/NdEwIbCw3NV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.112.8
country_id: 6252001
description:
Dec  1 04:41:47 host2 sshd[111599]: Disconnected from invalid user client 159.203.112.8 port 39268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.251.2
country_id: 6252001
description:
Dec  1 04:41:20 host2 sshd[111304]: Disconnected from invalid user old 74.249.251.2 port 46290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec  1 04:43:06 host2 sshd[112427]: Disconnected from invalid user admin 200.69.236.207 port 41409 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.97.117.34
country_id: 1269750
description:
Dec  1 04:42:13 host2 sshd[111842]: Disconnected from invalid user ubuntu 14.97.117.34 port 38790 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.118.142.216
country_id: 3686110
description:
Dec  1 04:42:46 host2 sshd[112209]: Disconnected from invalid user builder 186.118.142.216 port 52670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-01 04:43:43 dovecot_login authenticator failed for ([127.0.0.1]) [84.214.48.79]:44794: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Dec  1 04:43:48 host2 sshd[112858]: Disconnected from invalid user halo 95.0.27.163 port 45768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.165.255.181
country_id: 290557
description:
2025-12-01 04:43:57 dovecot_login authenticator failed for bba-217-165-255-181.alshamil.net.ae ([127.0.0.1]) [217.165.255.181]:49284: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Dec  1 04:44:57 host2 sshd[114057]: Disconnected from invalid user huawei 152.32.252.65 port 46782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Dec  1 04:45:00 host2 sshd[114082]: Disconnected from invalid user old 95.0.27.163 port 36166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Dec  1 04:47:11 host2 sshd[115735]: Disconnected from invalid user deployer 152.32.252.65 port 51622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.254.80.99
country_id: 1269750
description:
2025-12-01 04:47:35 dovecot_plain authenticator failed for (cataliated) [65.254.80.99]:57338: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-12-01 04:47:39 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (ancity) [5.185.233.251]:44550: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-01 04:47:42 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (bionia) [73.224.171.101]:57222: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 04:48:19 host2 sshd[116335]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.249.251.2
country_id: 6252001
description:
Dec  1 04:48:56 host2 sshd[116730]: Disconnected from invalid user ubuntu 74.249.251.2 port 48246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-12-01 04:49:47 dovecot_login authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:35256: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.124
country_id: 6252001
description:
2025-12-01 04:50:46 dovecot_login authenticator failed for (ADMIN) [191.96.37.124]:15853: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-01 04:54:30 dovecot_login authenticator failed for ([127.0.0.1]) [84.211.14.36]:33398: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.236.236.178
country_id: 6252001
description:
2025-12-01 04:54:36 dovecot_login authenticator failed for mail-gateway3.zarcrom.net ([127.0.0.1]) [209.236.236.178]:38532: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.185.206
country_id: 6252001
description:
Dec  1 05:00:56 host2 pure-ftpd[124603]: (?@40.124.185.206) [INFO] New connection from 40.124.185.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-12-01 05:01:55 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:39292: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2025-12-01 05:02:09 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:37398: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.70
country_id: 597427
description:
2025-12-01 05:03:39 dovecot_login authenticator failed for (ADMIN) [194.32.122.70]:53004: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.22
country_id: 718075
description:
2025-12-01 05:05:45 dovecot_login authenticator failed for (ADMIN) [185.225.31.22]:49463: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-01 05:06:22 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60948: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-12-01 05:10:26 dovecot_plain authenticator failed for (nenatic) [46.8.240.26]:49020: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.136
country_id: 6252001
description:
2025-12-01 05:12:56 dovecot_login authenticator failed for wsip-184-191-250-136.fv.ks.cox.net ([127.0.0.1]) [184.191.250.136]:33141: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-01 05:13:10 dovecot_login authenticator failed for ([127.0.0.1]) [27.123.90.94]:43116: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.55
country_id: 798544
description:
Dec  1 05:13:21 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=77.65.142.55, lip=66.85.158.91, TLS, session=<ijiIbNhEV8RNQY43>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.76
country_id: 953987
description:
Dec  1 05:13:42 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.64.40.76, lip=66.85.158.91, TLS, session=<gzCxbdhEHt5mQChM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.232.94.72
country_id: 241170
description:
Dec  1 05:16:06 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=156.232.94.72, lip=66.85.158.91, session=<OCdgd9hEIOac6F5I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Dec  1 05:16:22 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sysnytech.com>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<K4E5eNhE0N5283VD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.252.133
country_id: 1819730
description:
Dec  1 05:17:15 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.252.133, lip=66.85.158.92, TLS handshaking: Connection closed, session=<wEt1e9hEWDWYIPyF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.117
country_id: 357994
description:
2025-12-01 05:21:25 dovecot_login authenticator failed for (ADMIN) [188.214.122.117]:25117: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.67
country_id: 1861060
description:
2025-12-01 05:29:10 dovecot_login authenticator failed for (ADMIN) [149.22.87.67]:45152: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-12-01 05:35:51 dovecot_plain authenticator failed for (resser) [65.20.148.165]:39903: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-01 05:35:54 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (dectyphid) [24.1.200.187]:51608: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-01 05:35:57 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (anized) [73.197.194.98]:49810: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Dec  1 05:36:11 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<8DQOv9hEJIKSOC+J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.46
country_id: 2264397
description:
2025-12-01 05:40:37 dovecot_login authenticator failed for (ADMIN) [146.70.59.46]:35824: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.101.70
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 161.97.101.70 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.192.106.246
country_id: 3469034
description:
Dec  1 05:45:13 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=181.192.106.246, lip=66.85.158.91, TLS, session=<Eqbz3dhE8dG1wGr2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.102.169
country_id: 798544
description:
Dec  1 05:45:31 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.102.169, lip=66.85.158.91, TLS, session=<tSCV39hEx4yy22ap>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-01 05:47:57 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (thweanula) [98.193.112.85]:40698: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.19.79.32
country_id: 285570
description:
2025-12-01 05:48:01 dovecot_plain authenticator failed for (gamis) [185.19.79.32]:47303: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.251.213.33
country_id: 2589581
description:
2025-12-01 05:49:28 dovecot_plain authenticator failed for (PMAJ2FF461FCD) [154.251.213.33]:10125: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.145
country_id: 6252001
description:
2025-12-01 05:56:18 dovecot_login authenticator failed for (ADMIN) [173.244.56.145]:13431: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.126.17
country_id: 6252001
description:
Dec  1 05:56:52 host2 sshd[164265]: Disconnected from invalid user asterisk 158.51.126.17 port 37772 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.85
country_id: 6252001
description:
Dec  1 05:57:00 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.85, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CpulCdlEeMWTuYRV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.51.126.17
country_id: 6252001
description:
Dec  1 06:02:08 host2 sshd[168602]: Disconnected from invalid user csgo 158.51.126.17 port 54960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.126.17
country_id: 6252001
description:
Dec  1 06:03:11 host2 sshd[170122]: Disconnected from invalid user drcomadmin 158.51.126.17 port 53930 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec  1 06:03:25 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS: Connection closed, session=<nQSXINlEpu5ChJl6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 06:06:21 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<eEHzKtlEXJkXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.126.17
country_id: 6252001
description:
Dec  1 06:06:38 host2 sshd[173229]: Disconnected from invalid user docker 158.51.126.17 port 50876 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.242.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.56.242.238 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.3.217
country_id: 2661886
description:
2025-12-01 06:11:13 dovecot_login authenticator failed for (ADMIN) [46.246.3.217]:17898: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.20
country_id: 2635167
description:
Dec  1 06:14:31 host2 dovecot[3366265]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.20, lip=66.85.158.91, TLS, session=<pJlBSNlEy6W594kU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.153.26.38
country_id: 1643084
description:
2025-12-01 06:15:22 dovecot_plain authenticator failed for (gttamericas.wbsyzv2pqgqutcmqq4namzv3gh.jktx.internal.cloudapp.net) [70.153.26.38]:61890: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.53
country_id: 6252001
description:
Dec  1 06:17:54 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.53, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VehaVNlEA9fG6xg1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.242
country_id: 6252001
description:
Dec  1 06:19:17 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.242, lip=66.85.158.92, TLS, session=<ncVWWdlEauvG6xjy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-01 06:19:20 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (trintunbe) [174.169.224.27]:53438: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 06:23:24 host2 sshd[185874]: Disconnected from invalid user user 2.57.121.25 port 13307 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-01 06:24:39 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:43344: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 06:24:12 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<UEfLatlEjI0XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-12-01 06:25:13 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:39366: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 06:26:06 host2 sshd[188028]: Disconnected from invalid user user 2.57.121.25 port 47345 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.153.26.38
country_id: 1643084
description:
2025-12-01 06:26:56 dovecot_plain authenticator failed for (gttamericas.wbsyzv2pqgqutcmqq4namzv3gh.jktx.internal.cloudapp.net) [70.153.26.38]:49441: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.7
country_id: 732800
description:
2025-12-01 06:27:00 dovecot_login authenticator failed for (ADMIN) [94.156.14.7]:41634: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec  1 06:27:05 host2 sshd[188582]: Disconnected from invalid user radio 121.52.147.5 port 48744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.53.166
country_id: 6252001
description:
2025-12-01 06:28:04 dovecot_login authenticator failed for (ADMIN) [212.56.53.166]:28700: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.189.154.201
country_id: 3595528
description:
Dec  1 06:27:36 host2 sshd[188881]: Disconnected from invalid user bot 181.189.154.201 port 3696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec  1 06:30:07 host2 sshd[190477]: Disconnected from invalid user deploy 121.52.147.5 port 53918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.189.154.201
country_id: 3595528
description:
Dec  1 06:29:54 host2 sshd[190211]: Disconnected from invalid user ubuntu 181.189.154.201 port 6445 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec  1 06:31:35 host2 sshd[191349]: Disconnected from invalid user init 121.52.147.5 port 34042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.189.154.201
country_id: 3595528
description:
Dec  1 06:31:25 host2 sshd[191300]: Disconnected from invalid user bitnami 181.189.154.201 port 8419 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.189.154.201
country_id: 3595528
description:
Dec  1 06:32:38 host2 sshd[191869]: Disconnected from invalid user taiga 181.189.154.201 port 7979 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.189.154.201
country_id: 3595528
description:
Dec  1 06:33:45 host2 sshd[192500]: Disconnected from invalid user ekp 181.189.154.201 port 5140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-01 06:34:34 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:39488: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-01 06:34:12 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:46866: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec  1 06:34:17 host2 sshd[192772]: Disconnected from invalid user pdx 121.52.147.5 port 43032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 121.52.147.5
country_id: 1168579
description:
Dec  1 06:35:36 host2 sshd[193751]: Disconnected from invalid user drcomadmin 121.52.147.5 port 54492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Dec  1 06:36:28 host2 sshd[194274]: Disconnected from invalid user deployer 45.78.223.80 port 45812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec  1 06:37:07 host2 sshd[194656]: Disconnected from invalid user mqm 45.78.224.109 port 43712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec  1 06:39:50 host2 sshd[196141]: Disconnected from invalid user dockeradmin 45.78.224.109 port 46404 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.164
country_id: 2328926
description:
2025-12-01 06:42:53 dovecot_login authenticator failed for (ADMIN) [146.70.65.164]:2822: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.109
country_id: 1880251
description:
Dec  1 06:42:24 host2 sshd[197895]: Disconnected from invalid user postgres 45.78.224.109 port 34856 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-01 06:44:13 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:49789: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-01 06:44:45 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:32782: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.16.91
country_id: 1880251
description:
2025-12-01 06:44:58 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:50315: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec  1 06:45:03 host2 sshd[199750]: Disconnected from invalid user fiscal 45.78.224.109 port 44534 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-12-01 06:45:36 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:42154: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 06:46:40 host2 sshd[200973]: Disconnected from invalid user porter 62.60.131.157 port 29938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec  1 06:48:10 host2 sshd[201831]: Disconnected from invalid user cgpexpert 103.100.208.88 port 35929 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec  1 06:48:49 host2 sshd[202214]: Disconnected from invalid user botuser 179.33.186.151 port 19867 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec  1 06:50:06 host2 sshd[203034]: Disconnected from invalid user amir 45.78.224.109 port 39616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec  1 06:51:40 host2 sshd[204094]: Disconnected from invalid user odoo 103.100.208.88 port 33505 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec  1 06:51:49 host2 sshd[204180]: Disconnected from invalid user odoo 179.33.186.151 port 3954 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.208.88
country_id: 1819730
description:
Dec  1 06:53:02 host2 sshd[204986]: Disconnected from invalid user dev 103.100.208.88 port 46925 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec  1 06:53:08 host2 sshd[205098]: Disconnected from invalid user minecraft 179.33.186.151 port 8188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec  1 06:54:20 host2 sshd[206154]: Disconnected from invalid user ubuntu 103.100.208.88 port 60345 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec  1 06:54:25 host2 sshd[206360]: Disconnected from invalid user hu 179.33.186.151 port 9330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec  1 06:55:27 host2 sshd[207389]: Disconnected from invalid user botuser 103.100.208.88 port 45527 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.186.151
country_id: 3686110
description:
Dec  1 06:55:42 host2 sshd[207548]: Disconnected from invalid user elasticsearch 179.33.186.151 port 34897 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.61
country_id: 597427
description:
2025-12-01 06:56:39 dovecot_login authenticator failed for (ADMIN) [194.32.122.61]:1348: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-01 06:57:16 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (chary) [98.40.101.10]:45214: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Dec  1 06:59:13 host2 sshd[209921]: Disconnected from invalid user sftpuser 45.78.223.80 port 41476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-12-01 07:00:26 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:47196: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-01 07:00:12 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:55438: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-12-01 07:03:29 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:44250: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.8.52
country_id: 798544
description:
Dec  1 07:03:28 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=89.186.8.52, lip=66.85.158.91, TLS, session=<RIJZ9tlEf4BZugg0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.134.73.222
country_id: 3017382
description:
Dec  1 07:03:36 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.134.73.222, lip=66.85.158.92, session=<1QvR99lE9dBbhkne>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-12-01 07:03:50 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:37628: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.112
country_id: 1880251
description:
Dec  1 07:03:51 host2 sshd[213042]: Disconnected from invalid user ubuntu 45.78.220.112 port 56764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.81
country_id: 3469034
description:
Dec  1 07:03:10 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=191.240.36.81, lip=66.85.158.91, TLS, session=<jeY69dlE/sC/8CRR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Dec  1 07:04:27 host2 sshd[213409]: Disconnected from invalid user jmarquez 45.78.223.80 port 59612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.119
country_id: 357994
description:
2025-12-01 07:05:35 dovecot_login authenticator failed for (ADMIN) [188.214.122.119]:62956: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.80
country_id: 1880251
description:
Dec  1 07:06:59 host2 sshd[214980]: Disconnected from invalid user testadmin 45.78.223.80 port 57560 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.69
country_id: 6252001
description:
Dec  1 07:07:55 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.69, lip=66.85.158.91, TLS, session=<oCVIB9pEaObN0h9F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.114.153.71
country_id: 357994
description:
2025-12-01 07:09:11 dovecot_plain authenticator failed for (8N8LN255TCKTWN) [62.114.153.71]:65010: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.147
country_id: 660013
description:
2025-12-01 07:13:28 dovecot_login authenticator failed for (ADMIN) [188.126.89.147]:54726: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 07:14:07 host2 sshd[220057]: Disconnected from invalid user admin 2.57.121.112 port 24551 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec  1 07:14:59 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<o0hrINpEoNDCw3NV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 07:15:46 host2 sshd[221332]: Disconnected from invalid user admin 2.57.121.112 port 56069 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.217.208.1
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 83.217.208.1 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec  1 07:19:30 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=31.14.32.6, lip=66.85.158.92, session=<9YipMNpEyoUfDiAG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 07:24:08 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<gKk9QdpEZK4DjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 07:23:59 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<ziqXQNpEef9RvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 07:26:30 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=</hGzSdpEgNUDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-12-01 07:26:21 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:51490: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-01 07:27:32 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (coless) [73.168.136.150]:53800: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-01 07:27:36 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (toliader) [87.103.126.54]:31488: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 07:27:38 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<rnfHTdpE0K0DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.129.44
country_id: 617790
description:
2025-12-01 07:27:53 dovecot_login authenticator failed for (ADMIN) [178.175.129.44]:20453: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.69
country_id: 2264397
description:
Dec  1 07:28:59 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=109.105.210.69, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hz6fUtpEC8NtadJF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.70
country_id: 2264397
description:
Dec  1 07:29:00 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=109.105.210.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<OOaqUtpEzettadJG>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.210.67
country_id: 2264397
description:
Dec  1 07:28:58 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.210.67, lip=66.85.158.92, session=<VAyEUtpESYNtadJD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.68
country_id: 2264397
description:
Dec  1 07:28:59 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.68, lip=66.85.158.92, TLS, session=<clOVUtpEYbltadJE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.67
country_id: 2264397
description:
Dec  1 07:28:58 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=109.105.210.67, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UCWNUtpEirVtadJD>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 07:30:03 host2 dovecot[3366265]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<SPJkVtpEftADjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 07:31:28 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<TB1yW9pErusDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-01 07:32:56 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (shard) [73.13.220.220]:53192: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.44
country_id: 3175395
description:
Dec  1 07:35:12 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=185.15.171.44, lip=66.85.158.91, TLS, session=<NCTTZ9pEn6O5D6ss>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.209
country_id: 3469034
description:
Dec  1 07:35:33 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.53.131.209, lip=66.85.158.91, TLS, session=<X7/3aNpElqu/NYPR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.11
country_id: 732800
description:
2025-12-01 07:43:23 dovecot_login authenticator failed for (ADMIN) [94.156.14.11]:35286: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.162.45
country_id: 1861060
description:
Dec  1 07:45:39 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=8.211.162.45, lip=66.85.158.92, session=<zPYzjtpEVNwI06It>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.140
country_id: 660013
description:
2025-12-01 07:47:47 dovecot_login authenticator failed for (ADMIN) [188.126.89.140]:53871: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.120
country_id: 3996063
description:
2025-12-01 07:50:02 dovecot_login authenticator failed for ([127.0.0.1]) [201.173.216.120]:34489: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2025-12-01 07:50:24 dovecot_login authenticator failed for ([127.0.0.1]) [152.52.220.126]:33850: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-01 07:50:49 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (flingial) [98.40.101.10]:42400: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec  1 07:52:49 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS: Connection closed, session=<omfMp9pE1MxChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.203
country_id: 6252001
description:
Dec  1 07:54:13 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.203, lip=66.85.158.91, TLS, session=<W1HPrNpEpPnG6xjL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.34.157
country_id: 6252001
description:
2025-12-01 07:59:29 dovecot_login authenticator failed for (ADMIN) [143.244.34.157]:39874: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.245
country_id: 6252001
description:
Dec  1 08:02:45 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.245, lip=66.85.158.92, TLS, session=<voRTy9pElPzN0h/1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec  1 08:04:19 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<u2L50NpEvqg2rEyT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.62.222.54
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.62.222.54 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.222.54
country_id: 2750405
description:
Dec  1 08:07:36 host2 sshd[255749]: Invalid user cloudtourssrilan_travel from 178.62.222.54 port 49854


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.3
country_id: 1861060
description:
2025-12-01 08:08:17 dovecot_login authenticator failed for (ADMIN) [149.22.87.3]:36293: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.144
country_id: 798549
description:
2025-12-01 08:14:18 dovecot_login authenticator failed for (ADMIN) [91.90.120.144]:4407: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-01 08:14:42 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:42986: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.85
country_id: 3996063
description:
2025-12-01 08:15:12 dovecot_login authenticator failed for (201.172.88.85-clientes-izzi.mx) [201.172.88.85]:36118: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Dec  1 08:17:33 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.92, session=<wANDANtEToY2xDDo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec  1 08:19:21 host2 sshd[263275]: Disconnected from invalid user sonarqube 143.198.85.84 port 40254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.37.155
country_id: 2077456
description:
Dec  1 08:20:20 host2 sshd[264084]: Disconnected from invalid user saas 144.48.37.155 port 54308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec  1 08:22:09 host2 sshd[265507]: Disconnected from invalid user terraria 143.198.85.84 port 53578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.37.155
country_id: 2077456
description:
Dec  1 08:22:35 host2 sshd[265808]: Disconnected from invalid user nrk 144.48.37.155 port 52244 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.198.85.84
country_id: 1880251
description:
Dec  1 08:23:26 host2 sshd[266530]: Disconnected from invalid user ts1 143.198.85.84 port 54784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.37.155
country_id: 2077456
description:
Dec  1 08:23:58 host2 sshd[266879]: Disconnected from invalid user ali 144.48.37.155 port 55840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec  1 08:24:41 host2 sshd[267530]: Disconnected from invalid user ali 143.198.85.84 port 32978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  1 08:24:52 host2 sshd[267642]: Disconnected from invalid user gits 27.111.32.174 port 37928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.37.155
country_id: 2077456
description:
Dec  1 08:25:19 host2 sshd[268111]: Disconnected from invalid user vagrant 144.48.37.155 port 44546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  1 08:26:07 host2 sshd[268627]: Disconnected from invalid user qw 27.111.32.174 port 42540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.48.37.155
country_id: 2077456
description:
Dec  1 08:26:38 host2 sshd[268959]: Disconnected from invalid user monitoring 144.48.37.155 port 44200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  1 08:27:19 host2 sshd[269457]: Disconnected from invalid user vagrant 27.111.32.174 port 57950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.45
country_id: 2635167
description:
2025-12-01 08:27:52 dovecot_login authenticator failed for (ADMIN) [98.159.234.45]:51263: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.71
country_id: 298795
description:
2025-12-01 08:28:29 dovecot_login authenticator failed for (ADMIN) [188.213.34.71]:17344: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  1 08:28:30 host2 sshd[270357]: Disconnected from invalid user rstudio 27.111.32.174 port 55524 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.125
country_id: 6252001
description:
Dec  1 08:36:10 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.125, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Mw7bQttEhcHG6xh9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 08:37:30 host2 sshd[278162]: Disconnected from invalid user admin 2.57.121.112 port 40689 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 08:38:45 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<2Zb9S9tEjrMXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 08:38:44 host2 sshd[279073]: Disconnected from invalid user user 2.57.121.25 port 35061 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 08:39:07 host2 sshd[279483]: Disconnected from invalid user admin 2.57.121.112 port 5406 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 08:40:38 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<gVqzUttEnyxRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 08:43:03 host2 sshd[282597]: Disconnected from invalid user tevin 62.60.131.157 port 27055 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 08:43:21 host2 sshd[283001]: Disconnected from invalid user admin 2.57.121.112 port 63500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-01 08:44:50 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50640: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 08:45:07 host2 sshd[284659]: Disconnected from invalid user tevin 62.60.131.157 port 25520 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec  1 08:45:08 host2 pure-ftpd[284732]: (?@66.132.153.121) [INFO] New connection from 66.132.153.121


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-12-01 08:45:52 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:53854: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.9
country_id: 6252001
description:
2025-12-01 08:46:09 dovecot_login authenticator failed for (ADMIN) [191.96.37.9]:9637: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.21
country_id: 732800
description:
2025-12-01 08:48:18 dovecot_login authenticator failed for (ADMIN) [94.156.14.21]:11649: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-01 08:54:19 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:45962: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-01 08:54:50 dovecot_login authenticator failed for ([45.168.140.35]) [45.168.140.35]:48976: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.79.85.18
country_id: 3469034
description:
2025-12-01 08:55:03 dovecot_plain authenticator failed for (CEJ5O) [170.79.85.18]:24873: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.79.85.18
country_id: 3469034
description:
2025-12-01 08:55:09 dovecot_login authenticator failed for (CEJ5O) [170.79.85.18]:24873: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-12-01 08:55:40 dovecot_login authenticator failed for (techday.com.ua) [46.149.83.62]:51509: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-01 08:56:19 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:41322: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-01 08:57:05 dovecot_plain authenticator failed for (bitomating) [46.10.210.68]:59720: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-01 08:59:02 dovecot_plain authenticator failed for (pompra) [65.20.129.28]:56040: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 08:59:48 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<sE9Bl9tEgrcXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.150
country_id: 1210997
description:
2025-12-01 09:03:08 dovecot_login authenticator failed for (ADMIN) [64.64.112.150]:8293: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-12-01 09:03:29 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:52468: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-12-01 09:03:49 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:50241: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.24
country_id: 2661886
description:
2025-12-01 09:06:43 dovecot_login authenticator failed for (ADMIN) [212.112.19.24]:50644: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.216.141
country_id: 99237
description:
Dec  1 09:09:59 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=65.20.216.141, lip=66.85.158.91, TLS, session=<w466uttE0K9BFNiN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.237.57.144
country_id: 1269750
description:
Dec  1 09:09:22 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=103.237.57.144, lip=66.85.158.91, session=<vRGcudtE9pVn7TmQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.197.8.144
country_id: 3175395
description:
Dec  1 09:09:40 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=185.197.8.144, lip=66.85.158.91, session=<jCSnuttEXrO5xQiQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-12-01 09:12:49 dovecot_login authenticator failed for (RMdf8HC8oH) [178.16.54.32]:61673: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 09:13:33 host2 sshd[309673]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.237.138.83
country_id: 6252001
description:
Dec  1 09:13:29 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.237.138.83, lip=66.85.158.91, session=<hnNMyNtEcLEj7YpT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Dec  1 09:13:29 host2 pure-ftpd[309624]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.243.219.50
country_id: 6252001
description:
Dec  1 09:13:43 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.243.219.50, lip=66.85.158.91, session=<NbokydtEqNwj89sy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-12-01 09:13:13 dovecot_login authenticator failed for (lWSI2aqSRz) [178.16.54.32]:50714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-12-01 09:14:46 dovecot_login authenticator failed for (uqpSWX) [178.16.54.32]:54878: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.241
country_id: 1880251
description:
Dec  1 09:17:04 host2 sshd[312447]: Disconnected from invalid user sysadmin 101.47.48.241 port 58988 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.195
country_id: 6252001
description:
Dec  1 09:17:08 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.195, lip=66.85.158.92, session=<L1Jl1dtE8OrG6xjD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.185.36
country_id: 1819730
description:
Dec  1 09:17:24 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.185.36, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gghY1ttEDquYILkk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-01 09:20:11 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (uncylowes) [68.40.189.43]:59644: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.60
country_id: 1814991
description:
2025-12-01 09:22:11 dovecot_login authenticator failed for (ADMIN) [188.241.80.60]:26659: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.48.241
country_id: 1880251
description:
Dec  1 09:22:10 host2 sshd[317103]: Disconnected from invalid user vendas 101.47.48.241 port 49322 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.214.95.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 195.214.95.250 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec  1 09:23:44 host2 sshd[318397]: Disconnected from invalid user test1 179.51.153.37 port 50392 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.144.19.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.144.19.16 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.255.101.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.255.101.75 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.105.234
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.105.234 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec  1 09:25:17 host2 sshd[319677]: Disconnected from invalid user admin 179.51.153.37 port 57110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec  1 09:25:40 host2 sshd[319958]: Disconnected from invalid user ansadmin 162.240.212.247 port 36662 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.92
country_id: 1819730
description:
Dec  1 09:25:59 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.92, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8wj+9NtEDF0tjppc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec  1 09:26:50 host2 sshd[320687]: Disconnected from invalid user zookeeper 162.240.212.247 port 35372 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.212.247
country_id: 6252001
description:
Dec  1 09:28:01 host2 sshd[321401]: Disconnected from invalid user luis 162.240.212.247 port 34064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.19
country_id: 2029969
description:
2025-12-01 09:28:11 dovecot_login authenticator failed for (ADMIN) [173.244.58.19]:37652: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.140.2.120
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.140.2.120 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec  1 09:29:11 host2 sshd[322291]: Disconnected from invalid user postgres 162.240.212.247 port 32790 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.11.13.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.11.13.219 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.18.191.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.18.191.75 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.134.173.104
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.134.173.104 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.220.107.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.220.107.36 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec  1 09:31:23 host2 sshd[323825]: Disconnected from invalid user db2inst1 179.51.153.37 port 40576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.198
country_id: 1733045
description:
Dec  1 09:31:45 host2 sshd[324087]: Disconnected from invalid user hello 202.165.16.198 port 51226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.16.198
country_id: 1733045
description:
Dec  1 09:35:33 host2 sshd[326558]: Disconnected from invalid user db2inst1 202.165.16.198 port 59242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.198
country_id: 1733045
description:
Dec  1 09:36:48 host2 sshd[327568]: Disconnected from invalid user service 202.165.16.198 port 43406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.173.178
country_id: 2921044
description:
2025-12-01 09:37:24 dovecot_login authenticator failed for (ADMIN) [181.214.173.178]:40267: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.198
country_id: 1733045
description:
Dec  1 09:38:00 host2 sshd[328291]: Disconnected from invalid user ts2 202.165.16.198 port 51530 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 09:37:07 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<UTmyHNxEQocXXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.50.250.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.50.250.217 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.167.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.167.214 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.217.64.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 97.217.64.178 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.167.57.149
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.167.57.149 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.215.189.171
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.215.189.171 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.76.148
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.76.148 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.186.222.187
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.186.222.187 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.3
country_id: 2993457
description:
2025-12-01 09:46:16 dovecot_login authenticator failed for (ADMIN) [95.181.233.3]:49859: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.152.195.249
country_id: 6252001
description:
2025-12-01 09:51:46 dovecot_plain authenticator failed for ([89.116.164.85]) [47.152.195.249]:59256: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-12-01 09:52:24 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:48780: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-01 09:52:08 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:54011: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.0.132.205
country_id: 3469034
description:
2025-12-01 09:54:21 dovecot_plain authenticator failed for ([89.116.164.85]) [138.0.132.205]:10199: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.193
country_id: 2960313
description:
2025-12-01 09:55:38 dovecot_login authenticator failed for (ADMIN) [37.46.113.193]:19149: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.103
country_id: 6252001
description:
Dec  1 09:58:04 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.103, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<nRnEZ9xE88PN0h9n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2025-12-01 09:58:08 dovecot_login authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:46451: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-01 09:58:29 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:37965: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.255.32.136
country_id: 102358
description:
2025-12-01 09:58:57 dovecot_plain authenticator failed for ([89.116.164.85]) [151.255.32.136]:8001: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 09:59:33 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ZrHybNxEWo4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.78.207.148
country_id: 3658394
description:
2025-12-01 10:03:29 dovecot_plain authenticator failed for ([89.116.164.85]) [181.78.207.148]:54507: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.37
country_id: 6252001
description:
Dec  1 10:05:39 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.37, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<LQDZgtxENNSTuYQl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.168
country_id: 1562822
description:
2025-12-01 10:05:58 dovecot_login authenticator failed for (ADMIN) [173.239.247.168]:51369: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 10:08:23 host2 sshd[355412]: Disconnected from invalid user user 2.57.121.25 port 49720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.42
country_id: 6252001
description:
2025-12-01 10:11:37 dovecot_login authenticator failed for (ADMIN) [173.244.56.42]:51315: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.4.73
country_id: 690791
description:
Dec  1 10:11:41 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=176.103.4.73, lip=66.85.158.91, TLS, session=<b4lcl9xEzN2wZwRJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.116
country_id: 3175395
description:
Dec  1 10:12:00 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.139.180.116, lip=66.85.158.91, TLS, session=<pqWJmNxEnK+5i7R0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec  1 10:14:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<OlccodxE8JzCw3NV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.106.25.217
country_id: 6251999
description:
Dec  1 10:15:24 host2 sshd[361649]: Disconnected from invalid user marvin 140.106.25.217 port 53574 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.79.43
country_id: 3469034
description:
Dec  1 10:15:56 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=177.190.79.43, lip=66.85.158.91, TLS, session=<h4WaptxEh+Oxvk8r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.245.219.199
country_id: 6290252
description:
Dec  1 10:16:14 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.245.219.199, lip=66.85.158.91, TLS, session=<Mcm/p9xE9J9t9dvH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 140.106.25.217
country_id: 6251999
description:
Dec  1 10:16:24 host2 sshd[362480]: Disconnected from invalid user github 140.106.25.217 port 52232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.106.25.217
country_id: 6251999
description:
Dec  1 10:17:23 host2 sshd[363269]: Disconnected from invalid user devuser 140.106.25.217 port 50892 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.122.177
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.122.177 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.172.43.109
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.172.43.109 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.168.209.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.168.209.51 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.26.234.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.26.234.16 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.196.148.161
country_id: 3469034
description:
2025-12-01 10:20:48 dovecot_plain authenticator failed for ([89.116.164.85]) [177.196.148.161]:41269: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.197.8.146
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 162.197.8.146 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.4.114.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.4.114.111 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.6.85.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.6.85.238 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.119.224.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.119.224.29 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.107.193.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.107.193.163 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.38.145.80
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.38.145.80 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.167.56.47
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.167.56.47 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.216.116.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.216.116.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.109.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.150.109.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.176.49.129
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.176.49.129 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:25:04 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<3H1MyNxEttMDjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.223.76.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.223.76.181 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.220.118.201
country_id: 6290252
description:
2025-12-01 10:26:34 dovecot_plain authenticator failed for 178-220-118-201.static.isp.telekom.rs (prodions) [178.220.118.201]:40923: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.10.48.122
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.10.48.122 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.174.174.39
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.174.174.39 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.48.57.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.48.57.154 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.89.213.92
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 64.89.213.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.5.138.94
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.5.138.94 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.222.12.182
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.222.12.182 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.20
country_id: 2661886
description:
2025-12-01 10:27:54 dovecot_login authenticator failed for (ADMIN) [212.112.19.20]:10764: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:28:09 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<hR9U09xENtEDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.88
country_id: 6252001
description:
Dec  1 10:28:42 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.149.88, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<nrVS1dxEq9qi2JVY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.48.92
country_id: 6251999
description:
2025-12-01 10:29:07 dovecot_login authenticator failed for (ADMIN) [212.32.48.92]:52708: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.88
country_id: 6252001
description:
Dec  1 10:29:12 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=162.216.149.88, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<iVQa19xEBu+i2JVY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:30:05 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<8Eg+2txEuMoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:30:22 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<5P1D29xEDtcDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-01 10:30:32 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (nopol) [98.192.74.183]:34816: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:30:47 host2 dovecot[3366265]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<E7jJ3NxEdtgDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:31:57 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<CZHt4NxEFuUDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.18.126
country_id: 1269750
description:
2025-12-01 10:31:59 dovecot_login authenticator failed for (telemedia-ap-dynamic-126.18.175.122.airtelbroadband.in) [122.175.18.126]:52201: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:32:47 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<GC/q49xEzMIDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:33:18 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Xx3F5dxE7qwDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-01 10:33:39 dovecot_login authenticator failed for ([127.0.0.1]) [84.215.111.144]:33151: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.93.59.131
country_id: 1821275
description:
2025-12-01 10:33:53 dovecot_login authenticator failed for ([127.0.0.1]) [182.93.59.131]:48484: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:33:54 host2 dovecot[3366265]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<j9bp59xEQIYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec  1 10:34:22 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, session=<nqqY6dxEHsc2rEyT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:35:33 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<ypLL7dxEOM0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.88
country_id: 6252001
description:
Dec  1 10:36:09 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.88, lip=66.85.158.92, TLS, session=<NeH379xEquWi2JVY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 10:38:10 host2 sshd[381079]: Disconnected from invalid user flor 62.60.131.157 port 20229 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.252.197.98
country_id: 3202326
description:
2025-12-01 10:38:26 dovecot_plain authenticator failed for ([89.116.164.85]) [188.252.197.98]:20969: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.247.42.36
country_id: 2658434
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 94.247.42.36 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.110
country_id: 2635167
description:
2025-12-01 10:45:56 dovecot_login authenticator failed for (ADMIN) [158.173.23.110]:30897: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.68
country_id: 783754
description:
2025-12-01 10:46:23 dovecot_login authenticator failed for (ADMIN) [31.171.154.68]:37112: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.79.54.237
country_id: 3469034
description:
2025-12-01 10:50:04 dovecot_plain authenticator failed for 170-79-54-237.justwebtelecom.com.br ([89.116.164.85]) [170.79.54.237]:44341: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.79.54.237
country_id: 3469034
description:
2025-12-01 10:50:11 dovecot_login authenticator failed for 170-79-54-237.justwebtelecom.com.br ([89.116.164.85]) [170.79.54.237]:44341: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.80.74.188
country_id: 3175395
description:
2025-12-01 10:52:27 dovecot_plain authenticator failed for ([89.116.164.85]) [91.80.74.188]:51893: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-01 10:56:01 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (phile) [73.161.96.107]:36620: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.178.24.101
country_id: 6252001
description:
2025-12-01 10:57:10 dovecot_plain authenticator failed for ([89.116.164.85]) [107.178.24.101]:9774: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-12-01 11:01:22 dovecot_login authenticator failed for ([61.246.72.73]) [203.132.133.54]:35730: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.228.15.99
country_id: 1269750
description:
2025-12-01 11:01:29 dovecot_plain authenticator failed for ([89.116.164.85]) [223.228.15.99]:40597: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.94.211
country_id: 1880251
description:
2025-12-01 11:01:44 dovecot_login authenticator failed for ([223.25.94.211]) [223.25.94.211]:58442: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.124
country_id: 783754
description:
2025-12-01 11:02:16 dovecot_login authenticator failed for (ADMIN) [31.171.154.124]:39442: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.180
country_id: 6252001
description:
Dec  1 11:03:52 host2 pure-ftpd[405786]: (?@147.185.132.180) [INFO] New connection from 147.185.132.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.143
country_id: 2960313
description:
2025-12-01 11:06:18 dovecot_login authenticator failed for (ADMIN) [37.46.113.143]:63325: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.154
country_id: 6252001
description:
Dec  1 11:11:02 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.154, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<sFCybN1E2q+H7X6a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.190
country_id: 798544
description:
Dec  1 11:11:31 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=31.179.228.190, lip=66.85.158.91, TLS, session=<0jlwbd1ExK8fs+S+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.40.85.205
country_id: 6252001
description:
[2025-12-01 11:12:04 +0530] info [cpaneld] 70.40.85.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.57.104
country_id: 6252001
description:
Dec  1 11:11:12 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.29.57.104, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YbZTbd1E3NsUHTlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.152
country_id: 3469034
description:
Dec  1 11:11:13 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=190.89.137.152, lip=66.85.158.91, TLS, session=<OUhHbN1EPOy+WYmY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.213.223.12
country_id: 6252001
description:
[2025-12-01 11:11:59 +0530] info [cpaneld] 108.213.223.12 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.21.160.28
country_id: 6252001
description:
[2025-12-01 11:12:06 +0530] info [cpaneld] 76.21.160.28 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.234.41.66
country_id: 6252001
description:
[2025-12-01 11:12:08 +0530] info [whostmgrd] 69.234.41.66 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.70.67.135
country_id: 6252001
description:
[2025-12-01 11:12:17 +0530] info [cpaneld] 73.70.67.135 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.52.112.248
country_id: 6252001
description:
[2025-12-01 11:12:26 +0530] info [cpaneld] 184.52.112.248 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.231.162.135
country_id: 6252001
description:
[2025-12-01 11:12:13 +0530] info [cpaneld] 47.231.162.135 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.91.234
country_id: 2921044
description:
Dec  1 11:14:17 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.91.234, lip=66.85.158.92, TLS, session=<yYtSeN1EelGGelvq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.169.52
country_id: 3469034
description:
2025-12-01 11:15:14 dovecot_plain authenticator failed for ([89.116.164.85]) [45.238.169.52]:7394: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.81.33
country_id: 6251999
description:
2025-12-01 11:17:03 dovecot_login authenticator failed for (ADMIN) [66.56.81.33]:46926: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.196.242
country_id: 3469034
description:
Dec  1 11:16:56 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=179.189.196.242, lip=66.85.158.91, TLS, session=<fDGtgN1EkaazvcTy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.186.75.106
country_id: 6290252
description:
Dec  1 11:17:14 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=93.186.75.106, lip=66.85.158.91, TLS, session=<7u7lgd1E9eVduktq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.124
country_id: 6252001
description:
Dec  1 11:17:28 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.132.124, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ZCu7g91E19aTuYR8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.91.109.125
country_id: 6252001
description:
Dec  1 11:18:55 host2 pure-ftpd[418930]: (?@138.91.109.125) [INFO] New connection from 138.91.109.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.244.73.238
country_id: 6252001
description:
2025-12-01 11:19:05 dovecot_plain authenticator failed for ([89.116.164.85]) [74.244.73.238]:14105: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.244.73.238
country_id: 6252001
description:
2025-12-01 11:19:12 dovecot_login authenticator failed for ([89.116.164.85]) [74.244.73.238]:14105: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 11:21:19 host2 sshd[420934]: Disconnected from invalid user admin 2.57.121.112 port 19611 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.24
country_id: 1522867
description:
2025-12-01 11:23:17 dovecot_login authenticator failed for (ADMIN) [62.133.47.24]:47484: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.124
country_id: 6252001
description:
Dec  1 11:24:37 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.124, lip=66.85.158.91, TLS, session=<mdJHnd1EfP2TuYR8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-12-01 11:26:07 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:50286: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.254.80.99
country_id: 1269750
description:
2025-12-01 11:26:51 dovecot_plain authenticator failed for (thipes) [65.254.80.99]:55502: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec  1 11:27:26 host2 sshd[426404]: Disconnected from invalid user roott 143.110.137.94 port 56612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Dec  1 11:30:04 host2 sshd[428726]: Disconnected from invalid user tony 37.252.188.15 port 44200 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 11:30:49 host2 sshd[429472]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec  1 11:30:18 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<gbucsd1ENJAD7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Dec  1 11:31:56 host2 sshd[430482]: Disconnected from invalid user frappe 37.252.188.15 port 51502 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.252.188.15
country_id: 2782113
description:
Dec  1 11:33:59 host2 sshd[432330]: Disconnected from invalid user andy 37.252.188.15 port 48958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Dec  1 11:34:56 host2 sshd[433138]: Disconnected from invalid user mega 186.56.11.17 port 35354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec  1 11:35:25 host2 sshd[433761]: Disconnected from invalid user root2 143.110.137.94 port 53164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Dec  1 11:37:08 host2 sshd[435146]: Disconnected from invalid user cinema 37.252.188.15 port 45128 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.56.11.17
country_id: 3865483
description:
Dec  1 11:39:15 host2 sshd[437149]: Disconnected from invalid user admin 186.56.11.17 port 51712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec  1 11:44:47 host2 sshd[442407]: Disconnected from invalid user testftp 143.110.137.94 port 37658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.42.1
country_id: 1643084
description:
Dec  1 11:45:27 host2 sshd[443137]: Disconnected from invalid user tony 103.67.42.1 port 34228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.42.1
country_id: 1643084
description:
Dec  1 11:46:50 host2 sshd[444720]: Disconnected from invalid user ubuntu 103.67.42.1 port 40500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.14
country_id: 2029969
description:
2025-12-01 11:47:06 dovecot_login authenticator failed for (ADMIN) [173.244.58.14]:48004: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec  1 11:46:28 host2 sshd[444402]: Disconnected from invalid user vagrant 177.10.201.7 port 46698 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.137.94
country_id: 6252001
description:
Dec  1 11:46:39 host2 sshd[444554]: Disconnected from invalid user qwerty 143.110.137.94 port 50154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.198.238
country_id: 130758
description:
Dec  1 11:49:14 host2 sshd[446762]: Disconnected from invalid user vagrant 62.60.198.238 port 56282 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.164.240.11
country_id: 3895114
description:
2025-12-01 11:50:39 dovecot_plain authenticator failed for pc-11-240-164-190.cm.vtr.net ([89.116.164.85]) [190.164.240.11]:37614: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.42.1
country_id: 1643084
description:
Dec  1 11:50:59 host2 sshd[448547]: Disconnected from invalid user user 103.67.42.1 port 44186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.131.159
country_id: 6252001
description:
Dec  1 11:51:41 host2 sshd[449387]: Invalid user cloudtourssrilan_travel from 124.198.131.159 port 56402


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.32
country_id: 390903
description:
2025-12-01 11:52:30 dovecot_login authenticator failed for (ADMIN) [79.127.181.32]:33326: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec  1 11:52:10 host2 sshd[449864]: Disconnected from invalid user terraria 177.10.201.7 port 50880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.96.41.141
country_id: 1269750
description:
2025-12-01 11:55:33 dovecot_plain authenticator failed for ([89.116.164.85]) [117.96.41.141]:20985: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.198.238
country_id: 130758
description:
Dec  1 11:56:00 host2 sshd[454649]: Disconnected from invalid user odoo 62.60.198.238 port 51898 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 11:56:56 host2 sshd[455651]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Dec  1 11:56:31 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@systemtec.lk>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<eJE2D95Ebqd283VD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.67.235.174
country_id: 935317
description:
2025-12-01 11:59:47 dovecot_plain authenticator failed for ([89.116.164.85]) [154.67.235.174]:48970: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.198.238
country_id: 130758
description:
Dec  1 12:01:37 host2 sshd[460281]: Disconnected from invalid user terraria 62.60.198.238 port 41020 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.5
country_id: 6252001
description:
Dec  1 12:04:08 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.91, TLS, session=<hkeiKt5EoKfCpGsF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-01 12:04:45 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:56706: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.214
country_id: 3865483
description:
Dec  1 12:04:52 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=190.181.101.214, lip=66.85.158.91, TLS, session=<qvUgLN5Ewqq+tWXW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.61.153.63
country_id: 2510769
description:
Dec  1 12:05:11 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=37.61.153.63, lip=66.85.158.91, TLS, session=<QUtRLd5E26MlPZk/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 12:06:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<NXnAMd5ELjlRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.50
country_id: 6252001
description:
2025-12-01 12:07:04 dovecot_login authenticator failed for (ADMIN) [173.244.56.50]:9567: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.69.129.95
country_id: 1819730
description:
Dec  1 12:07:38 host2 sshd[467025]: Disconnected from invalid user administrator 103.69.129.95 port 51516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Dec  1 12:09:58 host2 sshd[469315]: Disconnected from invalid user superset 187.107.88.97 port 54323 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.228
country_id: 6252001
description:
2025-12-01 12:10:23 dovecot_login authenticator failed for (ADMIN) [191.96.67.228]:26071: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.234
country_id: 1880251
description:
Dec  1 12:11:13 host2 sshd[470669]: Disconnected from invalid user ubuntu 45.78.227.234 port 32884 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.69.129.95
country_id: 1819730
description:
Dec  1 12:15:29 host2 sshd[474547]: Disconnected from invalid user production 103.69.129.95 port 33978 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec  1 12:16:55 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS: Connection closed, session=<D69VWN5E9IZChJmK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Dec  1 12:17:16 host2 sshd[476165]: Disconnected from invalid user master 187.107.88.97 port 34630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Dec  1 12:20:10 host2 sshd[478831]: Disconnected from invalid user erpnext 187.107.88.97 port 40868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.69.129.95
country_id: 1819730
description:
Dec  1 12:20:30 host2 sshd[479109]: Disconnected from invalid user bounce 103.69.129.95 port 47976 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Dec  1 12:22:25 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<VV3aa95EoLOSOC+J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.107.88.97
country_id: 3469034
description:
Dec  1 12:23:13 host2 sshd[481472]: Disconnected from invalid user nominatim 187.107.88.97 port 43438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.53
country_id: 390903
description:
2025-12-01 12:23:45 dovecot_login authenticator failed for (ADMIN) [79.127.181.53]:23640: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 12:24:17 host2 sshd[482467]: Disconnected from invalid user makena 62.60.131.157 port 23786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-01 12:26:06 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65517: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 12:26:18 host2 sshd[484198]: Disconnected from invalid user makena 62.60.131.157 port 6496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Dec  1 12:26:12 host2 sshd[484142]: Disconnected from invalid user taibabi 187.107.88.97 port 39976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.234
country_id: 1880251
description:
Dec  1 12:27:22 host2 sshd[485170]: Disconnected from invalid user erpnext 45.78.227.234 port 58402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.18
country_id: 2589581
description:
2025-12-01 12:28:00 dovecot_login authenticator failed for (ADMIN) [176.125.228.18]:33617: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.227.234
country_id: 1880251
description:
Dec  1 12:29:53 host2 sshd[487042]: Disconnected from invalid user es 45.78.227.234 port 60226 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.209.96.179
country_id: 2921044
description:
Dec  1 12:31:28 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=8.209.96.179, lip=66.85.158.91, session=<bL1ejN5EtugI0WCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-01 12:33:04 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:60904: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-12-01 12:32:28 dovecot_login authenticator failed for ([125.23.235.136]) [128.185.252.110]:49098: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.131.134.68
country_id: 3658394
description:
2025-12-01 12:35:30 dovecot_plain authenticator failed for ([89.116.164.85]) [190.131.134.68]:51194: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-12-01 12:37:23 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:49032: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.148.10.116
country_id: 1210997
description:
2025-12-01 12:38:18 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.116]:48052: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 12:40:55 host2 sshd[498308]: Disconnected from invalid user admin 2.57.121.112 port 27579 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.68
country_id: 6252001
description:
2025-12-01 12:40:25 dovecot_login authenticator failed for (ADMIN) [173.244.56.68]:52991: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.244.246
country_id: 2077456
description:
2025-12-01 12:43:49 dovecot_login authenticator failed for ([127.0.0.1]) [120.157.244.246]:37428: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-01 12:43:58 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:44742: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-01 12:44:00 dovecot_login authenticator failed for ([127.0.0.1]) [187.161.213.35]:41723: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-12-01 12:44:13 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:54464: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.81.192
country_id: 6251999
description:
2025-12-01 12:46:10 dovecot_login authenticator failed for (ADMIN) [66.56.81.192]:34150: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.57.132
country_id: 3469034
description:
2025-12-01 12:47:08 dovecot_plain authenticator failed for 138-36-57-132.static.sumicity.net.br ([89.116.164.85]) [138.36.57.132]:10681: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.57.132
country_id: 3469034
description:
2025-12-01 12:47:14 dovecot_login authenticator failed for 138-36-57-132.static.sumicity.net.br ([89.116.164.85]) [138.36.57.132]:10681: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.193.142.160
country_id: 3469034
description:
2025-12-01 12:48:59 dovecot_plain authenticator failed for 200-193-142-160.user3p.v-tal.net.br ([89.116.164.85]) [200.193.142.160]:60296: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec  1 12:49:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<N9avy95ESIcD7r/l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.52.177
country_id: 953987
description:
Dec  1 12:53:38 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@jrdc.lk>, method=PLAIN, rip=102.129.52.177, lip=66.85.158.91, TLS, session=<hnli2t5EC4pmgTSx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.29.218.152
country_id: 3686110
description:
2025-12-01 12:53:50 dovecot_plain authenticator failed for dynamic-186-29-218-152.dynamic.etb.net.co ([89.116.164.85]) [186.29.218.152]:42710: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.234
country_id: 2300660
description:
Dec  1 12:54:02 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=41.139.47.234, lip=66.85.158.91, TLS, session=<wHrQ295Eiuspiy/q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.33
country_id: 6252001
description:
Dec  1 12:55:47 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.33, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<r+1U495E0tmTuYQh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.162.12
country_id: 290557
description:
2025-12-01 12:56:53 dovecot_login authenticator failed for (ADMIN) [217.138.162.12]:60754: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.0.186.225
country_id: 3865483
description:
2025-12-01 12:57:51 dovecot_plain authenticator failed for ([89.116.164.85]) [168.0.186.225]:36514: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-01 13:00:39 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.178.206]:34740: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2025-12-01 13:00:17 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.181.166]:40534: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
country_id: 798544
description:
2025-12-01 13:01:37 dovecot_plain authenticator failed for (cimas) [94.254.244.211]:40491: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.213
country_id: 2510769
description:
2025-12-01 13:04:45 dovecot_login authenticator failed for (ADMIN) [212.102.49.213]:43163: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.177.134
country_id: 3175395
description:
Dec  1 13:07:09 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=185.68.177.134, lip=66.85.158.91, TLS, session=</BgCC99E2rG5RLGG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.68
country_id: 3469034
description:
Dec  1 13:07:30 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.44.71.68, lip=66.85.158.91, TLS, session=<pdEbDN9EHtexLEdE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.46.146.249
country_id: 6252001
description:
2025-12-01 13:11:54 dovecot_plain authenticator failed for ([89.116.164.85]) [73.46.146.249]:51167: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.151
country_id: 294640
description:
2025-12-01 13:14:17 dovecot_login authenticator failed for (ADMIN) [149.88.26.151]:49448: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.46.136.234
country_id: 3865483
description:
2025-12-01 13:15:47 dovecot_plain authenticator failed for ([89.116.164.85]) [181.46.136.234]:19685: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-01 13:18:20 dovecot_login authenticator failed for ([127.0.0.1]) [74.224.215.23]:5312: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.55.58
country_id: 298795
description:
2025-12-01 13:18:12 dovecot_login authenticator failed for ([127.0.0.1]) [185.254.55.58]:33006: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 13:22:45 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<cwSlQ99EdMAXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-01 13:24:05 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (chabrater) [81.225.30.107]:36698: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 13:24:28 host2 sshd[541273]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.156
country_id: 6252001
description:
2025-12-01 13:26:29 dovecot_login authenticator failed for (ADMIN) [173.244.56.156]:12300: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.218
country_id: 798549
description:
2025-12-01 13:30:45 dovecot_login authenticator failed for (ADMIN) [91.90.120.218]:15118: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-01 13:32:38 dovecot_login authenticator failed for bl14-230-132.dsl.telepac.pt [85.247.230.132]:43868: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-01 13:33:14 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:33585: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.13.107
country_id: 3469034
description:
2025-12-01 13:33:57 dovecot_plain authenticator failed for ([89.116.164.85]) [170.233.13.107]:12683: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-01 13:34:37 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:59126: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-01 13:34:47 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:53640: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-12-01 13:38:59 dovecot_login authenticator failed for (189.218.82.49-clientes-izzi.mx) [189.218.82.49]:33366: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-01 13:39:24 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:43414: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.61
country_id: 2635167
description:
2025-12-01 13:43:53 dovecot_login authenticator failed for (ADMIN) [98.159.234.61]:10578: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.87.218.89
country_id: 102358
description:
2025-12-01 13:45:28 dovecot_plain authenticator failed for ([89.116.164.85]) [178.87.218.89]:57722: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-01 13:47:07 dovecot_plain authenticator failed for (entorely) [154.146.240.123]:37522: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.210
country_id: 798549
description:
2025-12-01 13:46:38 dovecot_login authenticator failed for (ADMIN) [91.90.120.210]:32861: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec  1 13:48:00 host2 sshd[562752]: Disconnected from invalid user shiny 45.144.233.139 port 50214 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.178.15.45
country_id: 3865483
description:
2025-12-01 13:47:09 dovecot_plain authenticator failed for ([89.116.164.85]) [190.178.15.45]:44936: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 13:48:30 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<zTW3n99EYqQXXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 13:50:31 host2 sshd[565240]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec  1 13:50:22 host2 sshd[565123]: Disconnected from invalid user mm 45.144.233.139 port 47612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Dec  1 13:51:13 host2 sshd[565836]: Disconnected from invalid user victor 98.159.109.235 port 41064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.233.151.14
country_id: 3469034
description:
Dec  1 13:51:56 host2 sshd[566396]: Disconnected from invalid user Test 170.233.151.14 port 40048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.10.75
country_id: 2300660
description:
Dec  1 13:52:28 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=41.139.10.75, lip=66.85.158.91, TLS, session=<sOHmrN9EwswpiwpL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Dec  1 13:52:45 host2 sshd[567195]: Disconnected from invalid user ctf 103.49.238.251 port 36764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.140
country_id: 1269750
description:
Dec  1 13:52:49 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.8.118.140, lip=66.85.158.91, TLS, session=<zqIrrt9EPpdnCHaM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.212.79.24
country_id: 3469034
description:
2025-12-01 13:52:09 dovecot_plain authenticator failed for ([89.116.164.85]) [177.212.79.24]:51582: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.233.151.14
country_id: 3469034
description:
Dec  1 13:53:11 host2 sshd[567572]: Disconnected from invalid user init 170.233.151.14 port 48542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Dec  1 13:54:51 host2 sshd[569567]: Disconnected from invalid user testftp 70.65.44.183 port 34068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.233.151.14
country_id: 3469034
description:
Dec  1 13:55:40 host2 sshd[570379]: Disconnected from invalid user max 170.233.151.14 port 41412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.234.237.10
country_id: 298795
description:
2025-12-01 13:56:16 dovecot_plain authenticator failed for ([89.116.164.85]) [88.234.237.10]:46716: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Dec  1 13:56:32 host2 sshd[571098]: Disconnected from invalid user temp 103.49.238.251 port 43436 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - yashihol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashihol (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec  1 13:57:31 host2 sshd[572128]: Disconnected from invalid user public 45.144.233.139 port 34710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 70.65.44.183
country_id: 6251999
description:
Dec  1 13:57:16 host2 sshd[571850]: Disconnected from invalid user gerrit 70.65.44.183 port 34286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Dec  1 13:58:23 host2 sshd[572938]: Disconnected from invalid user sopuser 70.65.44.183 port 34392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec  1 13:58:29 host2 sshd[573003]: Disconnected from invalid user invoices 45.144.233.139 port 50742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 13:59:12 host2 sshd[573649]: Disconnected from invalid user admin 2.57.121.112 port 49289 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Dec  1 14:00:57 host2 sshd[575462]: Disconnected from invalid user usuario2 98.159.109.235 port 45938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-01 14:01:11 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (bress) [73.171.230.200]:53652: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Dec  1 14:01:43 host2 sshd[576180]: Disconnected from invalid user bot 103.49.238.251 port 39800 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-01 14:01:09 dovecot_plain authenticator failed for (prothnus) [65.20.233.110]:38516: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.121
country_id: 783754
description:
2025-12-01 14:03:26 dovecot_login authenticator failed for (ADMIN) [31.171.154.121]:48014: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.226.104.207
country_id: 298795
description:
2025-12-01 14:10:09 dovecot_plain authenticator failed for ([89.116.164.85]) [88.226.104.207]:11656: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-01 14:10:13 dovecot_login authenticator failed for ([62.73.121.209]) [62.73.121.209]:56032: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-01 14:10:22 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:58582: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 14:11:37 host2 sshd[586534]: Disconnected from invalid user miya 62.60.131.157 port 7078 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.3.154.58
country_id: 6252001
description:
Dec  1 14:12:07 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.3.154.58, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<RStS9N9E3uHAA5o6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - ceyl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 14:16:37 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<wEhKBOBEQlVRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-01 14:17:03 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (nisfase) [72.241.202.216]:57747: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.52
country_id: 2661886
description:
2025-12-01 14:18:43 dovecot_login authenticator failed for (ADMIN) [46.246.8.52]:46755: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec  1 14:21:24 host2 sshd[595398]: Disconnected from invalid user openbravo 201.249.205.94 port 43438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-01 14:23:00 dovecot_login authenticator failed for ([127.0.0.1]) [178.232.138.184]:38258: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.37
country_id: 3865483
description:
2025-12-01 14:22:47 dovecot_login authenticator failed for (ADMIN) [146.70.38.37]:6413: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-01 14:23:09 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.226.118]:45976: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Dec  1 14:23:43 host2 sshd[597512]: Disconnected from invalid user customer 196.188.120.232 port 55264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec  1 14:23:57 host2 sshd[597712]: Disconnected from invalid user debian 201.249.205.94 port 57380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Dec  1 14:25:00 host2 sshd[598772]: Disconnected from invalid user tuan 196.188.120.232 port 33410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec  1 14:25:17 host2 sshd[599219]: Disconnected from invalid user sopuser 36.67.70.198 port 55868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.188.120.232
country_id: 337996
description:
Dec  1 14:26:16 host2 sshd[600146]: Disconnected from invalid user superset 196.188.120.232 port 44612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec  1 14:26:57 host2 sshd[600746]: Disconnected from invalid user bob 36.67.70.198 port 33304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.230.95
country_id: 2635167
description:
Dec  1 14:27:41 host2 sshd[601568]: Disconnected from invalid user amssys 165.227.230.95 port 38328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec  1 14:28:51 host2 sshd[602625]: Disconnected from invalid user student 201.249.205.94 port 50878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Dec  1 14:30:04 host2 sshd[603803]: Disconnected from invalid user sopuser 196.188.120.232 port 33312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec  1 14:30:17 host2 sshd[604066]: Disconnected from invalid user server 36.67.70.198 port 45910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.230.95
country_id: 2635167
description:
Dec  1 14:31:12 host2 sshd[604915]: Disconnected from invalid user sonarqube 165.227.230.95 port 46230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Dec  1 14:32:29 host2 sshd[606107]: Disconnected from invalid user fred 196.188.120.232 port 37698 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.230.95
country_id: 2635167
description:
Dec  1 14:32:19 host2 sshd[605876]: Disconnected from invalid user radarr 165.227.230.95 port 47606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec  1 14:33:23 host2 sshd[606913]: Disconnected from invalid user superset 36.67.70.198 port 55242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.230.95
country_id: 2635167
description:
Dec  1 14:33:27 host2 sshd[606977]: Disconnected from invalid user ir 165.227.230.95 port 48548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.171
country_id: 102358
description:
2025-12-01 14:33:38 dovecot_login authenticator failed for (ADMIN) [95.181.235.171]:54387: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec  1 14:35:58 host2 sshd[609410]: Disconnected from invalid user javad 201.249.205.94 port 36584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.114.250
country_id: 1643084
description:
Dec  1 14:40:40 host2 sshd[614393]: Disconnected from invalid user frappe 103.52.114.250 port 39776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.78
country_id: 2510769
description:
2025-12-01 14:43:43 dovecot_login authenticator failed for (ADMIN) [212.102.49.78]:33233: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.114.250
country_id: 1643084
description:
Dec  1 14:44:56 host2 sshd[619087]: Disconnected from invalid user vendas 103.52.114.250 port 58630 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.3
country_id: 1269750
description:
Dec  1 14:46:18 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.51.223.3, lip=66.85.158.91, TLS, session=<zh9tbeBEd6xnM98D>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.114.250
country_id: 1643084
description:
Dec  1 14:46:19 host2 sshd[621149]: Disconnected from invalid user ts2 103.52.114.250 port 58002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.168
country_id: 1269750
description:
Dec  1 14:46:39 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.18.166.168, lip=66.85.158.91, TLS, session=<lMe3buBEB91nEqao>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.38
country_id: 617790
description:
2025-12-01 14:47:44 dovecot_login authenticator failed for (ADMIN) [178.175.128.38]:22099: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.114.250
country_id: 1643084
description:
Dec  1 14:51:33 host2 sshd[626110]: Disconnected from invalid user retag 103.52.114.250 port 38534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.114.250
country_id: 1643084
description:
Dec  1 14:52:51 host2 sshd[627263]: Disconnected from invalid user root1 103.52.114.250 port 40192 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - yash "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yash (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec  1 15:02:32 host2 sshd[638993]: Disconnected from invalid user admin1 83.229.122.23 port 46276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.20.136
country_id: 2750405
description:
2025-12-01 15:03:07 dovecot_login authenticator failed for (ADMIN) [158.173.20.136]:11079: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.18
country_id: 2029969
description:
2025-12-01 15:05:02 dovecot_login authenticator failed for (ADMIN) [173.244.58.18]:54266: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec  1 15:05:10 host2 sshd[643198]: Disconnected from invalid user sahil 5.182.26.99 port 33870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec  1 15:05:51 host2 sshd[644061]: Disconnected from invalid user admin1234 83.229.122.23 port 53674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec  1 15:07:15 host2 sshd[645708]: Disconnected from invalid user vendas 5.182.26.99 port 49778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec  1 15:07:20 host2 sshd[645807]: Disconnected from invalid user cacti 190.181.25.210 port 56455 [preauth]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.121.88.28
country_id: 1227603
description:
[2025-12-01 15:07:34 +0530] info [cpaneld] 45.121.88.28 NEW veneelk:qvZUPzvIMMAkLjDQ address=45.121.88.28,app=cpaneld,creator=veneelk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Dec  1 15:09:33 host2 sshd[648436]: Disconnected from invalid user intell 83.229.122.23 port 51444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec  1 15:10:54 host2 sshd[650305]: Disconnected from invalid user user1 83.229.122.23 port 60052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec  1 15:11:08 host2 sshd[650605]: Disconnected from invalid user admin 36.255.223.75 port 41494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec  1 15:12:10 host2 sshd[651733]: Disconnected from invalid user gits 5.182.26.99 port 38440 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.223.75
country_id: 1880251
description:
Dec  1 15:12:25 host2 sshd[651985]: Disconnected from invalid user user 36.255.223.75 port 13432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec  1 15:13:15 host2 sshd[652846]: Disconnected from invalid user luis 83.229.122.23 port 51274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-12-01 15:13:10 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (culers) [73.199.161.144]:52862: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec  1 15:14:41 host2 sshd[654290]: Disconnected from invalid user user6 190.181.25.210 port 38945 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec  1 15:14:49 host2 sshd[654421]: Disconnected from invalid user qw 36.255.223.75 port 12292 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.25.210
country_id: 3923057
description:
Dec  1 15:16:00 host2 sshd[655671]: Disconnected from invalid user oscar 190.181.25.210 port 53914 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-01 15:16:05 dovecot_plain authenticator failed for (excus) [65.20.133.208]:54689: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 15:15:34 host2 sshd[655334]: Disconnected from invalid user admin 2.57.121.112 port 42667 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.228
country_id: 718075
description:
2025-12-01 15:19:00 dovecot_login authenticator failed for (ADMIN) [185.225.28.228]:51704: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec  1 15:18:49 host2 sshd[658740]: Disconnected from invalid user victor 190.181.25.210 port 55615 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.47
country_id: 6252001
description:
2025-12-01 15:23:05 dovecot_login authenticator failed for (ADMIN) [212.32.50.47]:45544: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 15:23:36 host2 sshd[663722]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - ceylon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylon (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec  1 15:25:39 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<yVxM++BEiOkD7r/l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-01 15:29:32 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (prosteria) [174.166.153.20]:59394: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.40
country_id: 2589581
description:
2025-12-01 15:33:28 dovecot_login authenticator failed for (ADMIN) [176.125.228.40]:42690: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 15:32:57 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<rqJBFeFEaK4XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 15:34:54 host2 sshd[674640]: Disconnected from invalid user user 2.57.121.25 port 51944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 15:36:31 host2 sshd[676567]: Disconnected from invalid user user 2.57.121.25 port 6879 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-01 15:40:05 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (lares) [174.58.87.108]:53946: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.20.122
country_id: 2750405
description:
2025-12-01 15:45:22 dovecot_login authenticator failed for (ADMIN) [158.173.20.122]:18816: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.234
country_id: 3865483
description:
Dec  1 15:46:22 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=190.122.128.234, lip=66.85.158.91, TLS, session=<Tz82ROFEKcu+eoDq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Dec  1 15:45:53 host2 sshd[687482]: Disconnected from invalid user docker 54.38.52.18 port 34890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.114.0
country_id: 3469034
description:
Dec  1 15:46:42 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.87.114.0, lip=66.85.158.91, TLS, session=<XxV+ReFEAdaxV3IA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.39
country_id: 6252001
description:
2025-12-01 15:47:34 dovecot_login authenticator failed for (ADMIN) [173.244.56.39]:25283: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.52.18
country_id: 798544
description:
Dec  1 15:48:04 host2 sshd[689608]: Disconnected from invalid user ansible 54.38.52.18 port 51902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Dec  1 15:49:10 host2 sshd[690721]: Disconnected from invalid user test3 54.38.52.18 port 48214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Dec  1 15:51:24 host2 sshd[693442]: Disconnected from invalid user arkserver 54.38.52.18 port 54672 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 15:51:45 host2 sshd[693851]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 15:58:34 host2 sshd[701054]: Disconnected from invalid user sade 62.60.131.157 port 13326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 16:00:34 host2 sshd[703246]: Disconnected from invalid user sade 62.60.131.157 port 53382 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.133
country_id: 6252001
description:
Dec  1 16:01:30 host2 pure-ftpd[704118]: (?@66.132.153.133) [INFO] New connection from 66.132.153.133


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 16:02:28 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Xg/DfuFEKtkXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec  1 16:04:25 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, session=<brfqheFE4qk2rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-01 16:04:46 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:54895: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.25
country_id: 146669
description:
2025-12-01 16:04:51 dovecot_login authenticator failed for (ADMIN) [185.253.162.25]:59498: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Dec  1 16:04:36 host2 sshd[708012]: Disconnected from invalid user production 186.38.26.5 port 47046 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.42
country_id: 2542007
description:
2025-12-01 16:05:38 dovecot_login authenticator failed for (ADMIN) [95.181.232.42]:51229: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.38.26.5
country_id: 3865483
description:
Dec  1 16:06:19 host2 sshd[709996]: Disconnected from invalid user support 186.38.26.5 port 48416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.153
country_id: 6252001
description:
2025-12-01 16:07:33 dovecot_login authenticator failed for ([127.0.0.1]) [70.174.167.153]:34749: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.30
country_id: 6252001
description:
2025-12-01 16:07:40 dovecot_login authenticator failed for ([127.0.0.1]) [98.181.46.30]:40749: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Dec  1 16:07:56 host2 sshd[712513]: Disconnected from invalid user testftp 186.38.26.5 port 49784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Dec  1 16:09:32 host2 sshd[714423]: Disconnected from invalid user kingbase 186.38.26.5 port 51150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-01 16:11:54 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49941: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - yashih "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashih (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:16:27 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<iFX9sOFEqq8DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.15
country_id: 2186224
description:
2025-12-01 16:17:25 dovecot_login authenticator failed for ([121.73.162.15]) [121.73.162.15]:34810: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:17:09 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5il4s+FEBtUDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:17:37 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tVMeteFEos4DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-01 16:17:40 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:48299: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Dec  1 16:17:51 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.91, session=<2uryteFEqHdAPpze>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:19:03 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<77NCuuFEyq4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:20:47 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<mSx1wOFEbJcDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:22:31 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vGWrxuFEgrQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:23:17 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<BK5eyeFEOJcDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:23:56 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ffm6y+FEcpIDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.11
country_id: 6252001
description:
2025-12-01 16:24:33 dovecot_login authenticator failed for (ADMIN) [95.181.238.11]:34862: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:24:40 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<BMhczuFEVuEDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.24
country_id: 1819730
description:
Dec  1 16:25:11 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.142.154.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0mUu0OFE+BYtjpoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-12-01 16:26:42 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:42988: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.154.175
country_id: 6252001
description:
Dec  1 16:32:54 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.154.175, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9o3O6+FExJUUQZqv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 16:34:08 host2 sshd[739300]: Disconnected from invalid user admin 2.57.121.112 port 9403 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Dec  1 16:37:52 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<yryO/eFEuIgDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.54
country_id: 2510769
description:
Dec  1 16:38:24 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=139.28.190.54, lip=66.85.158.91, TLS, session=<2Epv/uFE0tiLHL42>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - ceylondi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.88.3
country_id: 3469034
description:
Dec  1 16:38:44 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.22.88.3, lip=66.85.158.91, TLS, session=<5wyS/+FEI8ixFlgD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.108.174.24
country_id: 1269750
description:
2025-12-01 16:42:13 dovecot_login authenticator failed for (ADMIN) [103.108.174.24]:41020: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 16:47:21 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<FuhcH+JEeSNRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.98.41
country_id: 3469034
description:
2025-12-01 16:47:38 dovecot_login authenticator failed for (ADMIN) [146.70.98.41]:17216: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.84
country_id: 6252001
description:
Dec  1 16:48:36 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.126.84, lip=66.85.158.91, TLS, session=<e6ruI+JEKtiH7X5U>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-01 16:52:05 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:34719: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.235.173
country_id: 2750405
description:
Dec  1 16:51:47 host2 sshd[756321]: Disconnected from invalid user jrodrig 62.60.235.173 port 47296 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-12-01 16:51:58 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:35752: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 16:54:04 host2 sshd[758915]: Disconnected from invalid user user 2.57.121.25 port 40842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.235.173
country_id: 2750405
description:
Dec  1 16:55:16 host2 sshd[760941]: Disconnected from invalid user devuser 62.60.235.173 port 47038 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.230.80.50
country_id: 3865483
description:
Dec  1 16:57:24 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=45.230.80.50, lip=66.85.158.91, TLS, session=<cbQ0QuJE4uot5lAy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.162
country_id: 2635167
description:
2025-12-01 16:56:51 dovecot_login authenticator failed for (ADMIN) [98.159.234.162]:42484: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.235.173
country_id: 2750405
description:
Dec  1 16:57:59 host2 sshd[763931]: Disconnected from invalid user ventas01 62.60.235.173 port 37004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.37
country_id: 933860
description:
Dec  1 16:57:48 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<amila>, method=PLAIN, rip=41.216.213.37, lip=66.85.158.91, TLS, session=<NaSfQ+JEKbgp2NUl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.235.173
country_id: 2750405
description:
Dec  1 16:59:25 host2 sshd[765362]: Disconnected from invalid user hamed 62.60.235.173 port 39326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.235.173
country_id: 2750405
description:
Dec  1 17:00:52 host2 sshd[766854]: Disconnected from invalid user dspace 62.60.235.173 port 35262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.71
country_id: 298795
description:
2025-12-01 17:08:28 dovecot_login authenticator failed for (ADMIN) [188.213.34.71]:44216: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.132
country_id: 6252001
description:
2025-12-01 17:11:18 dovecot_login authenticator failed for (ADMIN) [158.173.153.132]:46393: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-12-01 17:18:16 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:59114: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-01 17:18:30 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:34784: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-01 17:20:58 +0530] info [cpaneld] 43.245.222.27 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-01 17:24:17 dovecot_login authenticator failed for ([127.0.0.1]) [62.97.161.137]:51417: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-01 17:24:25 dovecot_login authenticator failed for ([127.0.0.1]) [128.185.253.122]:53200: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 17:26:03 host2 sshd[792213]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.107
country_id: 2921044
description:
2025-12-01 17:27:58 dovecot_login authenticator failed for (ADMIN) [191.101.157.107]:4286: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.231
country_id: 6252001
description:
2025-12-01 17:27:15 dovecot_login authenticator failed for (ADMIN) [102.129.235.231]:41352: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  1 17:28:13 host2 sshd[794315]: Disconnected from invalid user default 198.12.114.232 port 56452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  1 17:30:40 host2 sshd[796918]: Disconnected from invalid user esuser 198.12.114.232 port 47668 [preauth]


