# incident

plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Dec 16 13:53:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 19 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS handshaking: Connection closed, session=<LYjDcg1GVr5ChJmF>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.241.95.66
country_id: 1269750
description:
Dec 16 13:56:06 host2 sshd[942162]: Disconnected from invalid user dev 117.241.95.66 port 41894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-16 13:57:30 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:60670: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-12-16 13:57:42 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:43082: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.9.217
country_id: 1880251
description:
Dec 16 13:59:06 host2 sshd[944449]: Disconnected from invalid user kkk 43.163.9.217 port 53224 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.9.217
country_id: 1880251
description:
Dec 16 14:02:46 host2 sshd[947663]: Disconnected from invalid user username 43.163.9.217 port 58990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.24
country_id: 2635167
description:
2025-12-16 14:02:17 dovecot_login authenticator failed for (ADMIN) [45.133.172.24]:9824: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.124.158.147
country_id: 99237
description:
Dec 16 14:05:22 host2 sshd[949637]: Disconnected from invalid user matlab 138.124.158.147 port 58716 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.124.158.147
country_id: 99237
description:
Dec 16 14:05:58 host2 sshd[949925]: Disconnected from invalid user igor 138.124.158.147 port 46710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.9.217
country_id: 1880251
description:
Dec 16 14:05:15 host2 sshd[949563]: Disconnected from invalid user wy 43.163.9.217 port 41874 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.33
country_id: 2963597
description:
2025-12-16 14:09:10 dovecot_login authenticator failed for (ADMIN) [155.2.194.33]:2045: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-12-16 14:09:23 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:52490: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-16 14:10:11 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:39617: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.112.100.11
country_id: 3175395
description:
Dec 16 14:10:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=217.112.100.11, lip=66.85.158.91, TLS, session=<0Xx6rg1GEYvZcGQL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-12-16 14:11:57 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:60712: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.230.11.165
country_id: 2661886
description:
Dec 16 14:11:10 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=81.230.11.165, lip=66.85.158.91, TLS, session=<0lKLrw1GvYBR5gul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.125.83.34
country_id: 1880251
description:
2025-12-16 14:11:41 dovecot_login authenticator failed for ([203.125.110.142]) [203.125.83.34]:61329: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.164.119
country_id: 2661886
description:
2025-12-16 14:12:27 dovecot_plain authenticator failed for 79.138.164.119.mobile.tre.se (slysivest) [79.138.164.119]:36518: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 14:13:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<365Uug1GVq8+PIcd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.9.82
country_id: 1168579
description:
Dec 16 14:16:49 host2 sshd[956445]: Disconnected from invalid user arcgis 103.164.9.82 port 36240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.178.94
country_id: 3175395
description:
2025-12-16 14:17:33 dovecot_plain authenticator failed for (dectrost) [151.3.178.94]:40392: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2025-12-16 14:19:01 dovecot_login authenticator failed for ([62.201.253.23]) [62.201.253.23]:47129: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.107.116.210
country_id: 798544
description:
2025-12-16 14:19:28 dovecot_login authenticator failed for (host-176.107.116-210.dynamic.mm.pl) [176.107.116.210]:53879: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 14:19:45 host2 sshd[957583]: Disconnected from invalid user anton 62.60.131.157 port 12721 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 14:19:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<jI2Szw1GCJ4+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.118
country_id: 1269750
description:
2025-12-16 14:19:55 dovecot_login authenticator failed for ([152.52.234.180]) [182.95.177.118]:44284: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.20.137.134
country_id: 3865483
description:
[2025-12-16 14:20:16 +0530] info [cpaneld] 181.20.137.134 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.215.124.52
country_id: 1512440
description:
[2025-12-16 14:20:20 +0530] info [cpaneld] 82.215.124.52 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 210.87.86.190
country_id: 1643084
description:
[2025-12-16 14:20:22 +0530] info [whostmgrd] 210.87.86.190 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.145.36.48
country_id: 1694008
description:
[2025-12-16 14:20:30 +0530] info [cpaneld] 49.145.36.48 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.209.222.64
country_id: 2287781
description:
[2025-12-16 14:20:46 +0530] info [cpaneld] 102.209.222.64 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.44.178.1
country_id: 102358
description:
[2025-12-16 14:20:49 +0530] info [cpaneld] 176.44.178.1 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-12-16 14:20:20 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:60508: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.128.251.29
country_id: 3865483
description:
[2025-12-16 14:20:33 +0530] info [cpaneld] 186.128.251.29 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-12-16 14:20:42 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:44203: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.244.155.212
country_id: 6252001
description:
[2025-12-16 14:20:47 +0530] info [cpaneld] 74.244.155.212 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.51.88.95
country_id: 1282988
description:
[2025-12-16 14:20:43 +0530] info [cpaneld] 202.51.88.95 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.131.91.152
country_id: 6252001
description:
[2025-12-16 14:20:44 +0530] info [whostmgrd] 72.131.91.152 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.211.168.47
country_id: 6252001
description:
[2025-12-16 14:20:17 +0530] info [cpaneld] 72.211.168.47 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 121.98.86.220
country_id: 2186224
description:
[2025-12-16 14:20:24 +0530] info [cpaneld] 121.98.86.220 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.203.78.149
country_id: 290557
description:
[2025-12-16 14:20:40 +0530] info [cpaneld] 94.203.78.149 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.166.139.194
country_id: 3017382
description:
[2025-12-16 14:20:41 +0530] info [cpaneld] 88.166.139.194 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.191
country_id: 3017382
description:
Dec 16 14:21:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.191, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+i8Y1g1Gm4pbxJi/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 14:21:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<hfAp1g1GGpg+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.189
country_id: 3017382
description:
Dec 16 14:22:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.189, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<nzSH1w1GcYNbxJi9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-16 14:21:33 dovecot_plain authenticator failed for (bekiess) [65.20.233.110]:47811: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.9.82
country_id: 1168579
description:
Dec 16 14:22:06 host2 sshd[959153]: Disconnected from invalid user core 103.164.9.82 port 58164 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.189
country_id: 3017382
description:
Dec 16 14:22:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.189, lip=66.85.158.92, TLS: Connection closed, session=<aDO31w1GJbNbxJi9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.247.105.174
country_id: 6251999
description:
2025-12-16 14:23:08 dovecot_login authenticator failed for (ADMIN) [84.247.105.174]:21702: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-16 14:23:36 dovecot_plain authenticator failed for (abstings) [154.144.243.93]:54658: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.101
country_id: 6252001
description:
2025-12-16 14:24:55 dovecot_login authenticator failed for (ADMIN) [158.173.153.101]:55796: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.105.110.146
country_id: 3865483
description:
[2025-12-16 14:27:49 +0530] info [cpaneld] 200.105.110.146 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.215.142.153
country_id: 3895114
description:
[2025-12-16 14:27:34 +0530] info [cpaneld] 190.215.142.153 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.62.241.11
country_id: 3469034
description:
[2025-12-16 14:27:37 +0530] info [cpaneld] 187.62.241.11 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.60.64.42
country_id: 3895114
description:
[2025-12-16 14:27:39 +0530] info [cpaneld] 179.60.64.42 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.253.246
country_id: 933860
description:
[2025-12-16 14:27:42 +0530] info [whostmgrd] 143.105.253.246 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.13.209.93
country_id: 3865483
description:
[2025-12-16 14:27:44 +0530] info [cpaneld] 186.13.209.93 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.255.184.98
country_id: 290291
description:
[2025-12-16 14:27:47 +0530] info [cpaneld] 84.255.184.98 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-16 14:28:13 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52036: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-16 14:28:15 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (piteric) [73.197.194.98]:38710: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-12-16 14:28:54 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:34451: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.206
country_id: 1269750
description:
2025-12-16 14:29:15 dovecot_login authenticator failed for ([182.95.63.206]) [182.95.63.206]:57704: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 14:35:00 host2 sshd[964960]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.214.83.136
country_id: 6252001
description:
[2025-12-16 14:36:04 +0530] info [cpaneld] 66.214.83.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.108.192.32
country_id: 3865483
description:
[2025-12-16 14:36:02 +0530] info [cpaneld] 190.108.192.32 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.185.255.102
country_id: 6252001
description:
[2025-12-16 14:36:08 +0530] info [cpaneld] 24.185.255.102 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.20.183.33
country_id: 3865483
description:
[2025-12-16 14:36:09 +0530] info [whostmgrd] 181.20.183.33 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.189.148.166
country_id: 3865483
description:
[2025-12-16 14:36:11 +0530] info [cpaneld] 190.189.148.166 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.75.225.253
country_id: 99237
description:
[2025-12-16 14:36:13 +0530] info [cpaneld] 185.75.225.253 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.182.60.29
country_id: 3469034
description:
[2025-12-16 14:36:15 +0530] info [cpaneld] 45.182.60.29 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 16 14:37:16 host2 sshd[966336]: Disconnected from invalid user ansible 43.133.148.170 port 41176 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 14:39:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<mkZpFg5Gwqs+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.37.72.46
country_id: 3469034
description:
Dec 16 14:39:49 host2 sshd[967338]: Disconnected from invalid user jj 191.37.72.46 port 43130 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 14:39:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<rkIvFw5GdJI+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-16 14:40:00 dovecot_login authenticator failed for (nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:48978: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-16 14:40:14 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:44268: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 16 14:43:03 host2 sshd[969222]: Disconnected from invalid user rootuser 43.133.148.170 port 38358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 16 14:43:44 host2 sshd[969563]: Disconnected from invalid user root1 43.133.148.170 port 54326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.32
country_id: 1880251
description:
Dec 16 14:43:06 host2 sshd[969242]: Disconnected from invalid user magento 45.78.228.32 port 33434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.37.72.46
country_id: 3469034
description:
Dec 16 14:44:15 host2 sshd[969783]: Disconnected from invalid user webadm 191.37.72.46 port 4239 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 16 14:44:19 host2 sshd[969809]: Disconnected from invalid user azure 70.54.182.130 port 38961 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.139.191.44
country_id: 130758
description:
Dec 16 14:46:00 host2 sshd[971508]: Disconnected from invalid user magento 94.139.191.44 port 53132 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.211.21.213
country_id: 1269750
description:
2025-12-16 14:47:27 dovecot_login authenticator failed for (213-21.211.103.static.gtplkcbpl.in) [103.211.21.213]:59789: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.27.116.226
country_id: 2635167
description:
2025-12-16 14:47:50 dovecot_login authenticator failed for ([92.27.116.226]) [92.27.116.226]:36916: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.133.148.170
country_id: 1643084
description:
Dec 16 14:47:53 host2 sshd[972474]: Disconnected from invalid user alex 43.133.148.170 port 55586 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 14:47:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<MR4MMQ5Gcp4+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.54.182.130
country_id: 6251999
description:
Dec 16 14:47:30 host2 sshd[972290]: Disconnected from invalid user admin 70.54.182.130 port 36734 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 16 14:50:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<wgvKOw5GNrM+PIds>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.107.88.97
country_id: 3469034
description:
Dec 16 14:50:24 host2 sshd[973933]: Disconnected from invalid user admin123 187.107.88.97 port 3554 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.187
country_id: 1694008
description:
2025-12-16 14:51:00 dovecot_login authenticator failed for (ADMIN) [188.214.125.187]:25993: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Dec 16 14:52:07 host2 sshd[975079]: Disconnected from invalid user ftpuser 187.107.88.97 port 3559 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 14:54:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<wM6GTA5GiNY+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.32
country_id: 1880251
description:
Dec 16 14:58:13 host2 sshd[979296]: Disconnected from invalid user elastic 45.78.228.32 port 55586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-16 14:59:36 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (syclinging) [174.166.153.20]:56354: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.216
country_id: 6252001
description:
2025-12-16 15:01:03 dovecot_login authenticator failed for (ADMIN) [102.129.153.216]:33984: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-16 15:00:56 dovecot_plain authenticator failed for (ading) [176.113.155.132]:58655: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.202
country_id: 6252001
description:
Dec 16 15:05:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.202, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</G8KdA5G287G6xjK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-16 15:06:03 dovecot_login authenticator failed for ([1.7.229.162]) [136.232.73.130]:56590: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-12-16 15:06:15 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:59681: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 15:06:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<D4l1dw5GgoQ+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 15:09:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<AnJRgA5G3N4+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 16 15:11:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<PpSQiA5GktM+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 15:11:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<3h9HiQ5G6KE+PIcm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 15:15:06 host2 sshd[993433]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.44
country_id: 6251999
description:
2025-12-16 15:15:23 dovecot_login authenticator failed for (ADMIN) [66.56.80.44]:16904: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 15:15:58 host2 sshd[994004]: Disconnected from invalid user chaz 62.60.131.157 port 45181 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.69.236.207
country_id: 3865483
description:
Dec 16 15:17:45 host2 sshd[995217]: Disconnected from invalid user bot 200.69.236.207 port 33205 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 15:17:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<uNZBnw5G0Ns+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.98.20
country_id: 3469034
description:
2025-12-16 15:19:39 dovecot_login authenticator failed for (ADMIN) [146.70.98.20]:55087: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-16 15:19:43 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (hynemle) [76.31.164.124]:57922: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.50.179.74
country_id: 1694008
description:
Dec 16 15:20:23 host2 sshd[996982]: Disconnected from invalid user test 116.50.179.74 port 38740 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-16 15:19:28 dovecot_plain authenticator failed for (huarte) [65.20.133.4]:33856: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 15:21:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Vghyqg5GGtg+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Dec 16 15:21:43 host2 sshd[998133]: Disconnected from invalid user hydra 212.154.234.9 port 31552 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.191.220.202
country_id: 3865483
description:
Dec 16 15:26:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=181.191.220.202, lip=66.85.158.91, TLS, session=<ZR32vA5GQY61v9zK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.167
country_id: 3175395
description:
Dec 16 15:26:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=185.197.8.167, lip=66.85.158.91, TLS, session=<Pr0tvg5GybC5xQin>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-16 15:27:50 dovecot_login authenticator failed for (cm-178.232.153.27.get.no) [178.232.153.27]:46305: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 15:27:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<rIoaww5G5OI+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.190.86.24
country_id: 3686110
description:
2025-12-16 15:28:05 dovecot_login authenticator failed for ([45.190.86.24]) [45.190.86.24]:43697: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 16 15:28:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<uDDfww5GdpY+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 15:28:26 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ruperves) [87.103.126.54]:47485: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-12-16 15:31:53 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:42759: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.246
country_id: 6252001
description:
2025-12-16 15:32:15 dovecot_login authenticator failed for wsip-184-191-242-246.fv.ks.cox.net [184.191.242.246]:34556: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.116
country_id: 1831722
description:
2025-12-16 15:32:29 dovecot_login authenticator failed for (ADMIN) [188.215.235.116]:23720: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.103
country_id: 3996063
description:
2025-12-16 15:32:50 dovecot_login authenticator failed for (201.173.57.103-clientes-izzi.mx) [201.173.57.103]:42328: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.179
country_id: 2215636
description:
2025-12-16 15:32:29 dovecot_login authenticator failed for ([102.38.3.179]) [102.38.3.179]:35494: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 16 15:34:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<pnHV2Q5GLtM+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Dec 16 15:35:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.91, TLS: Connection closed, session=<8RBX3w5Gdpsiemm2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-16 15:36:56 dovecot_plain authenticator failed for (woont) [102.53.15.56]:36867: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 15:37:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<cvD/4w5G/KU+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-16 15:39:26 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (saltaly) [98.227.25.115]:52650: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 16 15:38:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<VUkE6Q5G8NkD7r/l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 16 15:39:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<qs5n7A5GxOg+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.130
country_id: 3865483
description:
Dec 16 15:41:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=190.181.101.130, lip=66.85.158.91, TLS, session=<Aii38Q5GgYu+tWWC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-16 15:41:23 dovecot_login authenticator failed for (cm-178.232.147.85.get.no) [178.232.147.85]:33137: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-16 15:41:44 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:55994: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-16 15:42:20 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:53557: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.202
country_id: 3175395
description:
Dec 16 15:41:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=171.22.233.202, lip=66.85.158.91, TLS, session=<8dP78g5G896rFunK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 15:43:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<LmtY+Q5GPKU+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Dec 16 15:43:19 host2 sshd[1014544]: Disconnected from invalid user xh 45.249.245.22 port 39996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.77.30.178
country_id: 1269750
description:
Dec 16 15:42:52 host2 sshd[1014184]: Disconnected from invalid user josh 182.77.30.178 port 49030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.245.22
country_id: 1819730
description:
Dec 16 15:43:56 host2 sshd[1014943]: Disconnected from invalid user postgres 45.249.245.22 port 40904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.87.213.85
country_id: 2017370
description:
Dec 16 15:43:44 host2 sshd[1014841]: Disconnected from invalid user gameserver 194.87.213.85 port 34996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Dec 16 15:43:50 host2 sshd[1014902]: Disconnected from invalid user jira 178.128.92.222 port 60814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.92.222
country_id: 1880251
description:
Dec 16 15:44:31 host2 sshd[1015250]: Disconnected from invalid user hyper 178.128.92.222 port 60680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.87.213.85
country_id: 2017370
description:
Dec 16 15:44:50 host2 sshd[1015414]: Disconnected from invalid user weblogic 194.87.213.85 port 33858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.3.175
country_id: 6252001
description:
Dec 16 15:44:35 host2 sshd[1015300]: Disconnected from invalid user git 206.81.3.175 port 50444 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.68.222
country_id: 3932488
description:
Dec 16 15:44:57 host2 sshd[1015493]: Disconnected from invalid user postgres 161.132.68.222 port 42314 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 15:46:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<aZLDBA9Gts0+PIM0>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 206.81.3.175
country_id: 6252001
description:
Dec 16 15:47:05 host2 sshd[1017673]: Received disconnect from 206.81.3.175 port 34670:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.3.175
country_id: 6252001
description:
Dec 16 15:47:05 host2 sshd[1017673]: Disconnected from invalid user postgres 206.81.3.175 port 34670 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.77.30.178
country_id: 1269750
description:
Dec 16 15:47:44 host2 sshd[1017969]: Disconnected from invalid user ubuntu 182.77.30.178 port 43514 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 15:49:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<4H5QDg9GFsM+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.66
country_id: 6252001
description:
2025-12-16 15:51:18 dovecot_login authenticator failed for (ADMIN) [95.181.238.66]:24277: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 16 15:50:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<KdIXFQ9G8NU+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-16 15:53:07 dovecot_plain authenticator failed for (gonon) [38.248.111.238]:44434: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.146.254.92
country_id: 6252001
description:
[2025-12-16 15:55:37 +0530] info [cpaneld] 47.146.254.92 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.7.96.161
country_id: 3469034
description:
[2025-12-16 15:55:40 +0530] info [cpaneld] 191.7.96.161 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.62.160.65
country_id: 6252001
description:
[2025-12-16 15:55:45 +0530] info [cpaneld] 38.62.160.65 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.242.51.15
country_id: 3469034
description:
[2025-12-16 15:55:47 +0530] info [cpaneld] 191.242.51.15 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.139.9.120
country_id: 6252001
description:
[2025-12-16 15:55:46 +0530] info [cpaneld] 73.139.9.120 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-12-16 15:56:15 dovecot_login authenticator failed for ([46.210.94.61]) [46.210.94.61]:44788: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.124.2.7
country_id: 3865483
description:
[2025-12-16 15:55:39 +0530] info [cpaneld] 190.124.2.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.237.153.103
country_id: 1819730
description:
[2025-12-16 15:55:43 +0530] info [whostmgrd] 119.237.153.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.67
country_id: 1814991
description:
2025-12-16 15:56:03 dovecot_login authenticator failed for (ADMIN) [188.241.80.67]:39669: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.4
country_id: 1733045
description:
2025-12-16 15:56:35 dovecot_login authenticator failed for ([49.124.151.4]) [49.124.151.4]:55298: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 16 15:59:00 host2 pure-ftpd[1025636]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-12-16 15:59:28 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:55572: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 15:59:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<khdXNA9GUqo+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-16 15:59:40 dovecot_login authenticator failed for (187.161.198.68-clientes-izzi.mx) [187.161.198.68]:53925: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-16 16:01:23 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (snern) [196.47.172.253]:44266: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-16 16:02:21 dovecot_login authenticator failed for ([27.123.102.122]) [27.123.102.122]:48890: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-16 16:01:26 dovecot_login authenticator failed for (203-128-10-138.braintel.net.pk) [203.128.10.138]:37178: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-12-16 16:05:17 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:40890: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 16 16:05:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<NpH5SA9GhoQ+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-16 16:04:31 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:47993: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 16:11:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=</C1/Xg9GWJc+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 16:11:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<jf8AXw9G4Ms+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 16:13:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<e5H2Zg9Grsg+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2025-12-16 16:14:10 dovecot_plain authenticator failed for c-98-196-209-55.hsd1.tx.comcast.net (ractisess) [98.196.209.55]:45360: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.61.162
country_id: 6252001
description:
2025-12-16 16:14:37 dovecot_login authenticator failed for (ADMIN) [191.101.61.162]:43561: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 45.15.226.44
country_id: 617790
description:
Dec 16 16:17:01 host2 sshd[1038518]: error: maximum authentication attempts exceeded for root from 45.15.226.44 port 40354 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.15.226.44
country_id: 617790
description:
Dec 16 16:17:21 host2 sshd[1038719]: Disconnecting invalid user admin 45.15.226.44 port 54376: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.39
country_id: 2629691
description:
2025-12-16 16:16:49 dovecot_login authenticator failed for (ADMIN) [45.133.193.39]:25400: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 45.15.226.44
country_id: 617790
description:
Dec 16 16:17:01 host2 sshd[1038518]: Disconnecting authenticating user root 45.15.226.44 port 40354: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 16:18:35 host2 sshd[1039315]: Disconnected from invalid user caleigh 62.60.131.157 port 20143 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 16 16:20:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<4mr0fw9GMLk+PIdi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.179.243
country_id: 2921044
description:
Dec 16 16:21:44 host2 sshd[1041104]: Invalid user Can't open edapass from 167.172.179.243 port 41580


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 16:22:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<wYPRhw9GfKQ+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 16:23:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<X7vphw9GYOE+PIdp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 16:24:59 host2 sshd[1042928]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.142
country_id: 1269750
description:
Dec 16 16:25:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=103.18.166.142, lip=66.85.158.91, TLS, session=<7PXnkA9GmuFnEqaO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.244.196
country_id: 798544
description:
Dec 16 16:26:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts>, method=PLAIN, rip=109.125.244.196, lip=66.85.158.91, TLS, session=<sswrkg9Gx7FtffTE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-16 16:27:28 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (chent) [68.40.189.43]:49922: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 16:27:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=</oicmQ9GkNc+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.132.199.196
country_id: 1819730
description:
Dec 16 16:28:54 host2 sshd[1045157]: Disconnected from invalid user 123 43.132.199.196 port 59282 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 16 16:28:34 host2 sshd[1045011]: Disconnected from invalid user github 190.60.51.173 port 42924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 16 16:30:12 host2 sshd[1046057]: Disconnected from invalid user sdtdserver 190.60.51.173 port 47300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.24.213.28
country_id: 6252001
description:
2025-12-16 16:31:05 dovecot_login authenticator failed for (ADMIN) [216.24.213.28]:41450: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 16 16:30:49 host2 sshd[1046386]: Disconnected from invalid user administrator 190.60.51.173 port 49006 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 16:31:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ZtmSpA9GyLs+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.60.51.173
country_id: 3686110
description:
Dec 16 16:32:03 host2 sshd[1046968]: Disconnected from invalid user nabi 190.60.51.173 port 36304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.215
country_id: 6252001
description:
Dec 16 16:33:06 host2 sshd[1047738]: Disconnected from invalid user mt 107.174.67.215 port 49982 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.75.54
country_id: 1819730
description:
Dec 16 16:34:17 host2 sshd[1048484]: Disconnected from invalid user dev02 156.236.75.54 port 40560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-12-16 16:34:30 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:58326: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.215
country_id: 6252001
description:
Dec 16 16:34:40 host2 sshd[1048623]: Disconnected from invalid user postgres 107.174.67.215 port 42612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.17.174
country_id: 2017370
description:
2025-12-16 16:34:44 dovecot_login authenticator failed for ([155.212.17.174]) [155.212.17.174]:39206: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 16 16:35:48 host2 sshd[1049396]: Disconnected from invalid user ubuntu 51.89.166.236 port 50142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.215
country_id: 6252001
description:
Dec 16 16:35:48 host2 sshd[1049412]: Disconnected from invalid user sasha 107.174.67.215 port 38738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.54
country_id: 1819730
description:
Dec 16 16:35:35 host2 sshd[1049261]: Disconnected from invalid user mt 156.236.75.54 port 40826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.89.166.236
country_id: 2635167
description:
Dec 16 16:37:18 host2 sshd[1050349]: Disconnected from invalid user ubuntu 51.89.166.236 port 36448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.67.215
country_id: 6252001
description:
Dec 16 16:36:51 host2 sshd[1050074]: Disconnected from invalid user site 107.174.67.215 port 34864 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 16 16:36:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<lL9muQ9GmIc+PIcr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.226.150.85
country_id: 1880251
description:
Dec 16 16:37:02 host2 sshd[1050209]: Disconnected from invalid user adv 129.226.150.85 port 44476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.150.56
country_id: 6252001
description:
Dec 16 16:37:30 host2 sshd[1050457]: Disconnected from invalid user sasha 198.23.150.56 port 35238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 16 16:37:48 host2 sshd[1050635]: Disconnected from invalid user postgres 102.88.137.80 port 1335 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.152.37
country_id: 1269750
description:
Dec 16 16:38:31 host2 sshd[1051149]: Disconnected from invalid user mt 106.51.152.37 port 34874 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.80
country_id: 2328926
description:
Dec 16 16:39:16 host2 sshd[1051578]: Disconnected from invalid user noc 102.88.137.80 port 1319 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 16 16:40:21 host2 sshd[1052357]: Disconnected from invalid user mt 160.251.197.41 port 50576 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Dec 16 16:41:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.91, session=<Uuu5yA9GhOxAPsUR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.226.150.85
country_id: 1880251
description:
Dec 16 16:41:29 host2 sshd[1052905]: Disconnected from invalid user deploy 129.226.150.85 port 52782 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Dec 16 16:41:31 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.91, session=<Nck8yg9Gwk1APsUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-16 16:44:10 dovecot_plain authenticator failed for (tatife) [65.20.129.28]:50883: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 16:44:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<euKC1A9G+Ko+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 16:47:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<JVDD3Q9GwOk+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.60
country_id: 2802361
description:
2025-12-16 16:48:35 dovecot_login authenticator failed for (ADMIN) [181.214.218.60]:41392: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-16 16:49:40 dovecot_plain authenticator failed for (fratuped) [65.20.233.110]:50644: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 16 16:49:41 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, session=<hpxz5w9Ggrc26lCA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 16 16:50:50 host2 sshd[1060332]: Disconnected from invalid user user1 160.251.197.41 port 46378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.6.147
country_id: 2077456
description:
2025-12-16 16:51:17 dovecot_login authenticator failed for ([120.157.6.147]) [120.157.6.147]:33424: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.22
country_id: 6252001
description:
2025-12-16 16:51:38 dovecot_login authenticator failed for ([98.181.46.22]) [98.181.46.22]:44525: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.188.156
country_id: 99237
description:
2025-12-16 16:52:59 dovecot_plain authenticator failed for (sinas) [65.20.188.156]:59610: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 16 16:52:57 host2 sshd[1061700]: Disconnected from invalid user noc 160.251.197.41 port 42970 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 16:53:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<IBB19Q9GwLE+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.51
country_id: 6252001
description:
2025-12-16 16:54:21 dovecot_login authenticator failed for ([98.181.46.51]) [98.181.46.51]:38630: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 16:54:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<5FNq+A9GmLI+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-16 16:54:37 dovecot_login authenticator failed for ([152.52.14.137]) [182.79.89.14]:57986: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.226.154.124
country_id: 3469034
description:
Dec 16 16:55:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=45.226.154.124, lip=66.85.158.91, TLS, session=<AQed+g9GQw8t4pp8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.213.141
country_id: 99237
description:
Dec 16 16:55:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=65.20.213.141, lip=66.85.158.91, TLS, session=<whvR+w9Gu6VBFNWN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.106
country_id: 3469034
description:
Dec 16 16:55:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=186.216.88.106, lip=66.85.158.91, TLS, session=<0Kwy/A9GbYO62Fhq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.192.97.106
country_id: 3469034
description:
Dec 16 16:56:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=200.192.97.106, lip=66.85.158.91, TLS, session=<qeZs/Q9GqYvIwGFq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-16 16:57:12 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (priffets) [73.0.235.30]:35154: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-16 16:57:56 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (coscalas) [76.16.7.82]:37737: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2025-12-16 16:57:56 dovecot_login authenticator failed for (31-154-85-196.orange.net.il) [2.55.85.196]:37968: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-16 16:58:33 dovecot_login authenticator failed for ([84.210.149.45]) [84.210.149.45]:60664: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.45
country_id: 6252001
description:
Dec 16 17:00:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.5.45, lip=66.85.158.91, TLS handshaking: Connection closed, session=<s76tDRBG9NkSYQUt>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.40.213
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 159.223.40.213 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 17:03:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<4WRmGRBGUOg+PIM0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 17:05:14 host2 sshd[1072653]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.15
country_id: 3996063
description:
2025-12-16 17:04:40 dovecot_login authenticator failed for (ADMIN) [77.81.142.15]:31011: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Dec 16 17:05:37 host2 sshd[1072932]: Disconnected from invalid user admin 160.251.197.41 port 54240 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.203.135
country_id: 2077456
description:
2025-12-16 17:07:40 dovecot_login authenticator failed for (ADMIN) [173.239.203.135]:57150: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-16 17:09:08 dovecot_plain authenticator failed for (morilte) [12.150.243.22]:44583: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 16 17:11:26 host2 sshd[1077110]: Disconnected from invalid user fengkai 103.174.114.50 port 45028 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 183.82.126.193
country_id: 1269750
description:
Dec 16 17:10:34 host2 sshd[1076447]: Disconnected from invalid user alex 183.82.126.193 port 54624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.101.224.61
country_id: 1605651
description:
2025-12-16 17:11:11 dovecot_login authenticator failed for cm-171-101-224-61.revip11.asianet.co.th [171.101.224.61]:57986: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2025-12-16 17:11:36 dovecot_login authenticator failed for ([27.123.94.66]) [27.123.94.66]:36312: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
country_id: 6252001
description:
2025-12-16 17:11:53 dovecot_login authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:34226: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 16 17:13:55 host2 sshd[1078954]: Disconnected from invalid user zhangxin 37.59.110.4 port 57214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 16 17:14:29 host2 sshd[1079363]: Disconnected from invalid user user 37.59.110.4 port 60540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 16 17:14:43 host2 sshd[1079592]: Disconnected from invalid user app 103.174.114.50 port 49826 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.59.110.4
country_id: 3017382
description:
Dec 16 17:16:00 host2 sshd[1080751]: Disconnected from invalid user user 37.59.110.4 port 53592 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.114.50
country_id: 1643084
description:
Dec 16 17:18:51 host2 sshd[1083107]: Disconnected from invalid user joe 103.174.114.50 port 42706 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 16 17:20:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<qBDRVBBGzuM+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.10
country_id: 2993457
description:
2025-12-16 17:23:45 dovecot_login authenticator failed for (ADMIN) [95.181.233.10]:2062: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 17:27:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<ETvYbBBGvuI+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.14
country_id: 3703430
description:
2025-12-16 17:28:06 dovecot_login authenticator failed for (ADMIN) [91.90.126.14]:46386: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-16 17:28:56 dovecot_plain authenticator failed for (gragy) [154.144.243.93]:49910: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.35
country_id: 2542007
description:
Dec 16 17:31:18 host2 sshd[1091713]: Disconnected from invalid user nico 81.192.46.35 port 45542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-16 17:31:25 dovecot_plain authenticator failed for (faissofria) [102.53.15.18]:54404: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 16 17:31:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<3XOlfBBGALQ+PIds>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.192.46.35
country_id: 2542007
description:
Dec 16 17:32:48 host2 sshd[1092522]: Disconnected from invalid user xjy 81.192.46.35 port 48556 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-16 17:32:31 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (suasal) [174.58.87.108]:35158: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.30.117.80
country_id: 3469034
description:
Dec 16 17:34:55 host2 sshd[1093955]: Disconnected from invalid user ash 189.30.117.80 port 35544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.228.68.232
country_id: 3865483
description:
Dec 16 17:36:46 host2 sshd[1095436]: Disconnected from invalid user iqbal 181.228.68.232 port 36378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.35
country_id: 2542007
description:
Dec 16 17:36:44 host2 sshd[1095403]: Disconnected from invalid user www 81.192.46.35 port 33900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Dec 16 17:38:04 host2 sshd[1096096]: Disconnected from invalid user vncuser 103.49.239.184 port 44392 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.228.68.232
country_id: 3865483
description:
Dec 16 17:37:31 host2 sshd[1095776]: Disconnected from invalid user xjy 181.228.68.232 port 48522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.146.72
country_id: 1643084
description:
Dec 16 17:37:37 host2 sshd[1095830]: Disconnected from invalid user user9 103.187.146.72 port 53634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Dec 16 17:38:55 host2 sshd[1096607]: Disconnected from invalid user adrian 103.49.239.184 port 36766 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.187.146.72
country_id: 1643084
description:
Dec 16 17:38:58 host2 sshd[1096632]: Disconnected from invalid user maxim 103.187.146.72 port 39110 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.30.27
country_id: 798544
description:
Dec 16 17:39:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=178.216.30.27, lip=66.85.158.91, TLS, session=<jYVKlxBGXdSy2B4b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.30.117.80
country_id: 3469034
description:
Dec 16 17:38:18 host2 sshd[1096314]: Disconnected from invalid user vishal 189.30.117.80 port 50196 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.60.192.121
country_id: 2963597
description:
Dec 16 17:38:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=92.60.192.121, lip=66.85.158.91, TLS, session=<Ntg5lhBG379cPMB5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-16 17:40:01 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (delcars) [24.1.200.187]:36476: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Dec 16 17:39:44 host2 sshd[1097063]: Disconnected from invalid user user1 103.49.239.184 port 57678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.228.68.232
country_id: 3865483
description:
Dec 16 17:43:07 host2 sshd[1099009]: Disconnected from invalid user student 181.228.68.232 port 60930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.228.68.232
country_id: 3865483
description:
Dec 16 17:43:50 host2 sshd[1099494]: Disconnected from invalid user nico 181.228.68.232 port 44834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 17:44:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<KNunqhBG5Ic+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 17:45:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<nvo1rRBG7qM+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 16 17:47:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<1kDOtRBGNJQ+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-16 17:48:22 dovecot_plain authenticator failed for (basiass) [65.20.133.208]:46164: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-16 17:48:25 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (calogalne) [71.235.225.181]:53178: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 17:49:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<huzDvBBGjuk+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.134.63.224
country_id: 2921044
description:
2025-12-16 17:51:46 dovecot_login authenticator failed for (ADMIN) [95.134.63.224]:36337: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-16 17:52:03 dovecot_plain authenticator failed for (tudorine) [154.144.243.93]:53136: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 17:51:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<WH+HxBBGHLE+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 17:58:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<VZD13RBGPoc+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-16 18:00:11 dovecot_login authenticator failed for ([5.76.44.40]) [5.76.44.40]:39736: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-12-16 18:00:53 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:48422: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-16 18:01:15 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:38306: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.128.108
country_id: 6252001
description:
Dec 16 18:03:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.249.128.108, lip=66.85.158.92, session=<06H/8BBGxNpK+YBs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-16 18:05:15 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (claccously) [71.62.34.216]:41770: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.165
country_id: 6252001
description:
2025-12-16 18:05:54 dovecot_login authenticator failed for (ADMIN) [191.96.37.165]:41567: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-16 18:07:01 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (poeusubia) [73.224.171.101]:47222: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.8.243
country_id: 6252001
description:
Dec 16 18:10:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.168.8.243, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Die6BxFGDqoUqAjz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 18:10:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<lyzlBxFGVtM+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-16 18:12:34 dovecot_plain authenticator failed for (cring) [102.53.15.17]:33711: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 18:15:23 host2 sshd[1120270]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-16 18:16:22 dovecot_plain authenticator failed for (canostacad) [80.227.102.242]:33785: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.38.35.154
country_id: 6252001
description:
Dec 16 18:16:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.38.35.154, lip=66.85.158.91, TLS handshaking: Connection closed, session=</mHEHhFGpOUUJiOa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 16 18:18:52 host2 sshd[1121966]: Disconnected from invalid user aman 34.39.58.191 port 44542 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 16 18:19:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS handshaking: Connection closed, session=<32ztJhFG7vFChJmL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.35
country_id: 2963597
description:
2025-12-16 18:19:50 dovecot_login authenticator failed for (ADMIN) [155.2.194.35]:40605: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.86.122
country_id: 1269750
description:
Dec 16 18:21:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=139.59.86.122, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<xv8CMBFGcoaLO1Z6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 16 18:23:56 host2 sshd[1124908]: Disconnected from invalid user wangke 34.39.58.191 port 37126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:24:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DlSPORFGcrkDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-12-16 18:24:23 dovecot_plain authenticator failed for (forphy) [88.149.153.106]:56742: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 16 18:24:25 host2 sshd[1125298]: Disconnected from invalid user admin1 34.39.58.191 port 54938 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:24:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5FnPOhFGEM4DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-16 18:24:55 dovecot_plain authenticator failed for (unaste) [65.20.149.93]:39125: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-16 18:24:58 dovecot_plain authenticator failed for (buddet) [96.85.104.2]:56390: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 16 18:25:31 host2 sshd[1125992]: Disconnected from invalid user teste 181.116.220.11 port 57990 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:25:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<59pSPhFGZIwDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-16 18:25:57 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60836: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.247
country_id: 3469034
description:
2025-12-16 18:27:11 dovecot_login authenticator failed for (ADMIN) [188.241.177.247]:50759: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.39.58.191
country_id: 2635167
description:
Dec 16 18:26:22 host2 sshd[1126438]: Disconnected from invalid user william 34.39.58.191 port 42618 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:27:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<fqVBRhFG0p0DiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 16 18:28:46 host2 sshd[1127620]: Disconnected from invalid user sri 137.184.30.179 port 59976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 18:29:45 host2 sshd[1128361]: Disconnected from invalid user asha 62.60.131.157 port 10925 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:29:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<eDdxTRFGlucDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 16 18:30:59 host2 sshd[1129569]: Disconnected from invalid user pelias 181.116.220.11 port 37139 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 16 18:31:09 host2 sshd[1129694]: Disconnected from invalid user newusername 137.184.30.179 port 33624 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:30:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vAn5UBFGjoYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 18:30:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Z8vbUBFGpIM+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 16 18:31:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<wEd+UxFGeprBHmEh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:32:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<33iDVhFGrOEDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.78
country_id: 6252001
description:
Dec 16 18:32:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.125.78, lip=66.85.158.91, session=<9tiXVxFGwsaH7X1O>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-16 18:32:40 dovecot_plain authenticator failed for (enreakeede) [176.113.155.132]:42728: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.30.179
country_id: 6252001
description:
Dec 16 18:33:50 host2 sshd[1131148]: Disconnected from invalid user amin 137.184.30.179 port 35480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Dec 16 18:34:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.91, session=<YhViXRFGyv7CpRCl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:34:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<mpdKXRFGmOADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 16 18:34:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<tmsLXhFGpsoDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 16 18:36:12 host2 sshd[1132954]: Disconnected from invalid user max 181.116.220.11 port 39350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 16 18:36:18 host2 sshd[1133017]: Disconnected from invalid user rustserver 51.195.138.37 port 57742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 16 18:37:23 host2 sshd[1133534]: Disconnected from invalid user test1 51.195.138.37 port 44460 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-16 18:37:38 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (eatic) [72.241.202.216]:45201: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.195.138.37
country_id: 3017382
description:
Dec 16 18:37:54 host2 sshd[1133886]: Disconnected from invalid user odoo 51.195.138.37 port 59166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.102.85.71
country_id: 390903
description:
2025-12-16 18:39:14 dovecot_plain authenticator failed for (unfult) [147.102.85.71]:33269: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-12-16 18:38:18 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (press) [73.213.237.28]:52620: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.34
country_id: 3017382
description:
2025-12-16 18:42:11 dovecot_login authenticator failed for (ADMIN) [191.101.31.34]:52004: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 18:45:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<h9figxFGhMo+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 18:45:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ysNWhBFGhNY+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.143
country_id: 3865483
description:
Dec 16 18:45:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=190.181.109.143, lip=66.85.158.91, TLS, session=<P4Y2hRFG9o6+tW2P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.159.184.166
country_id: 798544
description:
Dec 16 18:45:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=93.159.184.166, lip=66.85.158.91, TLS, session=<DCdbhhFG969dn7im>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 16 18:46:05 host2 sshd[1139494]: Disconnected from invalid user svn 198.12.85.136 port 40764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.173.10
country_id: 2635167
description:
2025-12-16 18:45:27 dovecot_login authenticator failed for (ADMIN) [45.133.173.10]:41873: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 16 18:45:33 host2 sshd[1138786]: Disconnected from invalid user ftpuser1 198.12.85.136 port 37440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 16 18:47:11 host2 sshd[1140142]: Disconnected from invalid user li 198.12.85.136 port 46086 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 18:47:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<7bbcjRFGNqs+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.85.136
country_id: 6252001
description:
Dec 16 18:48:15 host2 sshd[1140742]: Disconnected from invalid user test_user 198.12.85.136 port 49106 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 18:49:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=</2VdkxFGqr0+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.57.123
country_id: 3996063
description:
2025-12-16 18:50:12 dovecot_plain authenticator failed for (gamity) [201.173.57.123]:35632: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 18:51:42 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (cowly) [87.103.126.54]:48542: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 18:55:51 host2 sshd[1145437]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.164.119
country_id: 2661886
description:
2025-12-16 18:55:56 dovecot_plain authenticator failed for 79.138.164.119.mobile.tre.se (chrootoce) [79.138.164.119]:60766: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.238
country_id: 192950
description:
Dec 16 18:56:24 host2 sshd[1145705]: Disconnected from invalid user ftpuser 102.220.23.238 port 37948 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.220.23.238
country_id: 192950
description:
Dec 16 18:57:08 host2 sshd[1146200]: Disconnected from invalid user backend 102.220.23.238 port 52068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.27.187
country_id: 3996063
description:
Dec 16 18:58:25 host2 sshd[1147233]: Disconnected from invalid user User 187.212.27.187 port 49430 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.220.23.238
country_id: 192950
description:
Dec 16 18:59:20 host2 sshd[1147916]: Disconnected from invalid user deployer 102.220.23.238 port 37960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.210
country_id: 6252001
description:
2025-12-16 19:00:23 dovecot_login authenticator failed for (ADMIN) [181.215.182.210]:64699: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.212.27.187
country_id: 3996063
description:
Dec 16 19:01:53 host2 sshd[1150082]: Disconnected from invalid user vncuser 187.212.27.187 port 60774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.128.167.105
country_id: 2635167
description:
Dec 16 19:01:59 host2 sshd[1150155]: Disconnected from invalid user appadmin 178.128.167.105 port 34894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.27.187
country_id: 3996063
description:
Dec 16 19:02:59 host2 sshd[1150970]: Disconnected from invalid user alpha 187.212.27.187 port 54378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.6.61.189
country_id: 6252001
description:
2025-12-16 19:04:11 dovecot_plain authenticator failed for 99-6-61-189.lightspeed.livnmi.sbcglobal.net (bourism) [99.6.61.189]:56726: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 16 19:05:32 host2 sshd[1153685]: Disconnected from invalid user user 2.57.121.25 port 47732 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2025-12-16 19:06:23 dovecot_plain authenticator failed for (sinder) [88.149.153.106]:57062: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 19:07:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<CodI0xFGGLY+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-16 19:07:59 dovecot_plain authenticator failed for (extagent) [105.72.176.66]:41620: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-16 19:09:11 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (gyine) [68.82.141.145]:56812: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 16 19:10:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<u0yf3RFGlpk+PIcq>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.167.105
country_id: 2635167
description:
Dec 16 19:09:54 host2 sshd[1156520]: Disconnected from invalid user user3 178.128.167.105 port 35460 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 19:14:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<P9KG7RFGqt4+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.73
country_id: 6252001
description:
Dec 16 19:15:20 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.208.73, lip=66.85.158.92, session=<mbZL8BFGbM2YINBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.18
country_id: 798549
description:
Dec 16 19:17:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=212.73.148.18, lip=66.85.158.91, TLS: Connection closed, session=<vXKD9xFGnJDUSZQS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.16
country_id: 798549
description:
Dec 16 19:19:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.16, lip=66.85.158.91, TLS: Connection closed, session=<JY2JABJGBuVV2ZUQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.172.131
country_id: 2658434
description:
Dec 16 19:20:51 host2 pure-ftpd[1163620]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.172.131
country_id: 2658434
description:
Dec 16 19:20:55 host2 pure-ftpd[1163696]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.11
country_id: 146669
description:
2025-12-16 19:21:55 dovecot_login authenticator failed for (ADMIN) [185.253.162.11]:39544: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-16 19:22:56 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (totridgric) [66.177.30.53]:48982: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Dec 16 19:23:19 host2 sshd[1165334]: Disconnected from invalid user ubuntu 101.47.135.95 port 39576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 16 19:23:32 host2 sshd[1165460]: Disconnected from invalid user manuel 154.124.97.102 port 34493 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Dec 16 19:25:00 host2 sshd[1166283]: Disconnected from invalid user odoo 103.172.112.192 port 50578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 16 19:25:34 host2 sshd[1166854]: Disconnected from invalid user yskim 165.227.3.79 port 41744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 19:26:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<aqpiFxJG0tQ+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.17.45.24
country_id: 6252001
description:
2025-12-16 19:26:19 dovecot_login authenticator failed for (ADMIN) [84.17.45.24]:49568: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-16 19:26:53 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:50142: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.247.158.242
country_id: 2510769
description:
Dec 16 19:27:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@v-deploy.com>, method=PLAIN, rip=188.247.158.242, lip=66.85.158.91, TLS, session=<B1iFGRJGMu28957y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.16
country_id: 3175395
description:
Dec 16 19:27:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.208.106.16, lip=66.85.158.91, TLS, session=</aKcGhJGucu50GoQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.181.149
country_id: 130758
description:
Dec 16 19:27:26 host2 sshd[1167847]: Invalid user Can't open edapass from 185.208.181.149 port 39488


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.205.8
country_id: 1269750
description:
2025-12-16 19:27:19 dovecot_login authenticator failed for ([103.250.160.76]) [59.96.205.8]:40852: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 16 19:27:19 host2 sshd[1167771]: Disconnected from invalid user ncc 165.227.3.79 port 59978 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.67.161.175
country_id: 6252001
description:
Dec 16 19:28:22 host2 pure-ftpd[1168384]: (?@40.67.161.175) [INFO] New connection from 40.67.161.175


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Dec 16 19:28:50 host2 sshd[1168672]: Disconnected from invalid user lfs 165.227.3.79 port 49953 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 19:28:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<C8uXIBJGCJM+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 16 19:29:44 host2 sshd[1169334]: Disconnected from invalid user yusuf 154.124.97.102 port 36531 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.113.246.124
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 189.113.246.124 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.156.188.7
country_id: 3439705
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 152.156.188.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.185.224.48
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.185.224.48 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.161.178.23
country_id: 290291
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.161.178.23 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 19:30:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<8+nbJBJGJNY+PIdj>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.97.109.70
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 138.97.109.70 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.83.132.147
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 170.83.132.147 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.79.49.84
country_id: 6290252
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.79.49.84 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.205.151.134
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 112.205.151.134 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Dec 16 19:32:11 host2 sshd[1171050]: Disconnected from invalid user testuser 103.172.112.192 port 57904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 19:31:41 host2 sshd[1170704]: Disconnected from invalid user dayana 62.60.131.157 port 61036 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.179.252.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 71.179.252.16 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.135.36.145
country_id: 3439705
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.135.36.145 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.83.43.98
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 170.83.43.98 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.4.216.8
country_id: 3895114
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.4.216.8 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.33.39.100
country_id: 690791
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 46.33.39.100 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.129.44.216
country_id: 953987
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 102.129.44.216 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 16 19:33:16 host2 sshd[1171926]: Disconnected from invalid user aa 154.124.97.102 port 50889 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Dec 16 19:34:29 host2 sshd[1172635]: Disconnected from invalid user artin 103.172.112.192 port 58124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.124.97.102
country_id: 2245662
description:
Dec 16 19:35:30 host2 sshd[1173468]: Disconnected from invalid user manager 154.124.97.102 port 53777 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 19:35:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Qti2ORJGfqs+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.117
country_id: 6252001
description:
2025-12-16 19:37:41 dovecot_login authenticator failed for (ADMIN) [102.129.252.117]:44998: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 19:38:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<U5a5QRJGDNE+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-16 19:39:27 dovecot_plain authenticator failed for syn-074-218-095-154.biz.spectrum.com (misacism) [74.218.95.154]:48560: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.125.78
country_id: 6252001
description:
Dec 16 19:39:54 host2 pure-ftpd[1176525]: (?@135.237.125.78) [INFO] New connection from 135.237.125.78


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-16 19:43:03 dovecot_plain authenticator failed for (thosin) [65.20.250.163]:42642: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.73
country_id: 6252001
description:
Dec 16 19:45:16 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.208.73, lip=66.85.158.91, session=<IgZeWxJGjtuYINBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.208.73
country_id: 6252001
description:
Dec 16 19:45:34 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.208.73, lip=66.85.158.91, session=<f6Z3XBJGKOGYINBJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.197
country_id: 6252001
description:
Dec 16 19:45:51 host2 pure-ftpd[1181868]: (?@91.230.168.197) [INFO] New connection from 91.230.168.197


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.196
country_id: 6252001
description:
Dec 16 19:45:51 host2 pure-ftpd[1181872]: (?@91.230.168.196) [INFO] New connection from 91.230.168.196


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 19:46:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<uPbnXhJGvuA+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 19:48:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<oVaJZhJG4Jg+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-16 19:49:33 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:48389: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-16 19:49:51 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:53964: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 19:50:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<h6WObBJGytY+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.227.10
country_id: 6252001
description:
2025-12-16 19:50:53 dovecot_login authenticator failed for (ADMIN) [191.96.227.10]:41542: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.232.237
country_id: 6252001
description:
2025-12-16 19:52:13 dovecot_login authenticator failed for (ADMIN) [102.129.232.237]:49310: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 19:51:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<LF7gchJGJJI+PIde>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 16 19:54:49 host2 pure-ftpd[1193712]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.221.78
country_id: 1880251
description:
Dec 16 19:55:00 host2 sshd[1193881]: Disconnected from invalid user foundry 45.78.221.78 port 53228 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.78
country_id: 1880251
description:
Dec 16 19:56:09 host2 sshd[1196222]: Disconnected from invalid user gitlab-runner 45.78.221.78 port 40914 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 19:58:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<cgQsiRJGANQ+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 20:00:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<fZsNkhJGNJI+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2025-12-16 20:01:46 dovecot_plain authenticator failed for c-98-196-209-55.hsd1.tx.comcast.net (posculs) [98.196.209.55]:36702: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 20:05:54 host2 sshd[1204972]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 20:08:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<q//BrRJG+JI+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 20:08:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<mhjFrhJGkpo+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 20:09:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<n8tvsBJGiMc+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-16 20:10:38 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:53231: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.139.77
country_id: 3144096
description:
2025-12-16 20:10:55 dovecot_login authenticator failed for ([188.124.139.77]) [188.124.139.77]:37068: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-16 20:11:33 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (nahorl) [50.74.136.134]:50734: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.32.159
country_id: 3469034
description:
Dec 16 20:11:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.39.32.159, lip=66.85.158.91, TLS, session=<DLTVuRJGF5+xJyCf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.17
country_id: 3865483
description:
Dec 16 20:12:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=179.0.251.17, lip=66.85.158.91, TLS, session=<zVkJuxJGJo6zAPsR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Dec 16 20:13:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.56, lip=66.85.158.92, TLS: Connection closed, session=<acYzwRJGns2nXpI4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-16 20:14:58 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (acopercy) [73.183.74.177]:50832: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 16 20:19:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=</OB+1BJGxOY+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 16 20:20:56 host2 sshd[1215237]: Disconnected from invalid user exploit 101.36.117.148 port 52510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.35
country_id: 3625428
description:
2025-12-16 20:20:51 dovecot_login authenticator failed for (ADMIN) [95.181.237.35]:49934: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec 16 20:22:32 host2 sshd[1216404]: Disconnected from invalid user user 193.106.245.20 port 49303 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.44
country_id: 953987
description:
2025-12-16 20:22:50 dovecot_login authenticator failed for (ADMIN) [154.47.30.44]:6438: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 16 20:22:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<H2BA4RJGpoE+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.188.156
country_id: 99237
description:
2025-12-16 20:23:58 dovecot_plain authenticator failed for (lactic) [65.20.188.156]:54694: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-16 20:24:00 dovecot_plain authenticator failed for (piesopily) [92.62.243.174]:56810: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.106.245.20
country_id: 798544
description:
Dec 16 20:24:23 host2 sshd[1217440]: Disconnected from invalid user ubuntu 193.106.245.20 port 39949 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 20:24:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<Sjvx5xJGRNA+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.181
country_id: 3017382
description:
Dec 16 20:24:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.181, lip=66.85.158.92, session=<FEV36BJGjbZb51m1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.178
country_id: 3017382
description:
Dec 16 20:24:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.178, lip=66.85.158.92, session=<BXQU6RJGneVb51my>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec 16 20:24:59 host2 sshd[1217704]: Disconnected from invalid user applmgr 193.106.245.20 port 40009 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.179
country_id: 3017382
description:
Dec 16 20:25:05 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.179, lip=66.85.158.92, session=<pPG86RJG94Jb51mz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.62
country_id: 3017382
description:
Dec 16 20:25:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.62, lip=66.85.158.92, session=<63jv6RJGUcdb51k+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 16 20:26:43 host2 sshd[1218906]: Disconnected from invalid user applmgr 103.123.53.88 port 36652 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-16 20:26:48 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:54829: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-16 20:27:04 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:33296: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 20:27:06 host2 sshd[1219140]: Disconnected from invalid user nikita 62.60.131.157 port 43281 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.135
country_id: 6252001
description:
Dec 16 20:27:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.135, lip=66.85.158.91, TLS: Connection closed, session=<N7vp8RJGTNTHLZqH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec 16 20:28:14 host2 sshd[1219866]: Disconnected from invalid user imran 193.106.245.20 port 43249 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 16 20:28:24 host2 sshd[1219983]: Disconnected from invalid user alex 101.36.117.148 port 40114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-16 20:28:50 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (dammuloss) [73.145.107.251]:59226: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.117.148
country_id: 1819730
description:
Dec 16 20:29:36 host2 sshd[1221061]: Disconnected from invalid user vikas 101.36.117.148 port 32838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 20:30:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ateolly) [87.103.126.54]:36690: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 16 20:30:25 host2 sshd[1221731]: Disconnected from invalid user acs 103.123.53.88 port 55422 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 20:30:46 host2 sshd[1221940]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 16 20:31:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<r//+/hJGMLI+PIdn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.64.68.99
country_id: 1643084
description:
Dec 16 20:31:44 host2 sshd[1222629]: Disconnected from invalid user admin 36.64.68.99 port 58280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 16 20:31:48 host2 sshd[1222654]: Disconnected from invalid user ftpuser 202.157.176.165 port 51142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 20:33:30 host2 sshd[1223650]: Disconnected from invalid user nikita 62.60.131.157 port 52941 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 16 20:33:50 host2 sshd[1223844]: Disconnected from invalid user admin 202.157.176.165 port 38350 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 20:34:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<jdu3ChNGpI4+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 20:35:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<FQznDhNGAus+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 16 20:35:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<p/uCDxNGJuU+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.174
country_id: 6252001
description:
2025-12-16 20:37:39 dovecot_login authenticator failed for (ADMIN) [181.41.206.174]:29997: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Dec 16 20:37:41 host2 sshd[1226528]: Disconnected from invalid user david 202.157.176.165 port 40516 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-16 20:38:12 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (preave) [37.150.8.174]:36571: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-16 20:38:17 dovecot_plain authenticator failed for (aphas) [5.31.15.108]:57657: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 20:40:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<zvgpIRNGaKU+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-12-16 20:39:40 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:38460: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.5.133
country_id: 2077456
description:
2025-12-16 20:40:05 dovecot_login authenticator failed for ([101.168.5.133]) [101.168.5.133]:52876: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec 16 20:40:14 host2 sshd[1228257]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 51515


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.41.217.74
country_id: 6252001
description:
Dec 16 20:42:24 host2 sshd[1229566]: Disconnected from invalid user web 34.41.217.74 port 39344 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.78.89.26
country_id: 298795
description:
Dec 16 20:43:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=94.78.89.26, lip=66.85.158.91, TLS, session=<z7nvKhNGkIleTlka>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 16 20:42:43 host2 sshd[1229731]: Disconnected from invalid user user1 103.153.190.105 port 56834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.41.217.74
country_id: 6252001
description:
Dec 16 20:43:51 host2 sshd[1230511]: Disconnected from invalid user geo 34.41.217.74 port 46144 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.15.88
country_id: 798544
description:
Dec 16 20:43:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=89.186.15.88, lip=66.85.158.91, TLS, session=<0OkELBNGn9ZZug9Y>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 167.172.203.52
country_id: 6252001
description:
Dec 16 20:44:39 host2 sshd[1231003]: Received disconnect from 167.172.203.52 port 34586:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 20:45:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<V85cMRNGkog+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-12-16 20:45:16 dovecot_login authenticator failed for ([61.2.44.54]) [61.2.44.54]:42336: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 20:46:07 host2 sshd[1232896]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 16 20:46:18 host2 pure-ftpd[1233054]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.172.203.52
country_id: 6252001
description:
Dec 16 20:46:49 host2 sshd[1233382]: Disconnected from invalid user user1 167.172.203.52 port 35968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-16 20:49:09 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:33468: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.138
country_id: 1269750
description:
2025-12-16 20:49:28 dovecot_login authenticator failed for ([125.19.174.244]) [128.185.201.138]:32968: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-16 20:50:46 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (jingeate) [73.144.27.228]:56564: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 20:52:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<DSRISxNGxqU+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 16 20:52:25 host2 sshd[1239031]: Disconnected from invalid user develop 103.153.190.105 port 60586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.151
country_id: 798549
description:
2025-12-16 20:52:30 dovecot_login authenticator failed for (ADMIN) [91.90.120.151]:37318: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.65.175
country_id: 6252001
description:
Dec 16 20:53:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.65.175, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<3JsITxNG9ucv+0Gv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.190.105
country_id: 1643084
description:
Dec 16 20:53:51 host2 sshd[1240262]: Disconnected from invalid user ubuntu 103.153.190.105 port 43336 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Dec 16 20:53:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<EK7TUBNGEqMv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.65.175
country_id: 6252001
description:
Dec 16 20:53:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=47.251.65.175, lip=66.85.158.91, TLS, session=<M8jSUBNGAOgv+0Gv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.134.63.219
country_id: 2921044
description:
2025-12-16 20:54:05 dovecot_login authenticator failed for (ADMIN) [95.134.63.219]:60579: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 20:56:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<bGJ6WBNGLNA+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 20:56:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<cRe/WxNGbog+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.67.39
country_id: 3996063
description:
2025-12-16 20:57:29 dovecot_login authenticator failed for ([201.160.67.39]) [201.160.67.39]:48522: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-16 20:57:49 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:58188: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.181.152
country_id: 130758
description:
Dec 16 21:00:23 host2 sshd[1245288]: Invalid user Can't open edapass from 185.208.181.152 port 42054


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 21:00:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<SFnxaRNGwpQ+PIcs>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec 16 21:01:12 host2 pure-ftpd[1246046]: (?@66.132.153.138) [INFO] New connection from 66.132.153.138


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.109
country_id: 6252001
description:
Dec 16 21:00:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.150.109, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<CRf7aBNGg8ai2JZt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.109
country_id: 6252001
description:
Dec 16 21:01:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.109, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<PzvLbBNGwOCi2JZt>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.158.166
country_id: 6252001
description:
Dec 16 21:01:58 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.158.166, lip=66.85.158.92, TLS, session=<PHirbRNGqM5HBp6m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.158.166
country_id: 6252001
description:
Dec 16 21:01:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.158.166, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<QMSsbRNG/M5HBp6m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.109.18
country_id: 6252001
description:
Dec 16 21:03:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=45.33.109.18, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<ZjthcxNGUpktIW0S>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 16 21:03:51 host2 sshd[1247888]: Disconnected from invalid user yassine 202.165.22.246 port 39176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 16 21:05:16 host2 sshd[1248766]: Disconnected from invalid user control 202.165.22.246 port 39074 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-16 21:04:45 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (safraniher) [24.91.103.202]:38944: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-16 21:04:52 dovecot_plain authenticator failed for (oversalian) [80.227.102.242]:40620: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.23.196
country_id: 3996063
description:
Dec 16 21:06:22 host2 sshd[1249392]: Disconnected from invalid user andy 201.124.23.196 port 39227 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.22.246
country_id: 1733045
description:
Dec 16 21:06:43 host2 sshd[1249536]: Disconnected from invalid user ubuntu 202.165.22.246 port 38972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 16 21:07:51 host2 sshd[1250043]: Disconnected from invalid user ubuntu 102.88.137.213 port 33775 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.13
country_id: 3042058
description:
2025-12-16 21:09:28 dovecot_login authenticator failed for (ADMIN) [91.90.122.13]:5755: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-16 21:09:03 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (juntomel) [144.64.157.244]:45862: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.109
country_id: 6252001
description:
Dec 16 21:09:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.109, lip=66.85.158.91, TLS, session=<zukZiBNGcOKi2JZt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.109
country_id: 6252001
description:
Dec 16 21:09:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.109, lip=66.85.158.91, TLS, session=<wc/liRNGKuqi2JZt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.124.23.196
country_id: 3996063
description:
Dec 16 21:10:28 host2 sshd[1252258]: Disconnected from invalid user erpnext 201.124.23.196 port 52348 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.171
country_id: 3469034
description:
Dec 16 21:10:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=177.44.96.171, lip=66.85.158.91, TLS, session=<IDJPixNGpcuxLGCr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.78.89.45
country_id: 298795
description:
Dec 16 21:10:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<designdpt>, method=PLAIN, rip=94.78.89.45, lip=66.85.158.91, TLS, session=<eKWXjBNGsuBeTlkt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-16 21:11:00 dovecot_login authenticator failed for (nsg-corporate-161.229.186.122.airtel.in) [182.79.86.102]:34018: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 16 21:12:28 host2 sshd[1253258]: Disconnected from invalid user superset 102.88.137.213 port 1439 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 16 21:12:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<KBdQkxNGmibUZija>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 16 21:11:43 host2 sshd[1252877]: Disconnected from invalid user me 102.88.137.213 port 1111 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-12-16 21:11:45 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:50093: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-16 21:12:52 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (orist) [174.169.224.27]:52290: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.255.38.183
country_id: 6252001
description:
Dec 16 21:13:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=38.255.38.183, lip=66.85.158.91, session=<CMy1lRNGuMUm/ya3>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.10
country_id: 798549
description:
Dec 16 21:14:31 host2 pure-ftpd[1254509]: (?@85.217.140.10) [INFO] New connection from 85.217.140.10


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.13
country_id: 798549
description:
Dec 16 21:14:04 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=85.217.140.13, lip=66.85.158.92, TLS, session=<GML0mBNGdq9V2YwN>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.140.10
country_id: 798549
description:
Dec 16 21:14:53 host2 pure-ftpd[1254690]: (?@85.217.140.10) [INFO] New connection from 85.217.140.10


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.140.10
country_id: 798549
description:
Dec 16 21:14:58 host2 pure-ftpd[1254746]: (?@85.217.140.10) [INFO] New connection from 85.217.140.10


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.190
country_id: 6252001
description:
Dec 16 21:15:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.190, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<w9FVnBNG5MSTuYW+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.190
country_id: 6252001
description:
Dec 16 21:15:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.133.190, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<p0fVnhNGPPWTuYW+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.235.40.131
country_id: 6252001
description:
Dec 16 21:17:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.235.40.131, lip=66.85.158.92, TLS, session=<JvMIpRNGLF2s6yiD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.218
country_id: 294640
description:
2025-12-16 21:21:01 dovecot_login authenticator failed for (ADMIN) [149.88.26.218]:36418: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-16 21:22:15 dovecot_login authenticator failed for (nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:51990: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.190
country_id: 6252001
description:
Dec 16 21:22:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.190, lip=66.85.158.92, TLS, session=<0aaJthNGnuCTuYW+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-16 21:22:35 dovecot_login authenticator failed for ([49.0.40.238]) [49.0.40.238]:59770: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.240.192.138
country_id: 6252001
description:
Dec 16 21:22:56 host2 pure-ftpd[1259722]: (?@66.240.192.138) [INFO] New connection from 66.240.192.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-16 21:23:33 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (boldne) [73.145.107.251]:33620: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.240.192.138
country_id: 6252001
description:
Dec 16 21:22:48 host2 pure-ftpd[1259653]: (?@66.240.192.138) [INFO] New connection from 66.240.192.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.217
country_id: 798549
description:
2025-12-16 21:23:51 dovecot_login authenticator failed for (ADMIN) [91.90.120.217]:59831: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:24:11 host2 sshd[1260374]: Disconnected from invalid user vlad 154.57.216.142 port 27822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 16 21:24:18 host2 sshd[1260427]: Disconnected from invalid user peertube 201.76.120.30 port 55906 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.81.146.106
country_id: 3469034
description:
2025-12-16 21:24:33 dovecot_plain authenticator failed for ([31.57.166.48]) [177.81.146.106]:60956: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-16 21:25:25 dovecot_login authenticator failed for ([125.19.173.163]) [182.95.181.62]:47314: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.175.30.38
country_id: 3144096
description:
2025-12-16 21:24:44 dovecot_plain authenticator failed for 38.51-175-30.customer.lyse.net ([31.57.166.48]) [51.175.30.38]:56998: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-16 21:24:54 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (gratint) [81.225.30.107]:33260: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-12-16 21:25:09 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:52180: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2025-12-16 21:25:47 dovecot_login authenticator failed for ([59.145.84.169]) [182.95.176.122]:58758: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.219
country_id: 1643084
description:
Dec 16 21:25:49 host2 sshd[1261551]: Disconnected from invalid user hadoop 103.172.204.219 port 56280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.91
country_id: 3996063
description:
2025-12-16 21:26:20 dovecot_login authenticator failed for (201.173.250.91-clientes-izzi.mx) [201.173.250.91]:55672: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:26:39 host2 sshd[1261933]: Disconnected from invalid user angel 154.57.216.142 port 62260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.219
country_id: 1643084
description:
Dec 16 21:26:43 host2 sshd[1261949]: Disconnected from invalid user ljh 103.172.204.219 port 42424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 16 21:28:28 host2 sshd[1263134]: Disconnected from invalid user ruan 201.76.120.30 port 44478 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-16 21:27:56 dovecot_plain authenticator failed for (whannia) [80.227.102.242]:37624: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-12-16 21:28:10 dovecot_login authenticator failed for ([180.94.75.114]) [180.94.75.114]:54740: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-16 21:28:40 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:48485: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-16 21:28:46 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (inapezine) [68.52.119.193]:42922: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.219
country_id: 1643084
description:
Dec 16 21:28:53 host2 sshd[1263413]: Disconnected from invalid user admin 103.172.204.219 port 48914 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 21:29:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<WZd20BNGkIQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.72.184.111
country_id: 6252001
description:
2025-12-16 21:30:17 dovecot_plain authenticator failed for ([31.57.166.48]) [73.72.184.111]:55680: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.115.135.128
country_id: 3895114
description:
2025-12-16 21:30:29 dovecot_plain authenticator failed for ([31.57.166.48]) [191.115.135.128]:40472: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 16 21:29:47 host2 sshd[1263996]: Disconnected from invalid user test10 201.76.120.30 port 40656 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.68.107.91
country_id: 1168579
description:
Dec 16 21:30:04 host2 sshd[1264250]: Disconnected from invalid user kube 111.68.107.91 port 59168 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.122.127.91
country_id: 690791
description:
2025-12-16 21:30:40 dovecot_plain authenticator failed for ([31.57.166.48]) [176.122.127.91]:54760: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec 16 21:31:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7SSW1xNGtgm4affC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.194
country_id: 6252001
description:
Dec 16 21:31:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.194, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TuCu2BNGpMi4affC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 21:31:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<k1bd2BNGsqo+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 16 21:33:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<allG3hNG2Jc+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:35:18 host2 sshd[1268229]: Disconnected from invalid user user 154.57.216.142 port 25967 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:36:05 host2 sshd[1268759]: Disconnected from invalid user carlos 154.57.216.142 port 58245 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:41:03 host2 sshd[1272344]: Disconnected from invalid user app 154.57.216.142 port 62916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 21:41:05 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (lilic) [87.103.126.54]:43395: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 21:41:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<OaMt+xNGroA+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.25
country_id: 146669
description:
2025-12-16 21:41:48 dovecot_login authenticator failed for (ADMIN) [185.253.162.25]:40445: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:41:50 host2 sshd[1272831]: Disconnected from invalid user app 154.57.216.142 port 46010 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 21:43:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<+VQoARRGxo0+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 21:43:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<9o7QAhRGvKs+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.142
country_id: 1694008
description:
2025-12-16 21:43:58 dovecot_login authenticator failed for (ADMIN) [188.214.125.142]:47318: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.57.216.142
country_id: 1168579
description:
Dec 16 21:44:11 host2 sshd[1274102]: Disconnected from invalid user aryan 154.57.216.142 port 54526 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 21:44:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<Cfx1BhRGVLo+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 21:46:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<uZ2mDRRGRq4+PIcf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 16 21:48:48 host2 pure-ftpd[1276846]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 16 21:50:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<DneeGhRGOp4+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 21:54:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Dy0+KBRGPts+PIcd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 21:56:09 host2 sshd[1282339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.124
country_id: 6252001
description:
Dec 16 21:56:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.124, lip=66.85.158.92, session=<NTMWMRRGuU1APpx8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Dec 16 21:56:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS: Connection closed, session=<0+rSMRRGbFJAPpx6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.47
country_id: 3175395
description:
Dec 16 21:57:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=217.26.178.47, lip=66.85.158.91, TLS, session=<msb7MhRGgafZGrIv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.183.92.238
country_id: 3469034
description:
Dec 16 21:57:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=45.183.92.238, lip=66.85.158.91, TLS, session=<pF8HMxRG1p0tt1zu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.56.46
country_id: 1269750
description:
Dec 16 21:57:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=103.237.56.46, lip=66.85.158.91, TLS, session=<EOIQMxRGv7hn7Tgu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.12
country_id: 3469034
description:
Dec 16 21:57:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=177.44.71.12, lip=66.85.158.91, TLS, session=<V68OMxRGU9mxLEcM>


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 5.187.97.40
country_id: 3579143
description:
Dec 16 21:58:06 host2 sshd[1284028]: Disconnecting authenticating user root 5.187.97.40 port 46891: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.187.97.40
country_id: 3579143
description:
Dec 16 21:58:13 host2 sshd[1284143]: Disconnecting invalid user admin 5.187.97.40 port 47519: Too many authentication failures [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.50
country_id: 798544
description:
Dec 16 21:57:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=77.65.142.50, lip=66.85.158.91, TLS, session=<q59VNBRGu4JNQY4y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.97.73.17
country_id: 3469034
description:
Dec 16 21:57:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=138.97.73.17, lip=66.85.158.91, TLS, session=<qLJdNBRGvoiKYUkR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.59.134.54
country_id: 1269750
description:
Dec 16 21:57:53 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<careers>, method=PLAIN, rip=103.59.134.54, lip=66.85.158.91, TLS, session=<4J1TNBRG3uBnO4Y2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.66
country_id: 1269750
description:
Dec 16 21:58:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<careers>, method=PLAIN, rip=103.18.166.66, lip=66.85.158.91, TLS, session=<sxHGNBRGR5xnEqZC>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 5.187.97.40
country_id: 3579143
description:
Dec 16 21:58:06 host2 sshd[1284028]: error: maximum authentication attempts exceeded for root from 5.187.97.40 port 46891 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.125.189
country_id: 1694008
description:
2025-12-16 21:59:15 dovecot_login authenticator failed for (ADMIN) [188.214.125.189]:46969: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 16 22:01:17 host2 sshd[1287460]: Disconnected from invalid user user 2.57.121.25 port 53942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.0.158
country_id: 1269750
description:
2025-12-16 22:04:59 dovecot_plain authenticator failed for (I7QG1XB55L1Y) [163.223.0.158]:51762: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.22
country_id: 2029969
description:
2025-12-16 22:06:15 dovecot_login authenticator failed for (ADMIN) [173.244.58.22]:50386: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-16 22:10:14 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (bartic) [68.52.119.193]:39928: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 16 22:10:13 host2 sshd[1293675]: Disconnected from invalid user guadalupe 62.60.131.157 port 62688 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-16 22:11:16 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:38025: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.80.4.83
country_id: 6252001
description:
Dec 16 22:11:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=98.80.4.83, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ohibZRRGJpNiUART>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 16 22:12:22 host2 sshd[1296246]: Disconnected from invalid user username 209.141.43.77 port 59162 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-12-16 22:12:27 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:49235: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-16 22:12:00 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3854: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 16 22:12:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<dOQNaRRGENk+PIdn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 16 22:14:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<Mq1XcRRGkJc+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 16 22:15:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<hFL6dRRGcJk+PIMh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 16 22:16:28 host2 sshd[1311803]: Disconnected from invalid user ipfs 209.141.43.77 port 56250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 16 22:18:18 host2 sshd[1313012]: Disconnected from invalid user postgres 209.141.43.77 port 41476 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 16 22:19:47 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.5, lip=66.85.158.92, TLS handshaking: Connection closed, session=<oFHwgxRGpjtKUi8F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-16 22:20:40 dovecot_plain authenticator failed for (trunhic) [94.206.93.90]:35445: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.27.33.174
country_id: 6252001
description:
2025-12-16 22:20:44 dovecot_plain authenticator failed for c-73-27-33-174.hsd1.fl.comcast.net (ditis) [73.27.33.174]:54594: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec 16 22:21:17 host2 sshd[1315425]: Disconnected from invalid user doc 179.125.24.202 port 52464 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.230
country_id: 6252001
description:
Dec 16 22:22:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.230, lip=66.85.158.91, TLS: Connection closed, session=<7mcAjBRG2IFHBobm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-16 22:23:24 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52447: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:23:29 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<0rsxkRRGmKMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.22
country_id: 3194884
description:
2025-12-16 22:22:55 dovecot_login authenticator failed for (ADMIN) [176.125.229.22]:38937: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 22:23:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<e5a+kBRGdso+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:24:41 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<kp+DlRRGAr8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:24:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<4++xlRRGvuADhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec 16 22:25:21 host2 sshd[1317850]: Disconnected from invalid user alex 179.125.24.202 port 44798 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.125.24.202
country_id: 3469034
description:
Dec 16 22:26:02 host2 sshd[1318211]: Disconnected from invalid user admin 179.125.24.202 port 58504 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.227.193.105
country_id: 6252001
description:
Dec 16 22:26:23 host2 pure-ftpd[1318396]: (?@34.227.193.105) [INFO] New connection from 34.227.193.105


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:26:33 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<AXklnBRGUJkDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 16 22:27:00 host2 sshd[1318689]: Disconnected from invalid user guest 36.37.122.175 port 38626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec 16 22:27:21 host2 sshd[1318979]: Disconnected from invalid user devops 179.125.24.202 port 39132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 16 22:26:48 host2 sshd[1318629]: Disconnected from invalid user admin 172.200.228.35 port 58554 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:26:54 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<XOpqnRRGNowDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:27:45 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<NTx7oBRGZLMDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:28:03 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<qwqEoRRGct4DhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 16 22:28:17 host2 sshd[1319558]: Disconnected from invalid user kirill 36.37.122.175 port 54362 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:29:17 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<MwHzpRRGxIoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.52
country_id: 798549
description:
2025-12-16 22:29:23 dovecot_login authenticator failed for (ADMIN) [143.244.52.52]:24419: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 16 22:28:57 host2 sshd[1319915]: Disconnected from invalid user api 36.37.122.175 port 36194 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:29:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<c9LTpRRGtIoDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 16 22:29:48 host2 sshd[1320526]: Disconnected from invalid user admin 172.200.228.35 port 54026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:30:25 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<XUL7qRRGmuwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 16 22:31:37 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<W41CrhRGQMoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-16 22:32:53 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (ectomyclia) [24.15.216.41]:41370: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec 16 22:33:17 host2 sshd[1323257]: Disconnected from invalid user minecraft 179.125.24.202 port 53430 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.140.219
country_id: 298795
description:
2025-12-16 22:34:10 dovecot_plain authenticator failed for (docon) [5.11.140.219]:57200: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-16 22:34:14 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (nonesses) [76.157.219.158]:41306: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 22:35:20 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (cania) [87.103.126.54]:15518: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 16 22:34:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<wWSiuRRGZKM+PIdp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 22:36:19 host2 sshd[1325250]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 16 22:36:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<4KNhvhRGPOw+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.81.82
country_id: 6251999
description:
2025-12-16 22:38:24 dovecot_login authenticator failed for (ADMIN) [66.56.81.82]:33568: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-16 22:40:15 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (tesiones) [98.204.134.124]:43276: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Dec 16 22:42:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<c2XS1RRG/Ays7OTF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-12-16 22:44:04 dovecot_plain authenticator failed for c-73-53-254-168.hsd1.fl.comcast.net (buganal) [73.53.254.168]:35718: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-16 22:45:51 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (tercily) [73.196.144.25]:49670: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 16 22:46:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<8pJN5BRGcqc+PIcm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.104
country_id: 3017382
description:
Dec 16 22:47:04 host2 pure-ftpd[1332579]: (?@91.196.152.104) [INFO] New connection from 91.196.152.104


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.21
country_id: 3017382
description:
Dec 16 22:47:04 host2 pure-ftpd[1332570]: (?@91.196.152.21) [INFO] New connection from 91.196.152.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-16 22:50:54 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (preae) [98.40.101.10]:42886: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 16 22:51:17 host2 pure-ftpd[1335517]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-16 22:51:38 dovecot_plain authenticator failed for (candess) [96.85.104.2]:41058: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 16 22:51:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<q78S9hRGTtc+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.44
country_id: 2635167
description:
2025-12-16 22:54:58 dovecot_login authenticator failed for (ADMIN) [45.133.172.44]:47658: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.10
country_id: 1522867
description:
2025-12-16 22:56:49 dovecot_login authenticator failed for (ADMIN) [62.133.47.10]:55541: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-16 22:57:52 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (logly) [50.74.136.134]:60778: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 16 22:59:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<QkFmExVG4Lo+PIcg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.85
country_id: 6252001
description:
Dec 16 23:00:18 host2 pure-ftpd[1342500]: (?@198.235.24.85) [INFO] New connection from 198.235.24.85


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.208.108.166
country_id: 1819730
description:
Dec 16 23:00:22 host2 sshd[1342544]: Disconnected from invalid user localhost 104.208.108.166 port 30810 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.172.21
country_id: 6252001
description:
Dec 16 23:01:25 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=45.79.172.21, lip=66.85.158.92, session=<avvUGBVGroktT6wV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 16 23:00:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<zWkWFxVGVrk+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.208.108.166
country_id: 1819730
description:
Dec 16 23:02:50 host2 sshd[1344337]: Disconnected from invalid user ubuntu 104.208.108.166 port 13006 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 16 23:04:15 host2 sshd[1346489]: Disconnected from invalid user zabbix 103.100.208.88 port 47357 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Dec 16 23:06:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.107, lip=66.85.158.91, TLS handshaking: Connection closed, session=<InthKhVG0hxAPsVr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 16 23:06:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<AJREKhVGoNw+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-16 23:06:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (yogiony) [87.103.126.54]:64968: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Dec 16 23:06:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.107, lip=66.85.158.91, TLS: Connection closed, session=<aOSULBVGOm1APsVr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.111.119
country_id: 1819730
description:
Dec 16 23:08:42 host2 sshd[1349647]: Disconnected from invalid user scan 101.36.111.119 port 52702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec 16 23:07:51 host2 sshd[1348933]: Disconnected from invalid user ssh 103.100.208.88 port 55351 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.208.108.166
country_id: 1819730
description:
Dec 16 23:08:01 host2 sshd[1349123]: Disconnected from invalid user scan 104.208.108.166 port 26272 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.92
country_id: 6252001
description:
Dec 16 23:09:15 host2 pure-ftpd[1350145]: (?@205.210.31.92) [INFO] New connection from 205.210.31.92


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.111.119
country_id: 1819730
description:
Dec 16 23:09:20 host2 sshd[1350210]: Disconnected from invalid user erick 101.36.111.119 port 39388 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.213
country_id: 1880251
description:
Dec 16 23:10:20 host2 sshd[1351156]: Disconnected from invalid user n 45.78.226.213 port 60830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-16 23:11:08 dovecot_plain authenticator failed for (soutupers) [154.144.243.93]:37578: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.174
country_id: 3144096
description:
2025-12-16 23:12:59 dovecot_login authenticator failed for (ADMIN) [46.246.122.174]:38599: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-16 23:13:44 dovecot_login authenticator failed for (syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:36538: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-16 23:14:07 dovecot_login authenticator failed for ([121.73.163.186]) [121.73.163.186]:40302: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-16 23:14:16 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (dives) [73.197.236.163]:39562: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 16 23:15:15 host2 sshd[1354071]: Disconnected from invalid user lighthouse 83.229.122.23 port 43584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 16 23:15:55 host2 sshd[1354363]: Disconnected from invalid user free 83.229.122.23 port 46116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.213
country_id: 1880251
description:
Dec 16 23:16:02 host2 sshd[1354393]: Disconnected from invalid user admin1 45.78.226.213 port 60128 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.108.39
country_id: 290557
description:
2025-12-16 23:17:02 dovecot_login authenticator failed for ([94.204.108.39]) [94.204.108.39]:38257: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.213
country_id: 1880251
description:
Dec 16 23:17:06 host2 sshd[1354934]: Disconnected from invalid user erick 45.78.226.213 port 34476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-16 23:17:30 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:33874: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 23:16:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<i08RUBVGIo0+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 16 23:17:50 host2 sshd[1355370]: Disconnected from invalid user onlyoffice 83.229.122.23 port 55938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-12-16 23:19:43 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (fardfole) [76.157.219.158]:53926: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 16 23:22:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<4BlCZBVGWrU+PIde>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 16 23:22:14 host2 sshd[1358386]: Disconnected from invalid user www-data 83.229.122.23 port 43888 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-12-16 23:26:06 dovecot_plain authenticator failed for (oseung) [65.20.148.165]:56459: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.18
country_id: 1227603
description:
2025-12-16 23:26:32 dovecot_login authenticator failed for (ADMIN) [95.181.239.18]:39369: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-16 23:26:31 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (zasught) [73.145.107.251]:34234: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.59.31.15
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 194.59.31.15 - cloudtourssrilan "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.116
country_id: 357994
description:
2025-12-16 23:29:36 dovecot_login authenticator failed for (ADMIN) [188.214.122.116]:47338: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-16 23:30:16 dovecot_plain authenticator failed for (orring) [90.160.139.163]:45936: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Dec 16 23:32:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, session=<UjrzhhVGMt7Y2s5C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-16 23:33:58 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (trachal) [73.230.86.50]:48322: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.54.213
country_id: 6252001
description:
Dec 16 23:34:28 host2 pure-ftpd[1365601]: (?@161.35.54.213) [INFO] New connection from 161.35.54.213


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2025-12-16 23:35:24 dovecot_login authenticator failed for ([61.246.205.1]) [125.19.218.2]:39686: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-16 23:34:56 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:43419: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.228.165
country_id: 1880251
description:
Dec 16 23:37:41 host2 sshd[1367483]: Disconnected from invalid user eli 45.78.228.165 port 56178 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Dec 16 23:36:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DJ6qlxVGvlFChJl2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 16 23:39:23 host2 sshd[1368715]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-16 23:39:53 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (rudize) [73.144.27.228]:37672: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2025-12-16 23:41:28 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:44542: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-12-16 23:42:05 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:34365: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.105.128
country_id: 1562822
description:
Dec 16 23:42:00 host2 sshd[1370557]: Disconnected from invalid user diquest 165.154.105.128 port 36676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Dec 16 23:43:26 host2 sshd[1371235]: Disconnected from invalid user administrator 68.233.116.124 port 26086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.228.165
country_id: 1880251
description:
Dec 16 23:43:51 host2 sshd[1371397]: Disconnected from invalid user yf 45.78.228.165 port 41932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 16 23:46:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<x2K/uRVGHJI+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 16 23:46:29 host2 sshd[1373530]: Disconnected from invalid user macro 205.185.125.150 port 34304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-16 23:46:39 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:59041: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.3.44.172
country_id: 2464461
description:
2025-12-16 23:47:05 dovecot_plain authenticator failed for ([31.57.166.48]) [197.3.44.172]:53628: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-16 23:47:06 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:54415: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.227.67.166
country_id: 3895114
description:
2025-12-16 23:47:17 dovecot_plain authenticator failed for ([31.57.166.48]) [148.227.67.166]:11497: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.73.72.206
country_id: 6252001
description:
2025-12-16 23:46:52 dovecot_plain authenticator failed for ([31.57.166.48]) [69.73.72.206]:56538: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.233.116.124
country_id: 1269750
description:
Dec 16 23:47:58 host2 sshd[1374178]: Disconnected from invalid user teste1 68.233.116.124 port 59322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.105.128
country_id: 1562822
description:
Dec 16 23:49:11 host2 sshd[1374970]: Disconnected from invalid user alfresco 165.154.105.128 port 39534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.201
country_id: 3932488
description:
Dec 16 23:48:58 host2 sshd[1374753]: Disconnected from invalid user checker 161.132.68.201 port 41974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.90.226
country_id: 2802361
description:
2025-12-16 23:49:04 dovecot_login authenticator failed for (ADMIN) [149.22.90.226]:30733: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Dec 16 23:49:05 host2 sshd[1374896]: Disconnected from invalid user chatbot 68.233.116.124 port 27720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 16 23:49:43 host2 sshd[1375237]: Disconnected from invalid user user 205.185.125.150 port 42602 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.125.150
country_id: 6252001
description:
Dec 16 23:50:19 host2 sshd[1375793]: Disconnected from invalid user chatbot 205.185.125.150 port 55554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.105.128
country_id: 1562822
description:
Dec 16 23:51:10 host2 sshd[1376522]: Disconnected from invalid user rootuser 165.154.105.128 port 37486 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 16 23:51:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<pcoMzBVGZNQ+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.105.128
country_id: 1562822
description:
Dec 16 23:52:08 host2 sshd[1377129]: Disconnected from invalid user macro 165.154.105.128 port 50576 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 161.132.68.201
country_id: 3932488
description:
Dec 16 23:52:15 host2 sshd[1377193]: Received disconnect from 161.132.68.201 port 39932:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.155
country_id: 3703430
description:
Dec 16 23:52:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.155, lip=66.85.158.92, session=<HPfdzxVG3/4t4/6b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.201
country_id: 3932488
description:
Dec 16 23:53:23 host2 sshd[1377815]: Disconnected from invalid user csserver 161.132.68.201 port 35582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.105.128
country_id: 1562822
description:
Dec 16 23:53:12 host2 sshd[1377716]: Disconnected from invalid user chatbot 165.154.105.128 port 35432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.63
country_id: 1880251
description:
2025-12-16 23:54:24 dovecot_login authenticator failed for (ADMIN) [156.146.57.63]:50072: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 16 23:53:46 host2 pure-ftpd[1378187]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-16 23:53:49 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:41472: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-16 23:54:08 dovecot_login authenticator failed for (cm-178.232.120.182.get.no) [178.232.120.182]:36720: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 16 23:55:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<Sti42xVGfto+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Dec 16 23:56:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.91, session=<sXZK3xVGXNdV2YwD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-17 00:00:03 dovecot_plain authenticator failed for (chites) [64.53.7.231]:39342: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 00:00:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<WFIa6xVGdsQ+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 17 00:05:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<ytWr/hVGBq7BHmEh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.8.221
country_id: 6252001
description:
Dec 17 00:05:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.79.8.221, lip=66.85.158.92, session=<RblT/xVGrqwtTwjd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-17 00:07:36 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (introtic) [73.197.236.163]:37926: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.46.128
country_id: 3703430
description:
[2025-12-17 00:09:24 +0530] info [cpaneld] 138.84.46.128 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.25.29.159
country_id: 3932488
description:
[2025-12-17 00:09:27 +0530] info [cpaneld] 38.25.29.159 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.86.20.227
country_id: 3469034
description:
[2025-12-17 00:09:29 +0530] info [cpaneld] 177.86.20.227 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.71.32.208
country_id: 6252001
description:
[2025-12-17 00:09:37 +0530] info [cpaneld] 73.71.32.208 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.144.162.134
country_id: 1694008
description:
[2025-12-17 00:09:31 +0530] info [whostmgrd] 49.144.162.134 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.105.124.76
country_id: 3865483
description:
[2025-12-17 00:09:33 +0530] info [cpaneld] 190.105.124.76 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.163.112.4
country_id: 3469034
description:
[2025-12-17 00:09:35 +0530] info [cpaneld] 45.163.112.4 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.23
country_id: 3625428
description:
2025-12-17 00:10:48 dovecot_login authenticator failed for (ADMIN) [95.181.237.23]:10954: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.76
country_id: 6252001
description:
Dec 17 00:12:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.76, lip=66.85.158.91, session=<o9fTFhZG129APpxM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.66
country_id: 6252001
description:
Dec 17 00:12:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.66, lip=66.85.158.91, TLS: Connection closed, session=<8teOFxZGRHxAPpxC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 00:15:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<DVvNIhZGIow+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.8
country_id: 798549
description:
Dec 17 00:18:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.8, lip=66.85.158.92, session=<blYdKxZGWMBV2YwI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.216.7
country_id: 1861060
description:
2025-12-17 00:18:44 dovecot_login authenticator failed for (ADMIN) [155.2.216.7]:50046: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 00:19:22 host2 sshd[1397532]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.13
country_id: 798549
description:
Dec 17 00:19:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.13, lip=66.85.158.92, TLS: Connection closed, session=<HDNeMBZGPqHUSZQN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.93.118
country_id: 6252001
description:
Dec 17 00:22:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=47.251.93.118, lip=66.85.158.92, session=<P0tpORZGRFAv+112>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 17 00:23:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<mnElPxZGyMA+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-17 00:24:00 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (triverin) [73.145.107.251]:54578: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 00:25:41 host2 sshd[1401362]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 00:25:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<+8VIRhZGmt0+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 00:25:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<sESGRhZG/ss+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 00:29:24 host2 sshd[1403195]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 61844


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.35
country_id: 953987
description:
2025-12-17 00:29:58 dovecot_login authenticator failed for (ADMIN) [154.47.30.35]:1409: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-17 00:30:12 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (zossain) [71.235.225.181]:56080: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 00:31:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<lzdHXBZGbLs+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-17 00:32:19 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:34398: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-17 00:32:37 dovecot_login authenticator failed for ([122.184.127.86]) [122.184.127.86]:43494: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Dec 17 00:33:28 host2 sshd[1406435]: Disconnected from invalid user user 50.84.211.204 port 33544 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Dec 17 00:34:01 host2 sshd[1406793]: Disconnected from invalid user ahmed 50.84.211.204 port 46044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.162.8
country_id: 1880251
description:
Dec 17 00:36:09 host2 sshd[1408748]: Disconnected from invalid user ahmed 15.235.162.8 port 41444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 00:35:44 host2 sshd[1408329]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 54652


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 15.235.162.8
country_id: 1880251
description:
Dec 17 00:38:11 host2 sshd[1410059]: Disconnected from invalid user hadi 15.235.162.8 port 38050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 17 00:37:41 host2 sshd[1409718]: Disconnected from invalid user user 152.32.130.118 port 54946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 17 00:38:25 host2 sshd[1410188]: Disconnected from invalid user onkar 152.32.130.118 port 54140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.162.8
country_id: 1880251
description:
Dec 17 00:38:49 host2 sshd[1410389]: Disconnected from invalid user demo 15.235.162.8 port 42396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-17 00:38:52 dovecot_plain authenticator failed for (mitass) [5.11.221.119]:55730: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-17 00:39:21 dovecot_plain authenticator failed for (taptly) [5.11.143.72]:53132: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 00:39:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Vz4ueBZGWpQ+PIcm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 17 00:40:51 host2 sshd[1412351]: Disconnected from invalid user ubuntu 152.32.130.118 port 37568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 17 00:40:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<1945ehZGiJQ+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 00:42:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Y5HggBZG3rU+PIcm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.221.74.234
country_id: 226074
description:
Dec 17 00:45:17 host2 sshd[1415433]: Disconnected from invalid user faisal 45.221.74.234 port 39640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.232.33
country_id: 6252001
description:
2025-12-17 00:45:48 dovecot_login authenticator failed for (ADMIN) [102.129.232.33]:60116: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.22.161
country_id: 6252001
description:
Dec 17 00:45:49 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.172.22.161, lip=66.85.158.92, TLS, session=<ccI7jhZGnrOnrBah>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.53.38.51
country_id: 6251999
description:
2025-12-17 00:46:02 dovecot_plain authenticator failed for (salitrole) [24.53.38.51]:48299: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-17 00:46:07 dovecot_plain authenticator failed for (peresm) [65.20.133.208]:58961: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.62
country_id: 798549
description:
2025-12-17 00:45:27 dovecot_login authenticator failed for (ADMIN) [143.244.52.62]:24496: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.156
country_id: 6252001
description:
Dec 17 00:47:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<graakhZGdNuTuYSc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-12-17 00:47:06 dovecot_login authenticator failed for (186.235.248.73.girardi-rs.com.br) [186.235.248.73]:47818: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-17 00:46:36 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:55516: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 00:48:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<rDFGmRZG9M4+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-17 00:49:21 dovecot_login authenticator failed for ([67.55.189.211]) [67.55.189.211]:53420: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-17 00:49:56 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:51963: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 17 00:50:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<w8p4nxZGpo8+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-17 00:51:38 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:39702: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 00:52:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<LsNSpxZG6rA+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.225.255.82
country_id: 2510769
description:
2025-12-17 00:53:36 dovecot_login authenticator failed for (82.red.255.225.212.procono.es) [212.225.255.82]:46526: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-12-17 00:54:02 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:47310: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.162
country_id: 6252001
description:
Dec 17 00:54:15 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.162, lip=66.85.158.92, session=<tDZdrBZGECFC5DWi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-17 00:54:28 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:38620: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-17 00:54:34 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (ambatter) [67.172.54.29]:59084: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 00:54:48 host2 sshd[1423387]: Disconnected from invalid user user 2.57.121.25 port 51704 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 00:55:17 host2 pure-ftpd[1423999]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 00:57:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<Vx+OthZGNK0+PIMh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.123
country_id: 3469034
description:
Dec 17 00:59:56 host2 sshd[1426453]: Disconnected from invalid user ria 189.47.10.123 port 60134 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-17 01:00:22 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (octainal) [87.103.126.54]:22491: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.123
country_id: 3469034
description:
Dec 17 01:01:43 host2 sshd[1427946]: Disconnected from invalid user onkar 189.47.10.123 port 50500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.168.120
country_id: 1269750
description:
2025-12-17 01:02:15 dovecot_plain authenticator failed for (6S73LVD8) [49.43.168.120]:5856: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 17 01:03:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<i5GFyxZGxOc+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 17 01:04:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<3Nml0BZGdIiLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.124
country_id: 3144096
description:
2025-12-17 01:06:28 dovecot_login authenticator failed for (ADMIN) [46.246.122.124]:13806: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 17 01:08:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<Vr773RZGboI+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.61
country_id: 6252001
description:
2025-12-17 01:08:30 dovecot_login authenticator failed for (ADMIN) [191.96.37.61]:60739: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 180.188.253.150
country_id: 1269750
description:
Dec 17 01:09:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=180.188.253.150, lip=66.85.158.91, session=<uRc84hZGTpe0vP2W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.73.203.129
country_id: 2542007
description:
Dec 17 01:09:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=105.73.203.129, lip=66.85.158.91, TLS, session=<yho94RZGl6lpScuB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.250.149.25
country_id: 1269750
description:
Dec 17 01:09:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=117.250.149.25, lip=66.85.158.91, TLS, session=<6/p94hZG1NJ1+pUZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.228.34
country_id: 1269750
description:
Dec 17 01:09:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=115.241.228.34, lip=66.85.158.91, TLS, session=<PVwD4xZG6KVz8eQi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 01:09:15 host2 sshd[1433858]: Disconnected from invalid user chantel 62.60.131.157 port 46895 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.186.54.65
country_id: 298795
description:
Dec 17 01:09:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=78.186.54.65, lip=66.85.158.91, session=<3S6z4hZGANpOujZB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 88.82.212.15
country_id: 2510769
description:
Dec 17 01:09:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=88.82.212.15, lip=66.85.158.91, TLS, session=<FWR/4hZGBcxYUtQP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 01:09:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<MKpB5BZGetY+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 01:11:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<AoDN6RZGCMc+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-17 01:12:13 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (winioninic) [73.144.27.228]:57670: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 17 01:14:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<baKn8xZGtMY+PIdi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Dec 17 01:14:28 host2 sshd[1438308]: Disconnected from invalid user test 45.78.203.166 port 38112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 01:16:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<bvjn+xZGqJY+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Dec 17 01:19:34 host2 sshd[1442473]: Disconnected from invalid user bravo 45.78.203.166 port 58646 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.44
country_id: 6252001
description:
Dec 17 01:19:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.169.105.44, lip=66.85.158.92, session=<vRxLBxdGaK4UqWks>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.19
country_id: 2029969
description:
2025-12-17 01:20:29 dovecot_login authenticator failed for (ADMIN) [173.244.58.19]:54088: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 01:21:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<XQ1SDBdGVNI+PIdf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.166
country_id: 1880251
description:
Dec 17 01:27:05 host2 sshd[1448153]: Disconnected from invalid user tom 45.78.203.166 port 57458 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.38.106.200
country_id: 2802361
description:
Dec 17 01:28:42 host2 pure-ftpd[1449400]: (?@34.38.106.200) [INFO] New connection from 34.38.106.200


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 01:28:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<EH8kKBdGRN0+PIcm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 01:30:01 host2 sshd[1450232]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.241.97
country_id: 2802361
description:
Dec 17 01:29:29 host2 pure-ftpd[1449964]: (?@35.195.241.97) [INFO] New connection from 35.195.241.97


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 17 01:32:12 host2 pure-ftpd[1451877]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 17 01:32:16 host2 pure-ftpd[1451901]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Dec 17 01:33:34 host2 sshd[1452654]: Disconnected from invalid user psg 45.78.203.166 port 59122 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 17 01:34:22 host2 pure-ftpd[1453094]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 01:35:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<33SXPhdGPOE+PIce>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 17 01:34:18 host2 pure-ftpd[1453055]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2025-12-17 01:38:24 dovecot_login authenticator failed for (ADMIN) [158.173.152.153]:12770: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 01:41:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<IlvUUxdG4MU+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.133
country_id: 3077311
description:
2025-12-17 01:42:23 dovecot_login authenticator failed for (ADMIN) [212.102.39.133]:20716: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 17 01:43:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<MLRFWxdG0r4+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-12-17 01:46:11 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:33700: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-12-17 01:46:27 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:52690: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 01:47:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<o28saRdGMKw+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-17 01:48:43 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (subles) [98.193.112.85]:59120: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 01:48:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<Xes9bxdGBLA+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 17 01:49:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<WdeEcRdGM/7CpRCm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.110.223.72
country_id: 6251999
description:
Dec 17 01:50:59 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=143.110.223.72, lip=66.85.158.91, TLS, session=<whNNdxdGMpmPbt9I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.199.81.100
country_id: 6252001
description:
Dec 17 01:53:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.199.81.100, lip=66.85.158.92, session=<LLvDfxdGfKvGx1Fk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec 17 01:54:17 host2 sshd[1464144]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 62004


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 17 01:54:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<zsIFgxdG3KQ+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.223.68
country_id: 6252001
description:
Dec 17 01:54:27 host2 sshd[1464237]: Disconnected from invalid user sftp 34.66.223.68 port 55998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Dec 17 01:56:07 host2 sshd[1465287]: Disconnected from invalid user arjun 203.150.162.250 port 54532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 01:56:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<LiPAiRdGXKA+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 17 01:56:24 host2 sshd[1465572]: Disconnected from invalid user ml 103.164.81.65 port 52356 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 01:56:53 host2 pure-ftpd[1465967]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec 17 01:57:31 host2 sshd[1466460]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 4877


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 17 01:57:39 host2 sshd[1466503]: Disconnected from invalid user admin 51.178.43.161 port 43264 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 17 01:57:43 host2 sshd[1466514]: Disconnected from invalid user ansible 103.164.81.65 port 22138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 17 01:58:21 host2 sshd[1466738]: Disconnected from invalid user admin 103.164.81.65 port 34522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 01:58:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<u7OGkRdGZIA+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 17 02:00:11 host2 sshd[1467529]: Disconnected from invalid user vpsuser 51.178.43.161 port 48918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.42.51
country_id: 690791
description:
2025-12-17 01:59:37 dovecot_login authenticator failed for (ADMIN) [84.239.42.51]:56158: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.223.68
country_id: 6252001
description:
Dec 17 01:59:54 host2 sshd[1467189]: Disconnected from invalid user cs 34.66.223.68 port 44208 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 17 02:00:45 host2 sshd[1467758]: Received disconnect from 51.178.43.161 port 33114:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 17 02:00:45 host2 sshd[1467758]: Disconnected from invalid user lighthouse 51.178.43.161 port 33114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Dec 17 02:00:49 host2 sshd[1467791]: Disconnected from invalid user ubuntu 203.150.162.250 port 55100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 02:01:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<bPzLnRdGCo8+PIde>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.150.162.250
country_id: 1605651
description:
Dec 17 02:02:06 host2 sshd[1468397]: Disconnected from invalid user lighthouse 203.150.162.250 port 38660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Dec 17 02:02:41 host2 sshd[1468705]: Disconnected from invalid user db2inst1 203.150.162.250 port 37146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 02:03:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<ZwW1ohdGeLY+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.9
country_id: 1522867
description:
2025-12-17 02:02:35 dovecot_login authenticator failed for (ADMIN) [62.133.47.9]:59835: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.46
country_id: 6252001
description:
Dec 17 02:04:37 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.46, lip=66.85.158.92, session=<3gUIqBdGQnKsaAsu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.163
country_id: 6252001
description:
Dec 17 02:08:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.163, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<vlQdtBdG+sfN0h+j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-17 02:08:48 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (rectin) [24.98.45.238]:58094: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 02:09:23 host2 sshd[1471926]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-17 02:09:48 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:46082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2025-12-17 02:10:03 dovecot_login authenticator failed for ([201.219.68.189]) [201.219.68.189]:45447: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.103.225.182
country_id: 3996063
description:
Dec 17 02:11:16 host2 sshd[1472839]: Disconnected from invalid user david 201.103.225.182 port 50014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-17 02:11:39 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:41234: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.134.231
country_id: 1819730
description:
Dec 17 02:14:43 host2 sshd[1474923]: Disconnected from invalid user precio01 152.32.134.231 port 59768 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.103.225.182
country_id: 3996063
description:
Dec 17 02:15:07 host2 sshd[1475410]: Disconnected from invalid user vyos 201.103.225.182 port 36356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.134.231
country_id: 1819730
description:
Dec 17 02:15:19 host2 sshd[1475517]: Disconnected from invalid user leo 152.32.134.231 port 32894 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.134.231
country_id: 1819730
description:
Dec 17 02:17:05 host2 sshd[1476303]: Disconnected from invalid user sun 152.32.134.231 port 34008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.78.54.93
country_id: 2750405
description:
2025-12-17 02:17:04 dovecot_login authenticator failed for (ADMIN) [195.78.54.93]:38567: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 02:17:06 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61510: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.198.63.135
country_id: 6252001
description:
Dec 17 02:18:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=143.198.63.135, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<3JGY2BdGOpuPxj+H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.184.27
country_id: 6252001
description:
Dec 17 02:18:35 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=40.124.184.27, lip=66.85.158.92, session=<bIv52RdGKOIofLgb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 17 02:18:41 host2 sshd[1476801]: Disconnected from invalid user wanghao 209.15.119.12 port 40818 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 02:20:25 host2 sshd[1477753]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 17 02:21:48 host2 sshd[1478470]: Disconnected from invalid user cuckoo 209.15.119.12 port 33214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.109.7
country_id: 3175395
description:
Dec 17 02:20:56 host2 sshd[1477938]: Disconnected from invalid user jmarquez 151.19.109.7 port 10858 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 02:22:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<3HXy5xdGuOg+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.40.218.140
country_id: 6252001
description:
Dec 17 02:22:02 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.40.218.140, lip=66.85.158.91, session=<R+FK5hdG/tAUKNqM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 02:22:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<q38C5xdGJJs+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 17 02:22:22 host2 sshd[1478803]: Disconnected from invalid user taiga 209.15.119.12 port 54336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.29
country_id: 6290252
description:
2025-12-17 02:24:17 dovecot_login authenticator failed for (ADMIN) [37.46.115.29]:33764: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 17 02:25:21 host2 sshd[1480545]: Disconnected from invalid user runner 186.80.18.158 port 35552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 17 02:26:19 host2 sshd[1481188]: Disconnected from invalid user postgres 154.91.81.224 port 35816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 17 02:26:33 host2 sshd[1481350]: Disconnected from invalid user github 186.80.18.158 port 38024 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 02:27:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=</LxH+BdGJrI+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 17 02:27:32 host2 sshd[1481920]: Disconnected from invalid user supervisor 154.91.81.224 port 60818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 17 02:27:39 host2 sshd[1481998]: Disconnected from invalid user admin 186.80.18.158 port 53642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.235.139
country_id: 6252001
description:
Dec 17 02:29:41 host2 sshd[1483135]: Disconnected from invalid user neeraj 165.154.235.139 port 59212 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 17 02:29:17 host2 sshd[1482931]: Disconnected from invalid user koha 154.91.81.224 port 42544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.123
country_id: 1643084
description:
Dec 17 02:31:52 host2 sshd[1484482]: Disconnected from invalid user supervisor 27.112.79.123 port 55352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 17 02:31:27 host2 sshd[1484259]: Disconnected from invalid user hadoop 27.111.32.174 port 34290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 02:32:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<RRycDBhGhso+PIM0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.79.123
country_id: 1643084
description:
Dec 17 02:32:28 host2 sshd[1484834]: Disconnected from invalid user user 27.112.79.123 port 57950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 17 02:33:16 host2 sshd[1485613]: Disconnected from invalid user admin 27.111.32.174 port 37636 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 17 02:33:50 host2 sshd[1485901]: Disconnected from invalid user user 27.111.32.174 port 58992 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 165.154.235.139
country_id: 6252001
description:
Dec 17 02:34:18 host2 sshd[1486197]: Received disconnect from 165.154.235.139 port 51870:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.142.79.90
country_id: 2658434
description:
2025-12-17 02:36:15 dovecot_login authenticator failed for (ADMIN) [79.142.79.90]:60258: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-17 02:38:18 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:37299: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-17 02:39:02 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:44050: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.112
country_id: 1880251
description:
Dec 17 02:41:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=15.235.175.112, lip=66.85.158.92, session=<dLaNKhhGLc4P669w>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.119
country_id: 1880251
description:
Dec 17 02:41:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 13 secs): user=<>, rip=15.235.175.119, lip=66.85.158.92, session=<0/JWKxhGxdsP6693>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.126
country_id: 1880251
description:
Dec 17 02:41:31 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=15.235.175.126, lip=66.85.158.92, session=<KBX5KxhGYckP669+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.127
country_id: 1880251
description:
Dec 17 02:41:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=15.235.175.127, lip=66.85.158.92, session=<sMssLBhGJ98P669/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.57
country_id: 6252001
description:
Dec 17 02:43:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.57, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mZdbNBhGqMvN0h85>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.107
country_id: 1814991
description:
Dec 17 02:44:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.107, lip=66.85.158.92, session=<4Vw7NxhGQ7he585r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.37
country_id: 1814991
description:
Dec 17 02:44:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.37, lip=66.85.158.92, session=<JY7ZNxhGp4Ve584l>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 02:44:57 host2 sshd[1494405]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.111
country_id: 1814991
description:
Dec 17 02:45:00 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.111, lip=66.85.158.92, session=<DD1uOBhG8+de585v>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.33
country_id: 1814991
description:
Dec 17 02:45:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.33, lip=66.85.158.92, session=<4c+hOBhG4eFe584h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.203.225.221
country_id: 6252001
description:
Dec 17 02:45:13 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.203.225.221, lip=66.85.158.91, session=<fkQ9ORhGQsOsy+Hd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.110.15
country_id: 1880251
description:
Dec 17 02:45:58 host2 sshd[1495884]: Disconnected from invalid user dev 43.128.110.15 port 46334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.133
country_id: 2328926
description:
2025-12-17 02:46:42 dovecot_login authenticator failed for (ADMIN) [146.70.65.133]:1029: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 02:46:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<Z7HnPhhG/qQ+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.202
country_id: 6252001
description:
2025-12-17 02:48:54 dovecot_login authenticator failed for ([72.214.132.202]) [72.214.132.202]:43982: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.128.110.15
country_id: 1880251
description:
Dec 17 02:49:03 host2 sshd[1498129]: Disconnected from invalid user ftpuser 43.128.110.15 port 33110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-17 02:54:15 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:38018: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:54:45 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<8TpSWxhG3LQDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-12-17 02:54:47 dovecot_login authenticator failed for ([125.17.236.223]) [125.17.233.246]:56894: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.193.6.183
country_id: 6251999
description:
2025-12-17 02:55:31 dovecot_login authenticator failed for (ADMIN) [91.193.6.183]:53688: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:55:35 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<pI9PXhhGxJsDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 02:56:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<cHgFYhhGDsA+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:57:10 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<gw/3YxhGNOADhpQ7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 02:57:58 host2 pure-ftpd[1504501]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:58:00 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<ICLwZhhGnL0DhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:58:43 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<MHWFaRhGBIEDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:59:13 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<0dVIaxhG6MIDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:59:34 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<ARKRbBhGBOcDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 03:00:03 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<PR9MbhhGOuEDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 03:01:22 host2 sshd[1507122]: Disconnected from invalid user reese 62.60.131.157 port 49336 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.201
country_id: 6252001
description:
Dec 17 03:03:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rQR5exhGhN6TuYTJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 17 03:04:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<SKRbfRhGqrk+PIds>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.87
country_id: 6252001
description:
Dec 17 03:04:25 host2 pure-ftpd[1509947]: (?@147.185.132.87) [INFO] New connection from 147.185.132.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-17 03:05:14 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:58816: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-17 03:05:15 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:51210: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-17 03:05:34 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:40856: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 03:06:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<tXo3hBhGBuo+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-17 03:05:57 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:47300: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-17 03:07:05 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (balbatte) [87.103.126.54]:46741: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.69
country_id: 2802361
description:
2025-12-17 03:07:11 dovecot_login authenticator failed for (ADMIN) [181.214.218.69]:46289: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 03:09:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<2c5SjhhGNN0+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 17 03:15:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<u4SXphhGvpo+PIdq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.117
country_id: 1819730
description:
Dec 17 03:16:48 host2 sshd[1518005]: Disconnected from invalid user storage 152.32.172.117 port 57606 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 03:17:48 host2 sshd[1518550]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 03:17:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<2dVNrhhGxJ8+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec 17 03:18:52 host2 sshd[1519030]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 63693


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec 17 03:19:09 host2 sshd[1519189]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 64439


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 17 03:19:38 host2 sshd[1519411]: Disconnected from invalid user runner 198.98.56.227 port 50390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 17 03:20:16 host2 sshd[1519933]: Disconnected from invalid user mrodelo 198.98.56.227 port 36400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 03:21:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<FAK3uxhG2Os+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.117
country_id: 1819730
description:
Dec 17 03:21:53 host2 sshd[1520948]: Disconnected from invalid user me 152.32.172.117 port 40364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Dec 17 03:22:15 host2 sshd[1521156]: Disconnected from invalid user ociispth 9.223.176.221 port 42370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Dec 17 03:22:54 host2 sshd[1521390]: Disconnected from invalid user admin1 9.223.176.221 port 44880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 03:23:24 host2 sshd[1521626]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 51830


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.117
country_id: 1819730
description:
Dec 17 03:23:39 host2 sshd[1521736]: Disconnected from invalid user www-data 152.32.172.117 port 36028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.117
country_id: 1819730
description:
Dec 17 03:24:48 host2 sshd[1522293]: Disconnected from invalid user ociispth 152.32.172.117 port 41236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-17 03:27:17 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:38064: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec 17 03:27:19 host2 sshd[1524187]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 19507


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-17 03:27:26 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:47483: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 03:28:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<KsYV0xhGXtg+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.87
country_id: 597427
description:
2025-12-17 03:28:20 dovecot_login authenticator failed for (ADMIN) [194.32.122.87]:56372: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Dec 17 03:27:56 host2 sshd[1524525]: Disconnected from invalid user www-data 9.223.176.221 port 56898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 9.223.176.221
country_id: 2661886
description:
Dec 17 03:29:29 host2 sshd[1525375]: Disconnected from invalid user mrodelo 9.223.176.221 port 33494 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.25
country_id: 6252001
description:
Dec 17 03:35:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.125.25, lip=66.85.158.91, TLS, session=<C73l7RhGmpcNWX0Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.36
country_id: 1861060
description:
2025-12-17 03:37:17 dovecot_login authenticator failed for (ADMIN) [149.22.87.36]:5396: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-17 03:40:44 dovecot_plain authenticator failed for (unding) [91.73.188.251]:50414: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 03:40:45 host2 sshd[1533264]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 57416


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 17 03:40:55 host2 sshd[1533326]: Disconnected from invalid user sandbox 103.187.165.26 port 41918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-17 03:42:01 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (agerom) [174.169.224.27]:56238: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.99.31
country_id: 1861060
description:
Dec 17 03:43:18 host2 sshd[1534555]: Disconnected from invalid user gaurav 163.44.99.31 port 51634 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 17 03:44:50 host2 sshd[1535417]: Disconnected from invalid user xiaolin 162.240.212.247 port 38172 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 03:43:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<8dMfCxlGwO0+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.99.31
country_id: 1861060
description:
Dec 17 03:44:34 host2 sshd[1535296]: Disconnected from invalid user ubuntu 163.44.99.31 port 34818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 17 03:45:07 host2 sshd[1535908]: Disconnected from invalid user waleed 103.187.165.26 port 36966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 17 03:45:21 host2 sshd[1536529]: Disconnected from invalid user lighthouse 162.240.212.247 port 51996 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.44.99.31
country_id: 1861060
description:
Dec 17 03:46:20 host2 sshd[1537526]: Disconnected from invalid user alex 163.44.99.31 port 42964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 17 03:47:31 host2 sshd[1538754]: Disconnected from invalid user lighthouse 103.187.165.26 port 44030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 03:48:10 host2 sshd[1539376]: Disconnected from invalid user stefanie 62.60.131.157 port 32373 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-17 03:48:16 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (tionia) [71.62.34.216]:36856: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 17 03:48:47 host2 sshd[1539793]: Disconnected from invalid user admin 162.240.212.247 port 50302 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-17 03:49:43 dovecot_plain authenticator failed for (exturacost) [65.20.129.28]:56123: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.20.206
country_id: 6252001
description:
Dec 17 03:52:45 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.20.206, lip=66.85.158.92, TLS, session=<trW/KhlGwJkUoxTO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.4
country_id: 3175395
description:
2025-12-17 03:54:13 dovecot_login authenticator failed for (ADMIN) [156.146.41.4]:44334: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-17 03:54:18 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (trosining) [67.173.58.47]:46080: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-17 03:55:15 dovecot_login authenticator failed for (GH3UWJzBWE) [69.5.189.21]:50825: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-17 03:56:03 dovecot_login authenticator failed for (yKmMSWx) [69.5.189.21]:63527: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 03:57:10 host2 sshd[1547328]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-17 03:57:09 dovecot_login authenticator failed for (XX6yKQxVbM) [69.5.189.21]:54911: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 03:57:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<YCnPPBlG0sgDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 03:59:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hBUrQhlG2N4DjyE/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 03:59:24 host2 pure-ftpd[1549298]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:00:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<dMYeRhlGlooDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 17 04:01:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<loiaSRlGsv/CpRCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-17 04:01:28 dovecot_plain authenticator failed for (veril) [64.72.74.162]:40534: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:02:02 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<1874SxlGRt4DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-17 04:03:07 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (plizzlik) [73.197.236.163]:50480: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-17 04:03:02 dovecot_plain authenticator failed for (unfelly) [5.32.99.14]:60140: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:04:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<4qBAUxlG/IADjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.130
country_id: 6252001
description:
2025-12-17 04:05:59 dovecot_login authenticator failed for (ADMIN) [191.96.37.130]:20693: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:06:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lTYNWxlGRrEDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:06:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<kwN5XRlGPMIDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:07:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<Q84lYRlGuqkDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 04:15:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<0AcSfBlGxsI+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.1
country_id: 798549
description:
Dec 17 04:15:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.1, lip=66.85.158.91, session=<r+LifBlGjIVV2ZUB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 04:18:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=</R8DhRlGiKI+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2025-12-17 04:18:05 dovecot_login authenticator failed for ([149.54.62.66]) [149.54.62.66]:39660: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-17 04:18:39 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:48844: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-17 04:18:52 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:59846: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-17 04:19:05 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:58929: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 04:20:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<dyiHjRlG+MM+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.199.81.100
country_id: 6252001
description:
Dec 17 04:20:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.199.81.100, lip=66.85.158.91, session=<b5UwjhlGqJPGx1Fk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.160
country_id: 2658434
description:
2025-12-17 04:21:01 dovecot_login authenticator failed for (ADMIN) [158.173.152.160]:34698: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 04:23:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<lxRymRlGbMU+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 04:23:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<iSIJmhlGKMM+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 04:24:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<119bnRlG5r0+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-17 04:25:40 dovecot_plain authenticator failed for (umman) [65.20.149.93]:46191: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.24.98
country_id: 2635167
description:
2025-12-17 04:27:26 dovecot_login authenticator failed for (ADMIN) [158.173.24.98]:63643: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-17 04:28:33 dovecot_plain authenticator failed for (jaybly) [96.85.104.2]:49394: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Dec 17 04:27:57 host2 sshd[1578646]: Disconnected from invalid user bot 103.49.238.104 port 55760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec 17 04:29:40 host2 sshd[1579716]: Disconnected from invalid user user 45.78.230.104 port 38232 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.78.30
country_id: 2921044
description:
Dec 17 04:31:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.232.78.30, lip=66.85.158.92, TLS handshaking: Connection closed, session=<mEEXtBlGJP+l6E4e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-17 04:33:01 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (coetion) [68.40.189.43]:45372: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.54.213
country_id: 6252001
description:
Dec 17 04:33:04 host2 pure-ftpd[1581584]: (?@161.35.54.213) [INFO] New connection from 161.35.54.213


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.74.239.125
country_id: 1643084
description:
Dec 17 04:33:55 host2 sshd[1582093]: Disconnected from invalid user hasan 202.74.239.125 port 40450 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.104
country_id: 1643084
description:
Dec 17 04:35:14 host2 sshd[1583055]: Disconnected from invalid user ftptest 103.49.238.104 port 58738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 17 04:34:59 host2 sshd[1582708]: Disconnected from invalid user admin 45.40.57.41 port 39504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Dec 17 04:36:25 host2 sshd[1583899]: Disconnected from invalid user myftp 103.49.238.104 port 54248 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 17 04:36:39 host2 sshd[1584023]: Disconnected from invalid user drcom 103.144.28.85 port 47648 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-17 04:36:51 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (brost) [174.166.153.20]:34588: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 17 04:36:08 host2 sshd[1583774]: Disconnected from invalid user nominatim 103.144.28.85 port 35320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 17 04:37:24 host2 sshd[1584375]: Disconnected from invalid user ubuntu 45.40.57.41 port 45854 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.64.106.222
country_id: 6252001
description:
Dec 17 04:37:33 host2 pure-ftpd[1584437]: (?@20.64.106.222) [INFO] New connection from 20.64.106.222


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 17 04:37:41 host2 sshd[1584497]: Disconnected from invalid user ubuntu 103.144.28.85 port 44072 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 17 04:38:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, session=<b66LzBlGtP/CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.74.239.125
country_id: 1643084
description:
Dec 17 04:38:19 host2 sshd[1584806]: Disconnected from invalid user user1 202.74.239.125 port 52074 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 17 04:39:53 host2 sshd[1585537]: Disconnected from invalid user bot 45.40.57.41 port 37766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2025-12-17 04:40:05 dovecot_login authenticator failed for (cm-84.213.187.240.get.no) [84.213.187.240]:59081: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-12-17 04:40:27 dovecot_login authenticator failed for (host253.181-93-60.telecom.net.ar) [181.93.60.253]:57171: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 17 04:40:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<tMt41hlGkJk+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.140
country_id: 3077311
description:
2025-12-17 04:41:57 dovecot_login authenticator failed for (ADMIN) [212.102.39.140]:45429: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.249.61.124
country_id: 298795
description:
Dec 17 04:43:15 host2 sshd[1587536]: Disconnected from invalid user admin 92.249.61.124 port 42208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.251.80
country_id: 2921044
description:
Dec 17 04:45:14 host2 sshd[1589019]: Disconnected from invalid user profe 164.92.251.80 port 40422 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.31
country_id: 3042058
description:
2025-12-17 04:47:50 dovecot_login authenticator failed for (ADMIN) [91.90.122.31]:16360: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 04:48:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<6x6X8BlGKs4+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2025-12-17 04:48:22 dovecot_plain authenticator failed for cm-72-241-202-104.buckeyecom.net (tatules) [72.241.202.104]:55637: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-17 04:51:20 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (jacent) [73.144.27.228]:58142: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 04:52:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<qlSrABpGHr4+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.10.47.6
country_id: 1643084
description:
Dec 17 04:53:33 host2 sshd[1594209]: Disconnected from invalid user redmine 114.10.47.6 port 19446 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.251.80
country_id: 2921044
description:
Dec 17 04:53:18 host2 sshd[1594115]: Disconnected from invalid user acct 164.92.251.80 port 45978 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 114.10.47.6
country_id: 1643084
description:
Dec 17 04:54:51 host2 sshd[1595426]: Disconnected from invalid user hadoop 114.10.47.6 port 19448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Dec 17 04:55:34 host2 sshd[1596289]: Disconnected from invalid user group1 103.143.238.173 port 54940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec 17 04:55:43 host2 sshd[1596317]: Disconnected from invalid user admin 45.78.230.104 port 53436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Dec 17 04:56:11 host2 sshd[1596951]: Disconnected from invalid user www 179.32.33.161 port 54580 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.33.161
country_id: 3686110
description:
Dec 17 04:56:49 host2 sshd[1597269]: Disconnected from invalid user flip 179.32.33.161 port 40514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Dec 17 04:57:15 host2 sshd[1597531]: Disconnected from invalid user ivan 103.143.238.173 port 36462 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 04:57:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<o12PERpGxq8+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Dec 17 04:57:49 host2 sshd[1597804]: Disconnected from invalid user sandra 103.25.47.94 port 40440 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.147.238.48
country_id: 3996063
description:
Dec 17 04:59:04 host2 sshd[1598692]: Disconnected from invalid user cloud 189.147.238.48 port 59004 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 05:01:09 host2 pure-ftpd[1600293]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.186.155
country_id: 6252001
description:
Dec 17 05:03:40 host2 pure-ftpd[1601801]: (?@40.124.186.155) [INFO] New connection from 40.124.186.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.171
country_id: 2921044
description:
2025-12-17 05:04:33 dovecot_login authenticator failed for (ADMIN) [191.101.157.171]:48406: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 05:05:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=</nOvLxpGTrc+PIcf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 05:05:59 host2 sshd[1603285]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 05:06:48 host2 sshd[1603887]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 56023


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 05:05:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<Y76JMBpG0tk+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.19
country_id: 289688
description:
2025-12-17 05:07:14 dovecot_login authenticator failed for (ADMIN) [95.181.234.19]:56454: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 05:07:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<yXrQNhpGLL0+PIce>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.204.25
country_id: 6251999
description:
Dec 17 05:12:24 host2 pure-ftpd[1607654]: (?@128.203.204.25) [INFO] New connection from 128.203.204.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 05:19:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<R5y1YRpGXqg+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 05:22:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<p0/IahpG/Ok+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 05:23:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<AK9abRpGeos+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 05:24:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<eNSxchpGMM8+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 05:24:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<UhsxcxpGeMY+PIcs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 05:25:09 host2 sshd[1616569]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.76
country_id: 1668284
description:
2025-12-17 05:24:56 dovecot_login authenticator failed for (ADMIN) [173.244.49.76]:33390: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 05:25:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<xp+BdhpGirI+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 05:25:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Zd6qdhpG3MY+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-17 05:25:35 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (aptaint) [68.52.119.193]:41410: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.20
country_id: 6252001
description:
2025-12-17 05:27:46 dovecot_login authenticator failed for (ADMIN) [191.96.67.20]:46824: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-17 05:27:57 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (tuley) [68.60.77.128]:38020: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 05:29:02 host2 sshd[1619332]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 53723


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-12-17 05:29:02 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.171.79.194
country_id: 3686110
description:
Dec 17 05:33:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 11 secs): user=<httpssmtp.zoho.com587hr>, method=PLAIN, rip=190.171.79.194, lip=66.85.158.91, TLS, session=<wBILkxpG35G+q0/C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.70
country_id: 690791
description:
Dec 17 05:33:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<httpssmtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=194.44.140.70, lip=66.85.158.91, TLS, session=<H8yjkBpG6oTCLIxG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.72
country_id: 798544
description:
Dec 17 05:33:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 19 secs): user=<httpssmtp.zoho.com587hr>, method=LOGIN, rip=91.228.33.72, lip=66.85.158.91, session=<Ob3TkRpGKg5b5CFI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-17 05:33:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (catity) [87.103.126.54]:41584: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 05:39:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<jzBEqRpGJKc+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-17 05:40:53 dovecot_plain authenticator failed for (fismilly) [173.25.186.130]:63709: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-17 05:41:08 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:52362: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-17 05:41:28 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:44014: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.28
country_id: 3017382
description:
2025-12-17 05:41:31 dovecot_login authenticator failed for (ADMIN) [191.101.31.28]:31836: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-12-17 05:41:56 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:44334: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 17 05:43:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<dTjotRpGQMXBHmEh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 05:44:08 host2 sshd[1630782]: Disconnected from invalid user user 2.57.121.25 port 17268 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 05:46:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<9NbHwBpGRKk+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-17 05:50:06 dovecot_plain authenticator failed for (asitivelly) [92.62.243.174]:35123: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.144
country_id: 2635167
description:
Dec 17 05:52:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.144, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<sW8Q1xpGbbpX7LCQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.18
country_id: 2635167
description:
Dec 17 05:52:30 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.18, lip=66.85.158.91, TLS, session=<iSL51hpGzZm594kS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.110
country_id: 2635167
description:
Dec 17 05:53:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.110, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<lhcH2xpG66a594lu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.128
country_id: 2635167
description:
Dec 17 05:53:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.128, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4NYL2RpGxaBX7LCA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.52
country_id: 6251999
description:
2025-12-17 05:54:11 dovecot_login authenticator failed for (ADMIN) [212.56.49.52]:6683: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.130
country_id: 2635167
description:
Dec 17 05:54:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.130, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<Gcb93hpGk7JX7LCC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.119
country_id: 2635167
description:
Dec 17 05:54:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.119, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<MWYC3RpGIc2594l3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.127
country_id: 2635167
description:
Dec 17 05:55:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.127, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yC734BpGrYG594l/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.138
country_id: 2635167
description:
Dec 17 05:55:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.138, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Bm/04hpGLci594mK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 05:56:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<jjFD5BpGFLI+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.129
country_id: 2635167
description:
Dec 17 05:56:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.129, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<INTv5BpGdZ6594mB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 05:56:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<PWUP5hpGdrA+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.116
country_id: 2635167
description:
Dec 17 05:56:57 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.116, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<00bp5hpGC9VX7LB0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.114
country_id: 2635167
description:
Dec 17 05:57:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.114, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<wqPk6BpGt6BX7LBy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.193.6.184
country_id: 6251999
description:
2025-12-17 05:58:21 dovecot_login authenticator failed for (ADMIN) [91.193.6.184]:55810: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 17 05:58:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<mxYz7RpGcs4+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 05:59:00 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64706: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 05:59:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<5r8h8RpG3IM+PIdj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 06:02:50 host2 pure-ftpd[1643678]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 06:03:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<UbCh/BpGatk+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 06:04:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<U3B7ABtGTKI+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 06:04:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<TcjwABtGyKE+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.243.106.218
country_id: 2802361
description:
2025-12-17 06:07:27 dovecot_plain authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be (exorseyl) [81.243.106.218]:50514: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 17 06:10:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<QPinGBtGpII+PIdn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-17 06:11:29 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (exprep) [71.224.169.28]:47508: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.81.170.119
country_id: 4566966
description:
2025-12-17 06:12:10 dovecot_login authenticator failed for ([208.81.170.119]) [208.81.170.119]:23973: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-17 06:12:45 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:33366: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.21.29
country_id: 2750405
description:
2025-12-17 06:12:52 dovecot_login authenticator failed for (ADMIN) [158.173.21.29]:31930: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.12
country_id: 2264397
description:
2025-12-17 06:13:53 dovecot_login authenticator failed for (ADMIN) [146.70.59.12]:8291: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2025-12-17 06:15:42 dovecot_login authenticator failed for ([58.136.207.202]) [58.136.207.202]:45539: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-17 06:15:09 dovecot_login authenticator failed for ([84.211.12.159]) [84.211.12.159]:43107: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2025-12-17 06:15:26 dovecot_login authenticator failed for pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:58324: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-12-17 06:15:31 dovecot_login authenticator failed for ([27.123.114.190]) [27.123.114.190]:60124: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-17 06:16:02 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (bilia) [66.177.30.53]:35210: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 06:16:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Ny5+KxtGftE+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.151.46.98
country_id: 1861060
description:
2025-12-17 06:18:36 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [45.151.46.98]:7983: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 06:19:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<p5JCNhtGrtI+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.17
country_id: 798549
description:
Dec 17 06:19:44 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.17, lip=66.85.158.92, session=<mMtrOBtGnJ9V2ZUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-17 06:18:58 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:35978: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.4
country_id: 2750405
description:
Dec 17 06:20:43 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=31.14.32.4, lip=66.85.158.92, session=<RAboOxtGLp4fDiAE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-17 06:22:03 dovecot_login authenticator failed for (syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:39262: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-17 06:22:27 dovecot_login authenticator failed for ([125.16.246.121]) [182.95.63.50]:41622: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.63.99
country_id: 6252001
description:
Dec 17 06:24:46 host2 sshd[1661381]: Disconnected from invalid user share 35.237.63.99 port 55230 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-17 06:26:13 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (natifers) [98.222.93.199]:48510: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-17 06:26:49 dovecot_plain authenticator failed for (finalty) [65.20.133.4]:35257: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.110.13.58
country_id: 2635167
description:
2025-12-17 06:27:26 dovecot_login authenticator failed for (ADMIN) [194.110.13.58]:1634: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.237.63.99
country_id: 6252001
description:
Dec 17 06:29:16 host2 sshd[1665557]: Disconnected from invalid user dev 35.237.63.99 port 37040 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Dec 17 06:29:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.118, lip=66.85.158.91, TLS: Connection closed, session=<bI7CWRtGOIZChJl2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.63.99
country_id: 6252001
description:
Dec 17 06:32:36 host2 sshd[1668888]: Disconnected from invalid user rootuser 35.237.63.99 port 36680 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.166
country_id: 3017382
description:
Dec 17 06:33:31 host2 pure-ftpd[1669644]: (?@91.196.152.166) [INFO] New connection from 91.196.152.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-17 06:35:49 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (bactic) [73.230.86.50]:44754: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 06:36:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<onDAdRtGitU+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.29
country_id: 2264397
description:
2025-12-17 06:39:50 dovecot_login authenticator failed for (ADMIN) [146.70.59.29]:13536: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 06:42:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<lEeOiRtGoJQ+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.237
country_id: 718075
description:
2025-12-17 06:45:29 dovecot_login authenticator failed for (ADMIN) [185.225.28.237]:22080: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-17 06:46:35 dovecot_login authenticator failed for ([209.23.72.121]) [209.23.72.121]:57168: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 06:47:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<mEPFmxtGbsI+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-17 06:46:56 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:45406: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-17 06:49:15 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:39351: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.160
country_id: 6252001
description:
2025-12-17 06:49:50 dovecot_login authenticator failed for wsip-184-191-250-160.fv.ks.cox.net [184.191.250.160]:59799: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 06:54:29 host2 sshd[1686173]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec 17 06:54:31 host2 sshd[1686199]: Disconnected from invalid user wms 179.51.153.37 port 51288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-17 06:55:47 dovecot_plain authenticator failed for (inflobus) [65.20.153.146]:46630: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 17 06:56:53 host2 sshd[1688155]: Disconnected from invalid user test 103.172.204.220 port 40886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.27
country_id: 6252001
description:
2025-12-17 06:57:39 dovecot_login authenticator failed for (ADMIN) [181.214.165.27]:12205: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.30.100
country_id: 1269750
description:
Dec 17 06:58:39 host2 sshd[1689175]: Disconnected from invalid user mosquitto 122.160.30.100 port 11314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec 17 06:59:38 host2 sshd[1689735]: Disconnected from invalid user user 179.51.153.37 port 36326 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.160.30.100
country_id: 1269750
description:
Dec 17 06:59:55 host2 sshd[1689880]: Disconnected from invalid user robot 122.160.30.100 port 24621 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 07:01:48 host2 sshd[1691236]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-17 07:01:09 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (sking) [73.68.220.15]:34858: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec 17 07:02:31 host2 sshd[1691739]: Disconnected from invalid user php 179.51.153.37 port 41918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 07:04:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<GGHx1htGXt8+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.30.100
country_id: 1269750
description:
Dec 17 07:04:21 host2 sshd[1693854]: Disconnected from invalid user minecraft 122.160.30.100 port 60364 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 17 07:04:41 host2 sshd[1694060]: Disconnected from invalid user php 103.172.204.220 port 60828 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 07:04:42 host2 pure-ftpd[1694080]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 17 07:05:31 host2 sshd[1694746]: Disconnected from invalid user ubuntu 103.172.204.220 port 39168 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 07:04:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<efLj2RtGjKg+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-17 07:04:56 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (pufted) [73.176.157.57]:42020: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-17 07:10:37 dovecot_plain authenticator failed for (wrogibrics) [65.20.250.163]:53621: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-17 07:10:47 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (surlic) [76.145.10.140]:45982: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2025-12-17 07:11:11 dovecot_login authenticator failed for ([177.236.144.20]) [177.236.144.20]:58306: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-17 07:11:13 dovecot_login authenticator failed for (45.168.140-35.smartlinkfibra.com.br) [45.168.140.35]:38827: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 07:11:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<9CS38BtGorI+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.217.74
country_id: 3996063
description:
2025-12-17 07:11:33 dovecot_login authenticator failed for (201.173.217.74-clientes-izzi.mx) [201.173.217.74]:51706: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-17 07:11:34 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:60724: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-17 07:12:01 dovecot_plain authenticator failed for (upfulate) [38.248.111.238]:52363: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 17 07:13:23 host2 sshd[1700144]: Disconnected from invalid user nikolay 182.253.79.194 port 5241 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Dec 17 07:13:34 host2 sshd[1700371]: Disconnected from invalid user test 45.78.200.2 port 52838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 07:15:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<dsUQ/htG1Kg+PIdp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 17 07:14:43 host2 sshd[1701215]: Disconnected from invalid user test 182.253.79.194 port 48531 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 17 07:15:54 host2 sshd[1702159]: Disconnected from invalid user debian 182.253.79.194 port 4200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 17 07:16:29 host2 sshd[1702563]: Disconnected from invalid user ftp_user 182.253.79.194 port 1204 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.233
country_id: 6252001
description:
Dec 17 07:17:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.233, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<pRflBRxG7cbN0h/p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 07:19:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ezyADBxG2rc+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 07:20:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<1u/YEBxGsKE+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 07:21:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<kbb7ExxGhKA+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 07:22:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Kqz4GRxGjus+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.76
country_id: 6252001
description:
2025-12-17 07:23:11 dovecot_login authenticator failed for (ADMIN) [181.41.206.76]:27976: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.200.2
country_id: 1880251
description:
Dec 17 07:24:01 host2 sshd[1707312]: Disconnected from invalid user botuser 45.78.200.2 port 48672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 07:28:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<agW8LxxG7sI+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 07:30:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<NoOPNBxGso4+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 07:37:15 host2 sshd[1717223]: Disconnected from invalid user brooks 62.60.131.157 port 36469 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.24.12
country_id: 1880251
description:
2025-12-17 07:42:05 dovecot_login authenticator failed for (ADMIN) [138.199.24.12]:47922: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-17 07:43:08 dovecot_login authenticator failed for ([182.95.115.194]) [182.95.115.194]:43208: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-17 07:43:20 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:52384: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-17 07:44:07 dovecot_plain authenticator failed for c-75-74-211-27.hsd1.fl.comcast.net (sostally) [75.74.211.27]:53585: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-17 07:49:00 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (cosite) [71.235.225.181]:34328: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 07:49:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<ne/iehxGYqI+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.10
country_id: 1227603
description:
2025-12-17 07:50:22 dovecot_login authenticator failed for (ADMIN) [95.181.239.10]:44500: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 17 07:53:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<PtO8hxxGzJ4+PIdn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 07:54:15 host2 sshd[1728923]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 07:54:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<FKkYixxGsro+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 17 07:59:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<At80nhxGwqc+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-17 07:59:44 dovecot_plain authenticator failed for (thich) [187.161.198.68]:54797: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 08:03:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0TWjqxxGiMI+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.77
country_id: 6252001
description:
Dec 17 08:04:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.149.77, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<0guMsBxGb8ei2JVN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.225.95.233
country_id: 6252001
description:
Dec 17 08:05:30 host2 sshd[1736242]: Disconnected from invalid user sammy 35.225.95.233 port 53932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 08:05:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<7d4wsxxGvNs+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.77
country_id: 6252001
description:
Dec 17 08:05:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=162.216.149.77, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<s6gItBxGpPui2JVN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-17 08:05:57 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:52494: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Dec 17 08:06:00 host2 sshd[1736584]: Disconnected from invalid user system 175.100.24.139 port 34124 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.77
country_id: 6252001
description:
Dec 17 08:06:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.149.77, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<qOpatRxGdu2i2JVN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-17 08:06:15 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:57684: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 08:06:40 host2 pure-ftpd[1736916]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.100.24.139
country_id: 1831722
description:
Dec 17 08:07:20 host2 sshd[1737221]: Disconnected from invalid user afa 175.100.24.139 port 58414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 17 08:08:22 host2 sshd[1737719]: Disconnected from invalid user sammy 187.210.77.100 port 37528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 17 08:10:43 host2 sshd[1739187]: Disconnected from invalid user wj 68.218.72.173 port 59014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.75.216.74
country_id: 1269750
description:
Dec 17 08:11:42 host2 sshd[1739672]: Disconnected from invalid user kafka 182.75.216.74 port 33403 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.77
country_id: 6252001
description:
Dec 17 08:11:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.77, lip=66.85.158.91, TLS, session=<YsUKyRxGDOui2JVN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 17 08:12:49 host2 sshd[1740259]: Disconnected from invalid user afa 68.218.72.173 port 37424 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.77
country_id: 6252001
description:
Dec 17 08:12:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.149.77, lip=66.85.158.91, TLS, session=<FDdEzRxGgvei2JVN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 08:14:30 host2 sshd[1741180]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.225.95.233
country_id: 6252001
description:
Dec 17 08:14:54 host2 sshd[1741481]: Disconnected from invalid user teamspeak 35.225.95.233 port 38284 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.75.216.74
country_id: 1269750
description:
Dec 17 08:14:16 host2 sshd[1741060]: Disconnected from invalid user consultor 182.75.216.74 port 31797 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-17 08:16:15 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:43631: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2025-12-17 08:16:35 dovecot_login authenticator failed for (cm-84.213.189.178.get.no) [84.213.189.178]:34594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.114.35
country_id: 1269750
description:
2025-12-17 08:16:37 dovecot_plain authenticator failed for (jocium) [103.69.114.35]:46725: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 08:16:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<zQES2xxGbtQ+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-12-17 08:16:59 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:46792: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 08:18:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<V99p3xxGuJo+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-12-17 08:17:17 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:59958: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.234.124.206
country_id: 6252001
description:
Dec 17 08:18:58 host2 pure-ftpd[1744003]: (?@104.234.124.206) [INFO] New connection from 104.234.124.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.234.124.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.234.124.206 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 17 08:19:15 host2 sshd[1744157]: Disconnected from invalid user demo 187.210.77.100 port 60982 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-17 08:20:33 dovecot_plain authenticator failed for (eptioneste) [65.20.174.63]:44234: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.77.115
country_id: 1269750
description:
2025-12-17 08:21:34 dovecot_login authenticator failed for ([103.220.16.51]) [117.247.77.115]:54298: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-17 08:21:46 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (galanic) [71.62.34.216]:47780: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-17 08:21:52 dovecot_login authenticator failed for ([46.212.127.128]) [46.212.127.128]:46783: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 08:22:41 host2 sshd[1747047]: Disconnected from invalid user user 2.57.121.25 port 38235 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 08:23:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<HwCW8hxGcIg+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.175
country_id: 6252001
description:
Dec 17 08:24:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.175, lip=66.85.158.91, TLS, session=<nKtN9RxGGOvN0h+v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.163
country_id: 1562822
description:
2025-12-17 08:24:42 dovecot_login authenticator failed for (ADMIN) [173.239.247.163]:5504: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 17 08:28:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<IFJgBB1GxJI+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.168
country_id: 6252001
description:
Dec 17 08:29:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.168, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<DuWuCR1GgcTN0h+o>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.216.180.11
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.216.180.11: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-17 08:31:47 dovecot_plain authenticator failed for (spiessicus) [102.53.15.180]:56488: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-17 08:31:51 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (gariummal) [81.225.30.107]:46145: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 08:39:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<jUQ2Kx1GBOo+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:40:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<+9h5Lx1GfLYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.123.230
country_id: 6252001
description:
2025-12-17 08:40:23 dovecot_login authenticator failed for (ADMIN) [151.241.123.230]:38334: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 08:43:02 host2 sshd[1759254]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:42:37 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<4t1gNx1GsqQDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.115.196
country_id: 1643084
description:
Dec 17 08:43:35 host2 sshd[1759600]: Disconnected from invalid user hw 103.174.115.196 port 37582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Dec 17 08:44:16 host2 sshd[1760153]: Disconnected from invalid user admin 103.174.115.196 port 43332 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:44:36 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<a1x/Ph1GTKEDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.122.109
country_id: 6252001
description:
2025-12-17 08:45:37 dovecot_login authenticator failed for (ADMIN) [151.241.122.109]:4163: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-17 08:46:21 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (pitaccing) [98.227.25.115]:34322: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:46:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<MuWERR1GMtwDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:46:51 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<xPuGRh1GzuoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:48:12 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<FapWSx1G5rcDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:49:06 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<9PWNTh1G0rEDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:48:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<Q9iMTR1GQJADhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 08:50:21 host2 sshd[1765827]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:50:25 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<j25EUx1GiosDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-17 08:51:24 dovecot_plain authenticator failed for (subdowist) [102.53.15.18]:51358: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-17 08:53:50 dovecot_plain authenticator failed for (naselabasm) [38.248.111.238]:50037: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 08:55:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<yVEBZR1G2ug+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 08:56:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<F7lUah1Gpsk+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 08:57:41 host2 sshd[1770577]: Disconnected from invalid user matt 37.32.10.237 port 54186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 09:01:03 host2 sshd[1772545]: Disconnected from invalid user ubuntu 37.32.10.237 port 37260 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.138
country_id: 6252001
description:
Dec 17 09:01:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.138, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mwoxex1GrtKTuYSK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 09:02:08 host2 sshd[1773213]: Disconnected from invalid user roman 37.32.10.237 port 38790 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 09:03:12 host2 sshd[1773949]: Received disconnect from 37.32.10.237 port 51984:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 09:03:12 host2 sshd[1773949]: Disconnected from invalid user support 37.32.10.237 port 51984 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec 17 09:03:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS, session=<2lI+gR1GgP1ChJmI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 09:03:44 host2 sshd[1774333]: Disconnected from invalid user debian 37.32.10.237 port 47570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 09:04:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<i7gMhB1G3Nc+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.39.151
country_id: 6252001
description:
2025-12-17 09:05:31 dovecot_login authenticator failed for (ADMIN) [156.146.39.151]:35025: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.111
country_id: 6251999
description:
2025-12-17 09:06:25 dovecot_login authenticator failed for (ADMIN) [212.56.52.111]:50890: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Dec 17 09:07:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.6, lip=66.85.158.91, TLS: Connection closed, session=<Qlyvjh1GPILCpGsG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-17 09:07:11 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (conic) [24.23.125.83]:47898: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-17 09:07:34 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (grayrated) [78.68.37.25]:49329: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 09:08:35 host2 pure-ftpd[1777545]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.8
country_id: 1880251
description:
Dec 17 09:12:12 host2 sshd[1779871]: Disconnected from invalid user roman 45.78.221.8 port 51668 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 09:20:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<ZEThvh1Gdsc+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 09:22:03 host2 sshd[1786071]: Disconnected from invalid user conrad 62.60.131.157 port 63007 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-17 09:22:31 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (kinonal) [196.47.172.253]:40716: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-17 09:23:15 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (distical) [85.225.19.144]:58343: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.55
country_id: 3144096
description:
2025-12-17 09:24:12 dovecot_login authenticator failed for (cm-84.213.190.55.get.no) [84.213.190.55]:44517: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.27
country_id: 3057568
description:
2025-12-17 09:24:15 dovecot_login authenticator failed for (ADMIN) [149.102.232.27]:2339: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2025-12-17 09:24:26 dovecot_login authenticator failed for pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:54543: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 09:27:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<yRVO1x1G2JU+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 09:28:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<yWOe2x1Ggro+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 09:30:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<xjn94R1Gxqk+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.68
country_id: 2921044
description:
2025-12-17 09:36:11 dovecot_login authenticator failed for (ADMIN) [212.102.57.68]:54977: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 09:39:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56355: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-17 09:40:29 dovecot_plain authenticator failed for (episteep) [38.248.111.238]:35248: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-12-17 09:48:51 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:59863: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-17 09:53:15 dovecot_plain authenticator failed for (mostish) [65.20.250.163]:60452: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 09:55:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<oIwPPR5GWsY+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.162.7
country_id: 290557
description:
2025-12-17 09:58:11 dovecot_login authenticator failed for (ADMIN) [217.138.162.7]:33911: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-17 09:59:19 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:44480: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 09:59:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<kNbGSR5Gzo4+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-17 10:00:13 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:33888: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 10:06:20 host2 sshd[1818177]: Disconnected from invalid user greyson 62.60.131.157 port 59325 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-17 10:07:36 dovecot_plain authenticator failed for (pyrress) [65.20.133.4]:44758: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 10:07:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<PtngZx5GHOI+PIcm>


