# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-12-25 07:32:06 dovecot_login authenticator failed for H=(mamanguape.static.gvt.net.br) [177.207.248.5]:59033: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.6
country_id: 1819730
description:
2025-12-25 07:32:19 dovecot_login authenticator failed for H=(m121-202-152-6.smartone.com) [121.202.152.6]:45230: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2025-12-25 07:32:22 dovecot_login authenticator failed for H=(nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:57302: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-12-25 07:32:37 dovecot_login authenticator failed for H=96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:55824: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-25 07:32:38 dovecot_login authenticator failed for H=(221-169-97-62.cust.smartcall.no) [62.97.169.221]:49259: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.39
country_id: 2186224
description:
2025-12-25 07:32:45 dovecot_login authenticator failed for H=([121.73.163.39]) [121.73.163.39]:38422: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.57.123.166
country_id: 2510769
description:
2025-12-25 07:33:12 dovecot_login authenticator failed for H=166.red-195-57-123.staticip.rima-tde.net [195.57.123.166]:15777: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-25 07:39:25 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:47282: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-25 07:39:45 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:55958: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-25 07:41:46 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:51069: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-25 07:44:07 dovecot_login authenticator failed for H=(cm-84.211.6.119.get.no) [84.211.6.119]:52748: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.69.147
country_id: 3374766
description:
2025-12-25 07:43:50 dovecot_login authenticator failed for H=([154.203.69.147]) [154.203.69.147]:59794: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.255.165
country_id: 2661886
description:
2025-12-25 07:45:51 dovecot_login authenticator failed for H=c188-148-255-165.bredband.tele2.se [188.148.255.165]:46776: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 166.88.171.166
country_id: 6252001
description:
[2025-12-25 07:45:38 +0530] info [webmaild] 166.88.171.166 - info@agronatureholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 07:47:47 host2 sshd[3159961]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-25 07:47:45 dovecot_login authenticator failed for H=([182.75.215.245]) [182.75.215.245]:56428: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.230
country_id: 6252001
description:
Dec 25 08:00:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.230, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KvfTj71Gp8vG6xjm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2025-12-25 08:01:06 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:54013: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.174.253
country_id: 3017382
description:
2025-12-25 08:05:27 dovecot_login authenticator failed for H=mastergateway.ville-saint-louis.fr [212.51.174.253]:51966: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-12-25 08:05:50 dovecot_login authenticator failed for H=([182.95.22.208]) [125.23.228.86]:42032: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.148.232.123
country_id: 294640
description:
[2025-12-25 08:06:13 +0530] info [webmaild] 45.148.232.123 - info@dataesite.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.148
country_id: 6252001
description:
Dec 25 08:10:37 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=18.97.19.148, lip=66.85.158.92, session=<i6Sws71GoqASYROU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-25 08:10:53 dovecot_login authenticator failed for H=(nsg-static-177.160.71.182.airtel.in) [182.95.63.10]:58408: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-25 08:11:07 dovecot_login authenticator failed for H=([120.157.13.61]) [120.157.13.61]:38284: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 08:22:07 host2 pure-ftpd[3189780]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Dec 25 08:22:46 host2 sshd[3190349]: Disconnected from invalid user ftpadmin 172.174.5.146 port 22652 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.121.43
country_id: 3144096
description:
2025-12-25 08:23:03 dovecot_login authenticator failed for H=(cm-178.232.121.43.get.no) [178.232.121.43]:47227: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-25 08:23:15 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:51926: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Dec 25 08:25:07 host2 sshd[3192686]: Disconnected from invalid user docker 172.174.5.146 port 50928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.174.5.146
country_id: 6252001
description:
Dec 25 08:31:14 host2 sshd[3198289]: Disconnected from invalid user test01 172.174.5.146 port 65131 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.174.5.146
country_id: 6252001
description:
Dec 25 08:33:43 host2 sshd[3199992]: Disconnected from invalid user user 172.174.5.146 port 36911 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 25 08:35:01 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.91, session=<m6XpCr5GapMs3lFz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.135.37
country_id: 1269750
description:
Dec 25 08:36:10 host2 sshd[3202059]: Disconnected from invalid user david 64.227.135.37 port 38236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-12-25 08:38:48 dovecot_login authenticator failed for H=([187.6.121.246]) [187.6.121.246]:45154: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-25 08:39:08 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:36418: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Dec 25 08:38:20 host2 sshd[3203591]: Disconnected from invalid user sara 43.252.229.25 port 41910 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2025-12-25 08:38:31 dovecot_login authenticator failed for H=([218.248.19.102]) [218.248.19.102]:38390: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.252.229.25
country_id: 1819730
description:
Dec 25 08:39:37 host2 sshd[3204698]: Disconnected from invalid user newusername 43.252.229.25 port 41438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.52.243
country_id: 3144096
description:
2025-12-25 08:39:14 dovecot_login authenticator failed for H=(cm-84.215.52.243.get.no) [84.215.52.243]:58213: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-25 08:39:23 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:52680: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-25 08:40:22 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:44693: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 25 08:40:51 host2 sshd[3205792]: Disconnected from invalid user ubuntu 101.36.120.76 port 40016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Dec 25 08:41:27 host2 sshd[3206438]: Disconnected from invalid user power 43.252.229.25 port 54830 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.66.34.121
country_id: 1643084
description:
Dec 25 08:42:17 host2 sshd[3207171]: Disconnected from invalid user newuser 157.66.34.121 port 35522 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.90.133.142
country_id: 1694008
description:
2025-12-25 08:44:08 dovecot_login authenticator failed for H=([202.90.133.142]) [202.90.133.142]:12101: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2025-12-25 08:44:10 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:40890: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.9.182
country_id: 6252001
description:
Dec 25 08:43:17 host2 sshd[3208114]: Disconnected from invalid user admin 138.68.9.182 port 50564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.66.34.121
country_id: 1643084
description:
Dec 25 08:43:23 host2 sshd[3208146]: Disconnected from invalid user pc 157.66.34.121 port 40446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.135.37
country_id: 1269750
description:
Dec 25 08:43:28 host2 sshd[3208234]: Disconnected from invalid user user 64.227.135.37 port 50966 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.9.182
country_id: 6252001
description:
Dec 25 08:44:51 host2 sshd[3210470]: Disconnected from invalid user bitwarden 138.68.9.182 port 45836 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2025-12-25 08:44:55 dovecot_login authenticator failed for H=([125.23.178.65]) [182.78.64.18]:33394: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 195.25.17.31
country_id: 3017382
description:
Dec 25 08:45:02 host2 sshd[3211072]: Received disconnect from 195.25.17.31 port 34994:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.25.17.31
country_id: 3017382
description:
Dec 25 08:46:09 host2 sshd[3213028]: Disconnected from invalid user term1 195.25.17.31 port 15775 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.7.84.213
country_id: 6252001
description:
[2025-12-25 08:46:25 +0530] info [cpaneld] 47.7.84.213 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.164.113.97
country_id: 6252001
description:
[2025-12-25 08:46:26 +0530] info [cpaneld] 71.164.113.97 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.133.118.130
country_id: 6252001
description:
[2025-12-25 08:46:35 +0530] info [cpaneld] 76.133.118.130 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.104.109.67
country_id: 6252001
description:
[2025-12-25 08:46:22 +0530] info [cpaneld] 68.104.109.67 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.45.90.108
country_id: 6252001
description:
[2025-12-25 08:46:23 +0530] info [whostmgrd] 99.45.90.108 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.76.106
country_id: 6252001
description:
[2025-12-25 08:46:27 +0530] info [cpaneld] 76.33.76.106 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.49.101.17
country_id: 6252001
description:
[2025-12-25 08:46:31 +0530] info [cpaneld] 67.49.101.17 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.94.163.0
country_id: 6252001
description:
[2025-12-25 08:46:19 +0530] info [cpaneld] 76.94.163.0 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.19.164.53
country_id: 6252001
description:
[2025-12-25 08:46:36 +0530] info [cpaneld] 45.19.164.53 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.141.18.185
country_id: 6252001
description:
[2025-12-25 08:46:34 +0530] info [cpaneld] 63.141.18.185 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.218.241.230
country_id: 6252001
description:
[2025-12-25 08:46:24 +0530] info [cpaneld] 24.218.241.230 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.85.56.143
country_id: 6252001
description:
[2025-12-25 08:46:30 +0530] info [cpaneld] 72.85.56.143 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.91.206.225
country_id: 6252001
description:
[2025-12-25 08:46:33 +0530] info [cpaneld] 50.91.206.225 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 25 08:47:05 host2 sshd[3214182]: Disconnected from invalid user user 101.36.120.76 port 46870 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.182.52.124
country_id: 6252001
description:
[2025-12-25 08:46:20 +0530] info [cpaneld] 67.182.52.124 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 08:49:51 host2 sshd[3216642]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2025-12-25 08:49:57 dovecot_login authenticator failed for H=(nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:40908: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-12-25 08:50:19 dovecot_login authenticator failed for H=([180.94.75.114]) [180.94.75.114]:55565: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.194
country_id: 6252001
description:
Dec 25 08:50:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.194, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kKrnQb5GMM7N0h/C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec 25 08:53:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<xW/TTL5G9IQD7r/l>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.61.223.109
country_id: 2017370
description:
[2025-12-25 08:54:18 +0530] info [webmaild] 185.61.223.109 - info@gnetuniversals.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.26
country_id: 6252001
description:
Dec 25 08:54:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=162.216.150.26, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<kLFzUb5GKtui2JYa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.26
country_id: 6252001
description:
Dec 25 08:55:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.26, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<H2bGVL5GoOSi2JYa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-12-25 08:57:06 dovecot_login authenticator failed for H=(nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:37692: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-25 08:57:22 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:39194: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.26
country_id: 6252001
description:
Dec 25 09:01:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.26, lip=66.85.158.92, TLS, session=<zSD+aL5G0vGi2JYa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-25 09:01:27 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:41700: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-25 09:02:16 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:50121: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.51
country_id: 6252001
description:
Dec 25 09:07:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.51, lip=66.85.158.92, TLS, session=<6FwZgL5GvPnN0h8z>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 09:10:33 host2 sshd[3234929]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.208.47.13
country_id: 1168579
description:
2025-12-25 09:12:41 dovecot_login authenticator failed for H=([154.208.47.13]) [154.208.47.13]:45054: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-25 09:13:32 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:49383: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.171.200
country_id: 6252001
description:
[2025-12-25 09:16:19 +0530] info [webmaild] 140.235.171.200 - info@jrdc.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.120
country_id: 6252001
description:
Dec 25 09:22:09 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.120, lip=66.85.158.92, TLS: Connection closed, session=<yt59s75GIs3HLZp4>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 09:24:39 host2 pure-ftpd[3245887]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.83.31.53
country_id: 6252001
description:
2025-12-25 09:28:01 dovecot_login authenticator failed for H=(lezzarotech.com) [45.83.31.53]:61392: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.180.173
country_id: 3996063
description:
2025-12-25 09:30:38 dovecot_login authenticator failed for H=fixed-189-203-180-173.totalplay.net [189.203.180.173]:51216: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-12-25 09:30:57 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:51233: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec 25 09:37:28 host2 pure-ftpd[3256170]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 25 09:41:04 host2 sshd[3259130]: Disconnected from invalid user jhlee 181.212.81.228 port 39068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.70.102.114
country_id: 2233387
description:
Dec 25 09:42:38 host2 sshd[3260316]: Disconnected from invalid user user_jenkins 154.70.102.114 port 46200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.44.15.210
country_id: 357994
description:
Dec 25 09:44:04 host2 sshd[3261296]: Disconnected from invalid user opc 197.44.15.210 port 46358 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 25 09:44:18 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.91, session=<aLSxAr9GDIQ26lCA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 25 09:44:27 host2 sshd[3262185]: Disconnected from invalid user pivpn 181.212.81.228 port 42754 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 25 09:44:08 host2 sshd[3261371]: Disconnected from invalid user www 125.20.16.22 port 31208 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-12-25 09:45:43 dovecot_login authenticator failed for H=([62.201.228.210]) [62.201.228.210]:53730: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.219
country_id: 3144096
description:
2025-12-25 09:45:58 dovecot_login authenticator failed for H=(219-163-97-62.cust.smartcall.no) [62.97.163.219]:46639: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.81.228
country_id: 3895114
description:
Dec 25 09:46:27 host2 sshd[3263802]: Disconnected from invalid user git 181.212.81.228 port 50610 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.70.102.114
country_id: 2233387
description:
Dec 25 09:46:30 host2 sshd[3263829]: Disconnected from invalid user yogi 154.70.102.114 port 42342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 25 09:49:08 host2 sshd[3265577]: Disconnected from invalid user jhlee 125.20.16.22 port 15740 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 25 09:49:45 host2 sshd[3265952]: Disconnected from invalid user user 125.20.16.22 port 16890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.136.125
country_id: 1168579
description:
Dec 25 09:52:09 host2 sshd[3268208]: Disconnected from invalid user ubuntu 116.71.136.125 port 39764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-12-25 09:54:03 dovecot_login authenticator failed for H=(host253.181-93-60.telecom.net.ar) [181.93.60.253]:54674: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-12-25 09:54:26 dovecot_login authenticator failed for H=([65.20.251.170]) [65.20.251.170]:58755: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.71.136.125
country_id: 1168579
description:
Dec 25 09:54:31 host2 sshd[3270099]: Disconnected from invalid user ftpuser 116.71.136.125 port 44730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-25 09:54:48 dovecot_login authenticator failed for H=(syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:34629: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.67.84.115
country_id: 3469034
description:
2025-12-25 09:54:50 dovecot_login authenticator failed for H=(45.168.140-35.smartlinkfibra.com.br) [177.67.84.115]:50665: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-25 09:55:00 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:37150: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-12-25 09:55:32 dovecot_login authenticator failed for H=(182.239.78.49.hk.chinamobile.com) [182.239.78.49]:44678: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-12-25 09:55:56 dovecot_login authenticator failed for H=([165.154.202.101]) [165.154.202.101]:49894: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.58
country_id: 1269750
description:
2025-12-25 09:56:20 dovecot_login authenticator failed for H=([182.95.22.220]) [125.19.251.58]:49004: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.96
country_id: 6252001
description:
Dec 25 09:57:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.195.96, lip=66.85.158.91, session=<W1AjML9GssUUQcNg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-25 09:57:19 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:54584: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.168.113.8
country_id: 3469034
description:
[2025-12-25 10:01:32 +0530] info [cpaneld] 45.168.113.8 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.115
country_id: 6252001
description:
Dec 25 10:09:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.115, lip=66.85.158.92, TLS: Connection closed, session=<dBU5Xb9GgN3HLZpz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.11
country_id: 6252001
description:
Dec 25 10:13:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=147.185.133.11, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<fLxgab9GssaTuYUL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.11
country_id: 6252001
description:
Dec 25 10:13:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=147.185.133.11, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<yfaYbL9Ggu6TuYUL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.74
country_id: 2635167
description:
Dec 25 10:13:50 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.74, lip=66.85.158.91, session=<ytRabL9GBv0jy9JK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.11
country_id: 6252001
description:
Dec 25 10:21:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.133.11, lip=66.85.158.91, TLS, session=<q+dgh79Gou+TuYUL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 10:27:09 host2 pure-ftpd[3297647]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-12-25 10:27:42 dovecot_login authenticator failed for H=([203.193.147.41]) [203.193.147.37]:57811: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.203.180.173
country_id: 3996063
description:
2025-12-25 10:27:53 dovecot_login authenticator failed for H=fixed-189-203-180-173.totalplay.net [189.203.180.173]:60326: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.92.199.36
country_id: 732800
description:
Dec 25 10:28:32 host2 sshd[3298598]: Disconnected from invalid user jack 91.92.199.36 port 59232 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-25 10:31:53 dovecot_login authenticator failed for H=([128.185.39.145]) [128.185.214.78]:43192: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.111
country_id: 6252001
description:
Dec 25 10:31:58 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.111, lip=66.85.158.91, TLS, session=<Avwtrb9GZuPN0h9v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.223
country_id: 3996063
description:
2025-12-25 10:31:24 dovecot_login authenticator failed for H=(201.173.56.223-clientes-izzi.mx) [201.173.56.223]:37056: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.49.38.12
country_id: 6252001
description:
[2025-12-25 10:34:46 +0530] info [webmaild] 64.49.38.12 - info@seyawin.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 10:35:34 host2 sshd[3304221]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.101
country_id: 3469034
description:
Dec 25 10:35:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=177.44.71.101, lip=66.85.158.91, TLS, session=<A+cgur9GaOSxLEdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-25 10:35:57 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:57841: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.219
country_id: 1269750
description:
Dec 25 10:35:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.164.246.219, lip=66.85.158.91, TLS, session=<2+gaur9G3JhnpPbb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 25 10:36:12 host2 sshd[3304740]: Disconnected from invalid user admin 160.242.96.43 port 32908 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.96.61
country_id: 3469034
description:
Dec 25 10:36:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<contact>, method=PLAIN, rip=191.240.96.61, lip=66.85.158.91, TLS, session=<bdtTu79GF42/8GA9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.120.28
country_id: 3865483
description:
Dec 25 10:36:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact>, method=PLAIN, rip=190.181.120.28, lip=66.85.158.91, TLS, session=<al8bvL9G18e+tXgc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-25 10:36:45 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:45068: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.242.96.43
country_id: 3355338
description:
Dec 25 10:37:37 host2 sshd[3305728]: Disconnected from invalid user web 160.242.96.43 port 34502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-12-25 10:40:03 dovecot_login authenticator failed for H=([65.20.191.97]) [65.20.191.97]:50330: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-25 10:39:41 dovecot_login authenticator failed for H=([150.129.20.234]) [150.129.20.234]:41967: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.92.199.36
country_id: 732800
description:
Dec 25 10:42:30 host2 sshd[3309901]: Disconnected from invalid user test 91.92.199.36 port 53502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 25 10:42:35 host2 sshd[3309964]: Disconnected from invalid user openproject 138.248.168.20 port 63966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 25 10:44:05 host2 sshd[3311022]: Disconnected from invalid user timemachine 138.248.168.20 port 59700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Dec 25 10:44:11 host2 sshd[3311168]: Disconnected from invalid user rodrigo 81.215.228.18 port 42032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.248.168.20
country_id: 2635167
description:
Dec 25 10:44:40 host2 sshd[3311949]: Disconnected from invalid user ivan 138.248.168.20 port 45482 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Dec 25 10:45:49 host2 sshd[3313009]: Disconnected from invalid user cisco 81.215.228.18 port 49336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-25 10:47:21 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:55704: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Dec 25 10:47:38 host2 sshd[3314516]: Disconnected from invalid user admin 103.224.247.23 port 60946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.118.15.236
country_id: 130758
description:
Dec 25 10:47:39 host2 sshd[3314537]: Disconnected from invalid user debian 185.118.15.236 port 38922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 25 10:50:10 host2 sshd[3316670]: Disconnected from invalid user tempftp 196.189.124.195 port 38996 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.155
country_id: 6252001
description:
Dec 25 10:50:40 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.104.155, lip=66.85.158.92, session=<TjoN8L9GhLQUQGib>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.124.195
country_id: 337996
description:
Dec 25 10:51:10 host2 sshd[3317984]: Disconnected from invalid user production 196.189.124.195 port 43548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-25 10:51:59 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:50475: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 25 10:52:10 host2 sshd[3318694]: Disconnected from invalid user user 196.189.124.195 port 58018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 25 10:53:38 host2 sshd[3319905]: Disconnected from invalid user user 35.200.237.19 port 1120 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:04 host2 sshd[3320301]: error: maximum authentication attempts exceeded for root from 168.138.115.41 port 37926 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:04 host2 sshd[3320301]: Disconnecting authenticating user root 168.138.115.41 port 37926: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Dec 25 10:54:51 host2 sshd[3321325]: Disconnected from invalid user ts3server 103.224.247.23 port 33230 [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:08 host2 sshd[3320521]: error: maximum authentication attempts exceeded for root from 168.138.115.41 port 37932 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:08 host2 sshd[3320521]: Disconnecting authenticating user root 168.138.115.41 port 37932: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:17 host2 sshd[3320775]: error: maximum authentication attempts exceeded for invalid user admin from 168.138.115.41 port 38188 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.138.115.41
country_id: 1269750
description:
Dec 25 10:54:20 host2 sshd[3320865]: Disconnecting invalid user admin 168.138.115.41 port 38204: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.118.15.236
country_id: 130758
description:
Dec 25 10:55:16 host2 sshd[3321802]: Disconnected from invalid user tableau 185.118.15.236 port 39198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 25 10:55:32 host2 sshd[3321989]: Disconnected from invalid user dev 35.200.237.19 port 1139 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.118.15.236
country_id: 130758
description:
Dec 25 10:55:48 host2 sshd[3322186]: Disconnected from invalid user test 185.118.15.236 port 39244 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 10:56:34 host2 sshd[3322756]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 25 10:56:11 host2 sshd[3322453]: Disconnected from invalid user tecmint 35.200.237.19 port 1143 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 25 10:57:24 host2 sshd[3323433]: Disconnected from invalid user admin 35.200.237.19 port 1133 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Dec 25 10:58:16 host2 sshd[3324045]: Disconnected from invalid user deployer 103.224.247.23 port 44674 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 25 10:58:38 host2 sshd[3324309]: Disconnected from invalid user kunal 35.200.237.19 port 1113 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:04:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<p6uUIcBGJJwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:06:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<zhFCJ8BGXOMDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.168
country_id: 6252001
description:
Dec 25 11:07:00 host2 pure-ftpd[3330645]: (?@205.210.31.168) [INFO] New connection from 205.210.31.168


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.145.131.213
country_id: 294640
description:
[2025-12-25 11:07:01 +0530] info [webmaild] 45.145.131.213 - info@tfab.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:07:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<L6qVK8BGPswDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:08:55 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<1TZWMcBGrucDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:13:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ug4NQcBGCLQDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:15:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<x1JMR8BGiOUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:16:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<2PcFS8BGGpIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 11:17:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<Y9NPUMBGOsIDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.228
country_id: 3865483
description:
2025-12-25 11:20:08 dovecot_login authenticator failed for H=([186.5.178.228]) [186.5.178.228]:41085: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-25 11:20:39 dovecot_login authenticator failed for H=([149.54.62.54]) [149.54.62.54]:40094: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 25 11:20:48 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<sQrXW8BGaOeLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.26
country_id: 1149361
description:
2025-12-25 11:28:28 dovecot_login authenticator failed for H=([149.54.62.26]) [149.54.62.26]:49311: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-12-25 11:28:28 dovecot_login authenticator failed for H=([140.84.188.140]) [140.84.188.140]:44322: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.142
country_id: 3144096
description:
2025-12-25 11:28:39 dovecot_login authenticator failed for H=(cm-178.232.138.142.get.no) [178.232.138.142]:45123: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-25 11:28:47 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:45975: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 11:29:45 host2 pure-ftpd[3349899]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-25 11:33:04 dovecot_login authenticator failed for H=([125.18.154.73]) [182.95.226.118]:49984: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-25 11:33:15 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:49553: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.219.221.172
country_id: 2661886
description:
2025-12-25 11:38:30 dovecot_login authenticator failed for H=83-219-221-172.cust.bredband2.com [83.219.221.172]:39832: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.97.62
country_id: 1269750
description:
2025-12-25 11:38:55 dovecot_login authenticator failed for H=([122.186.240.209]) [27.123.97.62]:43828: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 25 11:40:07 host2 sshd[3357330]: Disconnected from invalid user gino 200.91.236.125 port 33248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 25 11:40:44 host2 sshd[3357808]: Disconnected from invalid user ubuntu 200.91.236.125 port 41683 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 25 11:41:51 host2 sshd[3358639]: Disconnected from invalid user nasrin 103.210.21.242 port 50396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 25 11:42:26 host2 sshd[3359031]: Disconnected from invalid user alma 103.210.21.242 port 48398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 25 11:43:39 host2 sshd[3360073]: Disconnected from invalid user rootuser 103.210.21.242 port 44874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 25 11:43:47 host2 sshd[3360187]: Disconnected from invalid user user1 200.91.236.125 port 35050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.122
country_id: 1269750
description:
2025-12-25 11:45:31 dovecot_login authenticator failed for H=([125.18.219.209]) [27.123.102.122]:57066: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-12-25 11:45:49 dovecot_login authenticator failed for H=([65.20.179.251]) [65.20.179.251]:49051: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.49
country_id: 6252001
description:
Dec 25 11:47:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.49, lip=66.85.158.91, TLS, session=<k6jcu8BGUP3N0h8x>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.178.85.71
country_id: 102358
description:
2025-12-25 11:47:37 dovecot_login authenticator failed for H=([95.178.85.71]) [95.178.85.71]:45354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 25 11:49:09 host2 sshd[3364613]: Disconnected from invalid user info 200.91.236.125 port 48882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.196
country_id: 1733045
description:
2025-12-25 11:50:21 dovecot_login authenticator failed for H=([49.124.148.196]) [49.124.148.196]:37356: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.227.254.152
country_id: 3703430
description:
Dec 25 11:55:19 host2 pure-ftpd[3370123]: (?@45.227.254.152) [INFO] New connection from 45.227.254.152


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-25 11:57:32 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:36084: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:02:11 host2 pure-ftpd[3375288]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-12-25 12:01:31 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:50433: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:03:08 host2 pure-ftpd[3376049]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:03:03 host2 pure-ftpd[3375930]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:03:14 host2 pure-ftpd[3376123]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:03:15 host2 pure-ftpd[3376131]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:04:14 host2 pure-ftpd[3376930]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:04:18 host2 pure-ftpd[3377004]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:05:14 host2 pure-ftpd[3377958]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:05:15 host2 pure-ftpd[3377977]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:06:20 host2 pure-ftpd[3379072]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:06:15 host2 pure-ftpd[3378999]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:07:15 host2 pure-ftpd[3379793]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:07:17 host2 pure-ftpd[3379840]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:08:15 host2 pure-ftpd[3381190]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:08:16 host2 pure-ftpd[3381201]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:09:15 host2 pure-ftpd[3382078]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:09:19 host2 pure-ftpd[3382153]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:10:15 host2 pure-ftpd[3383336]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:10:16 host2 pure-ftpd[3383371]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:11:15 host2 pure-ftpd[3384362]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:11:19 host2 pure-ftpd[3384434]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:12:15 host2 pure-ftpd[3385301]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:12:16 host2 pure-ftpd[3385310]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:13:15 host2 pure-ftpd[3386277]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:13:14 host2 pure-ftpd[3386267]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:14:19 host2 pure-ftpd[3387117]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:14:14 host2 pure-ftpd[3387039]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:15:16 host2 pure-ftpd[3388002]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.202.242.45
country_id: 1210997
description:
Dec 25 12:15:14 host2 pure-ftpd[3387965]: (?@203.202.242.45) [INFO] New connection from 203.202.242.45


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 12:21:51 host2 sshd[3393104]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-12-25 12:21:55 dovecot_login authenticator failed for H=([190.85.134.20]) [190.85.134.20]:43433: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.180.232.172
country_id: 6252001
description:
[2025-12-25 12:26:32 +0530] info [webmaild] 194.180.232.172 - info@lankaherbalsolutions.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-12-25 12:27:18 dovecot_login authenticator failed for H=([122.184.124.46]) [122.184.124.46]:42918: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.235.35.123
country_id: 1269750
description:
2025-12-25 12:27:26 dovecot_login authenticator failed for H=([20.235.35.123]) [20.235.35.123]:36496: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-25 12:30:15 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:51456: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 12:31:41 host2 sshd[3400738]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 12:32:14 host2 pure-ftpd[3401191]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.91
country_id: 1819730
description:
Dec 25 12:33:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.91, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<n8EhXsFG9vgtjppb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2025-12-25 12:33:14 dovecot_login authenticator failed for H=([196.0.113.110]) [196.0.113.110]:35570: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-12-25 12:33:33 dovecot_login authenticator failed for H=([74.208.177.56]) [74.208.177.56]:50598: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-25 12:33:56 dovecot_login authenticator failed for H=([182.66.80.41]) [182.66.214.70]:38608: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-25 12:38:02 dovecot_login authenticator failed for H=([105.73.93.110]) [105.73.93.110]:60452: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-25 12:38:50 dovecot_login authenticator failed for H=([122.185.254.113]) [122.186.64.206]:43676: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.74.192.200
country_id: 2186224
description:
2025-12-25 12:39:14 dovecot_login authenticator failed for H=([202.74.192.200]) [202.74.192.200]:46794: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 12:42:52 host2 sshd[3409447]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.218.46.67
country_id: 6252001
description:
[2025-12-25 12:56:58 +0530] info [webmaild] 88.218.46.67 - info@anandaobauae.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.94.55
country_id: 1643084
description:
Dec 25 12:59:33 host2 sshd[3424597]: Disconnected from invalid user cashier 38.47.94.55 port 49750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.74.115.25
country_id: 1861060
description:
Dec 25 13:00:10 host2 sshd[3425201]: Disconnected from invalid user test1 40.74.115.25 port 38814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.215.144.32
country_id: 6252001
description:
Dec 25 13:01:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.215.144.32, lip=66.85.158.91, TLS, session=<jdjEwsFGkMOs15Ag>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.94.55
country_id: 1643084
description:
Dec 25 13:02:18 host2 sshd[3427090]: Disconnected from invalid user test1 38.47.94.55 port 56648 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.30.240.167
country_id: 2635167
description:
Dec 25 13:03:35 host2 sshd[3427943]: Disconnected from invalid user tunel 92.30.240.167 port 59218 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.74.115.25
country_id: 1861060
description:
Dec 25 13:07:04 host2 sshd[3430883]: Disconnected from invalid user rafael 40.74.115.25 port 56114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.6.119
country_id: 3144096
description:
2025-12-25 13:14:24 dovecot_login authenticator failed for H=(cm-84.211.6.119.get.no) [84.211.6.119]:46917: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.82
country_id: 1269750
description:
2025-12-25 13:14:39 dovecot_login authenticator failed for H=([59.145.212.121]) [182.95.184.82]:41848: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.7
country_id: 798549
description:
Dec 25 13:14:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.7, lip=66.85.158.92, session=<1fgB88FGSLdV2YwH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 52.188.81.67
country_id: 6252001
description:
Dec 25 13:17:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=52.188.81.67, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<GKuM+8FGdrI0vFFD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.187.217
country_id: 2921044
description:
Dec 25 13:17:08 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=164.92.187.217, lip=66.85.158.92, TLS, session=<QmPe+8FG1L2kXLvZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.199.163.171
country_id: 2635167
description:
2025-12-25 13:18:01 dovecot_login authenticator failed for H=171.163.199.146.dyn.plus.net [146.199.163.171]:52758: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-25 13:18:16 dovecot_login authenticator failed for H=(static.ill.117.211.15.106.bsnl.co.in) [117.211.15.93]:41530: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.68.87.135
country_id: 192950
description:
2025-12-25 13:18:28 dovecot_login authenticator failed for H=([102.68.87.135]) [102.68.87.135]:47768: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.98.8
country_id: 3144096
description:
2025-12-25 13:18:38 dovecot_login authenticator failed for H=(cm-84.215.98.8.get.no) [84.215.98.8]:52822: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.119.46.111
country_id: 294640
description:
[2025-12-25 13:25:12 +0530] info [webmaild] 212.119.46.111 - info@saara.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-25 13:28:19 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:45274: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.114
country_id: 1819730
description:
2025-12-25 13:29:14 dovecot_login authenticator failed for H=(223-197-145-114.static.imsbiz.com) [223.197.145.114]:61915: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 25 13:30:54 host2 sshd[3450182]: Disconnected from invalid user libuuid 137.59.55.50 port 42636 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.123
country_id: 933860
description:
Dec 25 13:32:36 host2 sshd[3451528]: Disconnected from invalid user owncloud 168.167.228.123 port 34207 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.140.207.251
country_id: 294640
description:
[2025-12-25 13:33:33 +0530] info [webmaild] 45.140.207.251 - info@epid.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 25 13:34:27 host2 sshd[3452862]: Disconnected from invalid user andrey 137.59.55.50 port 46252 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 13:34:46 host2 pure-ftpd[3453075]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.123
country_id: 933860
description:
Dec 25 13:35:55 host2 sshd[3454047]: Disconnected from invalid user rich 168.167.228.123 port 34211 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.59.55.50
country_id: 1269750
description:
Dec 25 13:35:35 host2 sshd[3453793]: Disconnected from invalid user user100 137.59.55.50 port 45212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 25 13:37:49 host2 sshd[3455403]: Disconnected from invalid user miguel 140.106.25.217 port 45802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Dec 25 13:39:55 host2 sshd[3456862]: Disconnected from invalid user mamy 107.150.104.184 port 42338 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 25 13:40:20 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, session=<z1bXTsJGqOEs3lFz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:40:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ExnIUMJGQoUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:41:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5lBQUsJGAqADhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.104.184
country_id: 6252001
description:
Dec 25 13:41:50 host2 sshd[3458547]: Disconnected from invalid user ubuntu 107.150.104.184 port 38570 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 25 13:42:41 host2 sshd[3459111]: Received disconnect from 140.106.25.217 port 41766:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 25 13:42:41 host2 sshd[3459111]: Disconnected from invalid user teaspeak 140.106.25.217 port 41766 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:43:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<b/ZgWsJGboADhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 25 13:43:45 host2 sshd[3459939]: Disconnected from invalid user samba 140.106.25.217 port 37732 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:45:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<nE6MX8JGZqsDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 140.106.25.217
country_id: 6251999
description:
Dec 25 13:44:17 host2 sshd[3460539]: Disconnected from invalid user j 140.106.25.217 port 49832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Dec 25 13:44:42 host2 sshd[3460874]: Disconnected from invalid user postgres 107.150.104.184 port 47032 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:45:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<1uvVYMJGDsMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:46:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<W54cZcJGpt0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:47:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<V4baacJGwJ0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 25 13:48:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<xSt7bcJGouEDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-12-25 13:53:53 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:38709: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-25 13:54:21 dovecot_login authenticator failed for H=([94.201.22.158]) [94.201.22.158]:51635: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-12-25 13:56:12 dovecot_login authenticator failed for H=(nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:56012: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-25 13:55:50 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:40838: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-25 14:02:17 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:49790: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-25 14:01:40 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:56282: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.202
country_id: 2750405
description:
Dec 25 14:03:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=80.82.77.202, lip=66.85.158.92, session=<meP+oMJGYOpQUk3K>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 14:08:11 host2 sshd[3481747]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-25 14:07:36 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49897: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-25 14:20:24 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:44499: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.16.99
country_id: 3144096
description:
2025-12-25 14:20:39 dovecot_login authenticator failed for H=(cm-178.232.16.99.get.no) [178.232.16.99]:55174: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 14:25:51 host2 sshd[3496001]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 14:29:11 host2 sshd[3498550]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-25 14:32:42 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:46010: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-12-25 14:33:28 dovecot_login authenticator failed for H=(223-197-153-138.static.imsbiz.com) [223.197.153.138]:62797: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.0.88
country_id: 3144096
description:
2025-12-25 14:34:37 dovecot_login authenticator failed for H=(cm-78.156.0.88.get.no) [78.156.0.88]:56649: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.198
country_id: 1733045
description:
Dec 25 14:36:30 host2 sshd[3504468]: Disconnected from invalid user server 202.165.16.198 port 49936 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.16.198
country_id: 1733045
description:
Dec 25 14:37:08 host2 sshd[3504914]: Disconnected from invalid user server 202.165.16.198 port 60578 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 14:37:08 host2 pure-ftpd[3504937]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.182.243
country_id: 2802361
description:
Dec 25 14:38:43 host2 pure-ftpd[3506230]: (?@34.79.182.243) [INFO] New connection from 34.79.182.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-12-25 14:39:13 dovecot_login authenticator failed for H=202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:50584: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-12-25 14:39:29 dovecot_login authenticator failed for H=209.66.246.220.static.netvigator.com [220.246.66.209]:61815: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.210.200
country_id: 2802361
description:
Dec 25 14:40:23 host2 pure-ftpd[3508003]: (?@34.76.210.200) [INFO] New connection from 34.76.210.200


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.198
country_id: 1733045
description:
Dec 25 14:40:36 host2 sshd[3508172]: Disconnected from invalid user git 202.165.16.198 port 59682 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-12-25 14:43:21 dovecot_login authenticator failed for H=(185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:54476: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.44.40
country_id: 1522867
description:
2025-12-25 14:43:44 dovecot_login authenticator failed for H=([5.76.44.40]) [5.76.44.40]:53948: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.238.213.180
country_id: 2661886
description:
2025-12-25 14:47:44 dovecot_login authenticator failed for H=h85-238-213-180.cust.bredband2.com [85.238.213.180]:55726: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-12-25 14:47:25 dovecot_login authenticator failed for H=([102.90.34.90]) [102.90.34.90]:47601: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.234.80.128
country_id: 6252001
description:
Dec 25 14:49:20 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.234.80.128, lip=66.85.158.92, session=<TPaSRcNGEIo26lCA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-25 14:52:24 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:49914: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.99.80.56
country_id: 1643084
description:
Dec 25 14:56:07 host2 sshd[3522308]: Disconnected from invalid user frappe 118.99.80.56 port 10470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.99.80.56
country_id: 1643084
description:
Dec 25 14:58:37 host2 sshd[3524142]: Disconnected from invalid user deploy 118.99.80.56 port 2534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.99.80.56
country_id: 1643084
description:
Dec 25 15:01:18 host2 sshd[3526097]: Disconnected from invalid user ubuntu 118.99.80.56 port 7798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 25 15:03:39 host2 sshd[3527567]: Disconnected from invalid user admin 186.87.166.141 port 45434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 25 15:04:10 host2 sshd[3527787]: Disconnected from invalid user student2 186.87.166.141 port 51100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.74.229.158
country_id: 2510769
description:
Dec 25 15:06:52 host2 sshd[3530325]: Disconnected from invalid user test 77.74.229.158 port 47178 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.211.94.35
country_id: 289688
description:
2025-12-25 15:07:48 dovecot_login authenticator failed for H=([37.211.94.35]) [37.211.94.35]:26403: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-12-25 15:08:14 dovecot_login authenticator failed for H=(cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:48168: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Dec 25 15:08:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<6R+Ni8NG6Iws3lFz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Dec 25 15:08:38 host2 sshd[3531972]: Disconnected from invalid user gemini 152.42.203.0 port 48830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.42.203.0
country_id: 1880251
description:
Dec 25 15:09:26 host2 sshd[3532577]: Disconnected from invalid user sftp_user 152.42.203.0 port 43242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.166.174.63
country_id: 1880251
description:
Dec 25 15:10:04 host2 sshd[3533291]: Disconnected from invalid user rustserver 207.166.174.63 port 45786 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.42.203.0
country_id: 1880251
description:
Dec 25 15:10:07 host2 sshd[3533352]: Disconnected from invalid user alan 152.42.203.0 port 33650 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.89.125.231
country_id: 6252001
description:
Dec 25 15:10:43 host2 pure-ftpd[3533850]: (?@13.89.125.231) [INFO] New connection from 13.89.125.231


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 211.24.41.44
country_id: 1733045
description:
Dec 25 15:12:30 host2 sshd[3535787]: Disconnected from invalid user abhishek 211.24.41.44 port 58130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.166.174.63
country_id: 1880251
description:
Dec 25 15:14:29 host2 sshd[3537487]: Disconnected from invalid user cheng 207.166.174.63 port 42534 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.225.19
country_id: 6252001
description:
Dec 25 15:15:00 host2 pure-ftpd[3537835]: (?@20.118.225.19) [INFO] New connection from 20.118.225.19


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 45.131.135.89
country_id: 2750405
description:
Dec 25 15:16:31 host2 sshd[3539205]: Received disconnect from 45.131.135.89 port 35736:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.131.135.89
country_id: 2750405
description:
Dec 25 15:16:31 host2 sshd[3539205]: Disconnected from invalid user sammy 45.131.135.89 port 35736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.131.135.89
country_id: 2750405
description:
Dec 25 15:18:28 host2 sshd[3541187]: Disconnected from invalid user deploy 45.131.135.89 port 35176 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-25 15:20:04 dovecot_login authenticator failed for H=(nsg-corporate-226.215.186.122.airtel.in) [122.186.201.62]:49370: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-25 15:20:06 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:33710: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-12-25 15:20:30 dovecot_login authenticator failed for H=([189.80.46.250]) [189.80.46.250]:60696: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.240.244.53
country_id: 1269750
description:
2025-12-25 15:20:45 dovecot_login authenticator failed for H=([152.52.93.82]) [115.240.244.53]:10400: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-12-25 15:20:51 dovecot_login authenticator failed for H=([121.73.169.161]) [121.73.169.161]:46790: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-25 15:21:21 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:40188: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-25 15:22:11 dovecot_login authenticator failed for H=([152.52.234.134]) [125.20.245.182]:38624: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.93.110
country_id: 2542007
description:
2025-12-25 15:22:25 dovecot_login authenticator failed for H=([105.73.93.110]) [105.73.93.110]:45967: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-25 15:22:45 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:17216: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 15:29:45 host2 sshd[3550322]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.82.55.50
country_id: 3469034
description:
Dec 25 15:29:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=170.82.55.50, lip=66.85.158.91, TLS, session=<54Ef1MNG55WqUjcy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.118.183.189
country_id: 3865483
description:
Dec 25 15:29:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt>, method=PLAIN, rip=181.118.183.189, lip=66.85.158.91, TLS, session=<DIpi1cNGRK+1dre9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 25 15:33:23 host2 sshd[3553443]: Disconnected from invalid user ubuntu 92.191.96.115 port 54642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.46.102
country_id: 2921044
description:
Dec 25 15:33:43 host2 sshd[3553660]: Disconnected from invalid user thomas 51.195.46.102 port 46392 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 25 15:34:14 host2 sshd[3554158]: Disconnected from invalid user usher 158.69.194.34 port 52624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-12-25 15:34:47 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:58170: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 25 15:36:09 host2 sshd[3556309]: Disconnected from invalid user steam 92.191.96.115 port 37328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 25 15:36:19 host2 sshd[3556426]: Disconnected from invalid user apps 158.69.194.34 port 51808 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 25 15:37:49 host2 sshd[3557734]: Received disconnect from 158.69.194.34 port 49700:11: Bye Bye [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 15:38:30 host2 pure-ftpd[3558726]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.46.102
country_id: 2921044
description:
Dec 25 15:39:31 host2 sshd[3559362]: Disconnected from invalid user mark 51.195.46.102 port 33552 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-25 15:41:02 dovecot_plain authenticator failed for H=c-73-197-236-163.hsd1.nj.comcast.net (losal) [73.197.236.163]:56698: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.29.239.66
country_id: 1880251
description:
2025-12-25 15:45:54 dovecot_login authenticator failed for H=([114.29.239.66]) [114.29.239.66]:47496: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-25 15:46:07 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:42082: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 25 15:52:54 host2 sshd[3571097]: Disconnected from invalid user pt 152.32.215.203 port 40858 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 15:54:26 host2 sshd[3573255]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 25 15:55:12 host2 sshd[3573855]: Disconnected from invalid user felix 152.32.215.203 port 37724 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-25 15:56:25 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (culphinde) [73.176.157.57]:35094: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-25 16:10:40 dovecot_plain authenticator failed for H=(writy) [12.150.243.22]:24759: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 16:15:40 host2 sshd[3592765]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-12-25 16:17:47 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:51926: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-25 16:17:23 dovecot_login authenticator failed for H=syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:37973: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 31.208.188.18
country_id: 2661886
description:
Dec 25 16:17:33 host2 pure-ftpd[3594183]: (?@31.208.188.18) [INFO] New connection from 31.208.188.18


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.208.188.18
country_id: 2661886
description:
Dec 25 16:17:34 host2 sshd[3594186]: Invalid user httpsaccounts.zoho.comsigninhr@lezzarotech.com from 31.208.188.18 port 62837


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 31.208.188.18
country_id: 2661886
description:
Dec 25 16:17:40 host2 pure-ftpd[3594183]: (?@31.208.188.18) [WARNING] Authentication failed for user [httpsaccounts.zoho.comsigninhr@lezzarotech.com]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 31.208.188.18
country_id: 2661886
description:
Dec 25 16:17:41 host2 sshd[3594292]: Invalid user httpsaccounts.zoho.comsigninhr from 31.208.188.18 port 63332


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-12-25 16:23:24 dovecot_login authenticator failed for H=([49.231.31.220]) [49.231.31.220]:12196: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-12-25 16:24:02 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [151.237.115.206]:33190: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:31:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<FmqjscRG7q8DiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-25 16:31:19 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (jocaphyceo) [68.52.119.193]:47322: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:33:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<dJi6usRGnqYDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 25 16:34:42 host2 sshd[3613323]: Disconnected from invalid user andrey 89.218.69.66 port 11531 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:34:03 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<6zYTvMRG/OADiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 25 16:35:21 host2 sshd[3614226]: Disconnected from invalid user server 89.218.69.66 port 30355 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:36:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<1BKuw8RGIpUDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:36:40 host2 dovecot[1881837]: pop3-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<nahsxcRGutIDiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:37:04 host2 dovecot[1881837]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<zO3lxsRGlpIDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 25 16:37:14 host2 sshd[3616418]: Disconnected from invalid user deploy 89.218.69.66 port 27789 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-25 16:38:06 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (cally) [73.183.74.177]:57744: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 25 16:38:05 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<iSeMysRGLLYDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Dec 25 16:38:09 host2 sshd[3617343]: Disconnected from invalid user bots 167.99.78.165 port 49648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.249.61.124
country_id: 298795
description:
Dec 25 16:38:52 host2 sshd[3618061]: Disconnected from invalid user tin 92.249.61.124 port 38294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.218.69.66
country_id: 1522867
description:
Dec 25 16:39:38 host2 sshd[3618954]: Disconnected from invalid user administrator 89.218.69.66 port 37439 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.78.165
country_id: 1880251
description:
Dec 25 16:39:50 host2 sshd[3619173]: Disconnected from invalid user fastuser 167.99.78.165 port 53974 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 16:41:20 host2 pure-ftpd[3621312]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.78.165
country_id: 1880251
description:
Dec 25 16:41:06 host2 sshd[3620983]: Disconnected from invalid user server 167.99.78.165 port 45380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.249.61.124
country_id: 298795
description:
Dec 25 16:42:04 host2 sshd[3622177]: Disconnected from invalid user edu 92.249.61.124 port 57144 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.249.61.124
country_id: 298795
description:
Dec 25 16:42:44 host2 sshd[3622875]: Disconnected from invalid user posiflex 92.249.61.124 port 56552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.249.61.124
country_id: 298795
description:
Dec 25 16:44:36 host2 sshd[3625362]: Disconnected from invalid user wm 92.249.61.124 port 35544 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 25 16:44:42 host2 pure-ftpd[3625610]: (?@66.132.153.114) [INFO] New connection from 66.132.153.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-25 16:48:28 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:33370: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-25 16:48:31 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:40544: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.251.180.148
country_id: 1522867
description:
2025-12-25 16:49:08 dovecot_login authenticator failed for H=([5.251.180.148]) [5.251.180.148]:34404: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-25 16:49:25 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:18482: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.203.11.178
country_id: 294640
description:
[2025-12-25 17:02:44 +0530] info [webmaild] 193.203.11.178 - info@casa18villa.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-25 17:08:25 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:50378: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-12-25 17:09:34 dovecot_login authenticator failed for H=([41.231.85.75]) [41.231.85.75]:53701: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.122.247
country_id: 3144096
description:
2025-12-25 17:09:54 dovecot_login authenticator failed for H=(cm-178.232.122.247.get.no) [178.232.122.247]:53373: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-12-25 17:08:58 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:8867: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-25 17:17:29 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:50730: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-25 17:31:27 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:49310: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2025-12-25 17:31:54 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:34468: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-25 17:32:05 dovecot_login authenticator failed for H=(cm-84.213.189.27.get.no) [84.213.189.27]:55335: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Dec 25 17:32:45 host2 sshd[3683437]: Disconnected from invalid user erik 209.141.57.124 port 34858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.57.124
country_id: 6252001
description:
Dec 25 17:35:13 host2 sshd[3685771]: Disconnected from invalid user gokul 209.141.57.124 port 42174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.7
country_id: 1605651
description:
Dec 25 17:35:26 host2 sshd[3686093]: Disconnected from invalid user kiran 49.49.231.7 port 58716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Dec 25 17:36:36 host2 sshd[3687343]: Disconnected from invalid user ubuntu 209.141.57.124 port 37638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.231.7
country_id: 1605651
description:
Dec 25 17:36:05 host2 sshd[3686862]: Disconnected from invalid user tomcat 49.49.231.7 port 33586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Dec 25 17:38:04 host2 sshd[3688757]: Disconnected from invalid user kiran 209.141.57.124 port 33102 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.49.231.7
country_id: 1605651
description:
Dec 25 17:39:22 host2 sshd[3690043]: Disconnected from invalid user liuyong 49.49.231.7 port 33560 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 17:40:21 host2 sshd[3691155]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 17:41:45 host2 sshd[3692339]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:41:52 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<tPyYrsVGxL4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:42:10 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<YtOzr8VGiLMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:43:05 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<4Xn/ssVGqqIDgmBb>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 17:44:04 host2 pure-ftpd[3694629]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:44:30 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<5o0JuMVGmMwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:45:14 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<WmmjusVGKrUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:46:19 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<72SJvsVGeJEDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.51.234.214
country_id: 6252001
description:
Dec 25 17:46:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.51.234.214, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ed06wMVGVNIUM+rW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:47:09 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<ItuCwcVG4KkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:48:27 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<YagoxsVGuqkDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.109
country_id: 2215636
description:
2025-12-25 17:49:17 dovecot_login authenticator failed for H=([102.38.3.109]) [102.38.3.109]:52274: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:49:21 host2 dovecot[1881837]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<RYJoycVGBMIDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.179.129
country_id: 3144096
description:
2025-12-25 17:49:46 dovecot_login authenticator failed for H=(cm-84.213.179.129.get.no) [84.213.179.129]:42048: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:50:11 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<I+hhzMVGFsoDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 17:51:33 host2 sshd[3702772]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 25 17:51:09 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<NePQz8VGzJ4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Dec 25 17:55:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<wUn43cVGApA2xDDo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.21.25
country_id: 6252001
description:
Dec 25 17:58:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.29.21.25, lip=66.85.158.91, TLS, session=<yjux6cVGFt0UHRUZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 18:01:19 host2 sshd[3712709]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.141.160
country_id: 2921044
description:
Dec 25 18:09:11 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.141.160, lip=66.85.158.91, session=<Mq5REMZGrclo+I2g>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.99.249.109
country_id: 2921044
description:
Dec 25 18:09:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.99.249.109, lip=66.85.158.91, session=<9/ZwEMZG1NmnY/lt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-25 18:32:14 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:51068: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.221.50
country_id: 2921044
description:
Dec 25 18:37:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=207.154.221.50, lip=66.85.158.92, TLS handshaking: Connection closed, session=<V39kdMZGVibPmt0y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.10.245
country_id: 2921044
description:
Dec 25 18:36:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.89.10.245, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<GuVAcsZGs9WfWQr1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 18:37:57 host2 sshd[3749505]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.117.78.106
country_id: 3865483
description:
Dec 25 18:41:55 host2 sshd[3753858]: Invalid user smtp.zoho.com587hr@lezzarotech.com from 138.117.78.106 port 55019


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.117.78.106
country_id: 3865483
description:
Dec 25 18:41:55 host2 pure-ftpd[3753855]: (?@138.117.78.106) [INFO] New connection from 138.117.78.106


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 138.117.78.106
country_id: 3865483
description:
Dec 25 18:42:00 host2 pure-ftpd[3753855]: (?@138.117.78.106) [WARNING] Authentication failed for user [smtp.zoho.com587hr@lezzarotech.com]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.57
country_id: 1733045
description:
2025-12-25 18:44:08 dovecot_login authenticator failed for H=([49.124.151.57]) [49.124.151.57]:60568: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.149.183.243
country_id: 3017382
description:
2025-12-25 18:43:30 dovecot_login authenticator failed for H=static-css-cqn-183243.business.bouyguestelecom.com [176.149.183.243]:47418: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-25 18:45:21 dovecot_login authenticator failed for H=([152.52.206.188]) [152.52.192.74]:38838: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-12-25 18:46:07 dovecot_login authenticator failed for H=([82.102.165.200]) [82.102.165.200]:40999: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 18:46:40 host2 pure-ftpd[3759363]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-25 18:51:27 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:48265: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 25 18:51:30 host2 sshd[3764821]: Disconnected from invalid user rancid 42.200.78.78 port 44778 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-12-25 18:51:56 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:59809: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Dec 25 18:53:13 host2 sshd[3766389]: Disconnected from invalid user admin 42.200.78.78 port 51444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 25 18:53:30 host2 sshd[3766559]: Disconnected from invalid user forward 43.155.21.198 port 36902 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 25 18:54:44 host2 sshd[3768019]: Disconnected from invalid user app 43.155.21.198 port 51440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Dec 25 18:55:41 host2 sshd[3769172]: Disconnected from invalid user postgres 128.1.131.163 port 38606 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.131.163
country_id: 1819730
description:
Dec 25 18:56:18 host2 sshd[3769827]: Disconnected from invalid user tiptop 128.1.131.163 port 51416 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 18:58:59 host2 sshd[3772677]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.142
country_id: 3144096
description:
2025-12-25 19:04:43 dovecot_login authenticator failed for H=([178.232.138.142]) [178.232.138.142]:39532: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-25 19:05:33 dovecot_login authenticator failed for H=([187.51.252.236]) [186.201.54.90]:35569: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 25 19:09:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS: read(size=704) failed: Connection reset by peer, session=<r7gg6MZGSORChJly>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 19:14:07 host2 sshd[3790911]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.208.161
country_id: 2921044
description:
Dec 25 19:15:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=207.154.208.161, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<Sara/MZG60DPmtCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.128.203.219
country_id: 2921044
description:
Dec 25 19:15:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=178.128.203.219, lip=66.85.158.92, TLS handshaking: Connection closed, session=<JyX6/sZGwoaygMvb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-25 19:19:20 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:50550: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-25 19:19:48 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:49009: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.51
country_id: 6252001
description:
Dec 25 19:24:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.51, lip=66.85.158.91, TLS: Connection closed, session=<2VPdG8dGjlOnXpIz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.152
country_id: 6252001
description:
Dec 25 19:28:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gAgZK8dGlBtAPsWY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.152
country_id: 6252001
description:
Dec 25 19:28:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Bh0rLMdG5ttAPsWY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-25 19:31:09 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:57384: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 19:32:36 host2 sshd[3814959]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.85.65
country_id: 1880251
description:
Dec 25 19:34:57 host2 sshd[3817676]: Disconnected from invalid user www-data 167.172.85.65 port 31202 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:36:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Y5sMR8dGns2i2JVQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:36:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<IS3ESMdG3Oqi2JVQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.172.85.65
country_id: 1880251
description:
Dec 25 19:36:49 host2 sshd[3820065]: Disconnected from invalid user pacs 167.172.85.65 port 11478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.129.41.91
country_id: 1643084
description:
Dec 25 19:36:54 host2 sshd[3820170]: Disconnected from invalid user admin 43.129.41.91 port 49438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 25 19:36:56 host2 sshd[3820239]: Disconnected from invalid user ubuntu 35.210.61.208 port 48032 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:37:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<Cmw3TMdG+vai2JVQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 25 19:39:03 host2 sshd[3822652]: Disconnected from invalid user ftpuser 144.31.195.14 port 52500 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.138
country_id: 1819730
description:
Dec 25 19:39:15 host2 sshd[3822831]: Disconnected from invalid user pacs 150.5.169.138 port 40146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.122
country_id: 1880251
description:
Dec 25 19:40:06 host2 sshd[3823865]: Disconnected from invalid user user 45.78.201.122 port 48572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.129.41.91
country_id: 1643084
description:
Dec 25 19:39:19 host2 sshd[3822945]: Disconnected from invalid user pzuser 43.129.41.91 port 47846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 25 19:39:30 host2 sshd[3823129]: Disconnected from invalid user oe 144.31.195.14 port 58000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.138
country_id: 1819730
description:
Dec 25 19:39:30 host2 sshd[3823131]: Disconnected from invalid user pzuser 150.5.169.138 port 52124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 25 19:40:38 host2 sshd[3824660]: Disconnected from invalid user kostas 146.59.95.254 port 48804 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 25 19:40:56 host2 sshd[3825068]: Received disconnect from 144.31.195.14 port 55346:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.31.195.14
country_id: 6252001
description:
Dec 25 19:41:24 host2 sshd[3825766]: Disconnected from invalid user qa 144.31.195.14 port 51204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 25 19:41:32 host2 sshd[3825963]: Disconnected from invalid user ubuntu 162.240.212.247 port 60832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Dec 25 19:41:38 host2 sshd[3826017]: Disconnected from invalid user admin 103.31.39.143 port 59100 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:42:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<rZeyX8dGgOei2JVQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.143
country_id: 1643084
description:
Dec 25 19:43:04 host2 sshd[3827775]: Disconnected from invalid user panda 103.31.39.143 port 42764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Dec 25 19:42:32 host2 sshd[3827156]: Disconnected from invalid user firewall 35.210.61.208 port 37612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 25 19:44:06 host2 sshd[3828846]: Disconnected from invalid user vpn 162.240.212.247 port 33278 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.124.62.2
country_id: 2658434
description:
Dec 25 19:44:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.124.62.2, lip=66.85.158.92, TLS: Connection closed, session=<l+x/Y8dGJJOKfD4C>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 25 19:45:12 host2 sshd[3830458]: Disconnected from invalid user ftpuser 190.181.27.22 port 35376 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:46:00 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS, session=<aFaPasdGauui2JVQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.118.34.82
country_id: 1269750
description:
Dec 25 19:46:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=45.118.34.82, lip=66.85.158.91, TLS, session=<Nt8ibMdGTaUtdiJS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.80
country_id: 6252001
description:
Dec 25 19:46:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.80, lip=66.85.158.91, TLS, session=<fUZ+bcdGrPei2JVQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.137.252
country_id: 690791
description:
Dec 25 19:47:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=91.234.137.252, lip=66.85.158.91, TLS, session=<UHpdbcdGc9db6on8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 19:49:45 host2 pure-ftpd[3835257]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 25 19:51:36 host2 sshd[3837765]: Disconnected from invalid user papa 107.175.89.172 port 59338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.122
country_id: 1880251
description:
Dec 25 19:51:57 host2 sshd[3838597]: Disconnected from invalid user tester 45.78.201.122 port 60252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 25 19:55:37 host2 sshd[3842917]: Disconnected from invalid user es_user 107.175.89.172 port 32962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 25 19:57:12 host2 sshd[3844567]: Disconnected from invalid user terra 107.175.89.172 port 44162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.17.58.173
country_id: 2921044
description:
Dec 25 19:57:53 host2 sshd[3845341]: Disconnected from invalid user mac 178.17.58.173 port 59364 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.13
country_id: 798549
description:
Dec 25 19:59:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.13, lip=66.85.158.91, TLS: Connection closed, session=<A55XmsdGTttV2YwN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.28.222.221
country_id: 2264397
description:
Dec 25 19:59:24 host2 sshd[3847135]: Disconnected from invalid user portal 62.28.222.221 port 36620 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.28.222.221
country_id: 2264397
description:
Dec 25 20:00:09 host2 sshd[3848281]: Disconnected from invalid user kevin 62.28.222.221 port 6123 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 25 20:00:24 host2 sshd[3848577]: Disconnected from invalid user admin 2.57.121.112 port 28749 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.28.222.221
country_id: 2264397
description:
Dec 25 20:00:49 host2 sshd[3849022]: Disconnected from invalid user andy 62.28.222.221 port 10097 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.150.253
country_id: 2635167
description:
Dec 25 20:02:52 host2 sshd[3850940]: Disconnected from invalid user roy 138.68.150.253 port 44820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.17.58.173
country_id: 2921044
description:
Dec 25 20:03:50 host2 sshd[3852035]: Disconnected from invalid user next 178.17.58.173 port 58056 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.17.58.173
country_id: 2921044
description:
Dec 25 20:04:29 host2 sshd[3852687]: Disconnected from invalid user ehsan 178.17.58.173 port 59774 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.252.150.207
country_id: 6252001
description:
[2025-12-25 20:06:47 +0530] info [cpaneld] 73.252.150.207 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.33.105.41
country_id: 6252001
description:
[2025-12-25 20:06:41 +0530] info [cpaneld] 98.33.105.41 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.195.24.33
country_id: 6252001
description:
[2025-12-25 20:06:42 +0530] info [cpaneld] 68.195.24.33 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.247.219.77
country_id: 6252001
description:
[2025-12-25 20:06:46 +0530] info [whostmgrd] 67.247.219.77 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.55.247.96
country_id: 6252001
description:
[2025-12-25 20:06:49 +0530] info [cpaneld] 184.55.247.96 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.16.224.121
country_id: 6252001
description:
[2025-12-25 20:06:50 +0530] info [cpaneld] 70.16.224.121 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.97.109.15
country_id: 6252001
description:
[2025-12-25 20:06:48 +0530] info [cpaneld] 99.97.109.15 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.23.70.13
country_id: 6252001
description:
[2025-12-25 20:06:59 +0530] info [cpaneld] 69.23.70.13 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.243.74.105
country_id: 6252001
description:
[2025-12-25 20:07:03 +0530] info [cpaneld] 108.243.74.105 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.229.175.188
country_id: 6252001
description:
[2025-12-25 20:07:02 +0530] info [cpaneld] 71.229.175.188 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.2.104
country_id: 6252001
description:
[2025-12-25 20:06:45 +0530] info [cpaneld] 98.97.2.104 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.218.52.234
country_id: 6252001
description:
[2025-12-25 20:06:51 +0530] info [cpaneld] 73.218.52.234 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.162.176.167
country_id: 6252001
description:
[2025-12-25 20:07:01 +0530] info [cpaneld] 47.162.176.167 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.242.14.23
country_id: 6252001
description:
[2025-12-25 20:07:00 +0530] info [cpaneld] 23.242.14.23 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2025-12-25 20:08:54 dovecot_login authenticator failed for H=([125.17.225.97]) [182.95.61.82]:43970: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.15.194
country_id: 3469034
description:
2025-12-25 20:09:36 dovecot_login authenticator failed for H=([200.195.15.194]) [200.195.15.194]:53747: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 25 20:10:25 host2 sshd[3859246]: Disconnected from invalid user igor 107.175.89.172 port 54628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.52.243
country_id: 3144096
description:
2025-12-25 20:21:52 dovecot_login authenticator failed for H=([84.215.52.243]) [84.215.52.243]:60606: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-12-25 20:22:06 dovecot_login authenticator failed for H=([59.98.144.36]) [59.98.144.36]:55828: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-25 20:23:21 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:43012: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 20:24:01 host2 sshd[3875068]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-25 20:23:50 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:33946: 535 Incorrect authentication data (set_id=washeera)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 38.58.182.203
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 38.58.182.203: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.133.161
country_id: 3175395
description:
Dec 25 20:29:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.63.133.161, lip=66.85.158.91, TLS, session=<VmffBMhG6+u5P4Wh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.88
country_id: 3469034
description:
Dec 25 20:29:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=168.0.224.88, lip=66.85.158.91, TLS, session=<waj4BchGxOaoAOBY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.175.164
country_id: 130758
description:
Dec 25 20:35:57 host2 sshd[3889459]: Disconnected from invalid user server2 185.208.175.164 port 41312 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.208.175.164
country_id: 130758
description:
Dec 25 20:38:31 host2 sshd[3891979]: Received disconnect from 185.208.175.164 port 60618:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.175.164
country_id: 130758
description:
Dec 25 20:38:31 host2 sshd[3891979]: Disconnected from invalid user lighthouse 185.208.175.164 port 60618 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.55.249.98
country_id: 6252001
description:
Dec 25 20:37:38 host2 sshd[3891191]: Disconnected from invalid user administrator 45.55.249.98 port 49120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.175.164
country_id: 130758
description:
Dec 25 20:39:01 host2 sshd[3892344]: Disconnected from invalid user steam 185.208.175.164 port 41900 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.208.175.164
country_id: 130758
description:
Dec 25 20:39:34 host2 sshd[3892891]: Disconnected from invalid user test 185.208.175.164 port 51418 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 20:45:02 host2 sshd[3898904]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.89.27.65
country_id: 2921044
description:
Dec 25 20:48:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=159.89.27.65, lip=66.85.158.92, TLS handshaking: Connection closed, session=<2MtFSMhGbOSfWRtB>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 20:52:49 host2 pure-ftpd[3907536]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.140
country_id: 798544
description:
Dec 25 20:54:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=128.127.94.140, lip=66.85.158.91, TLS, session=<R79sXchGau2Af16M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.26.178.124
country_id: 3175395
description:
Dec 25 20:53:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=217.26.178.124, lip=66.85.158.91, TLS, session=<b8RaXMhGA6fZGrJ8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-25 20:54:44 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:65062: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Dec 25 21:00:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, session=<5Nz9dMhGtN24affE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Dec 25 21:00:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.247.196, lip=66.85.158.91, TLS: Connection closed, session=<vobkdchGRvW4affE>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 38.58.182.203
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 38.58.182.203: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-25 21:08:14 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:41558: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.234
country_id: 6252001
description:
Dec 25 21:08:19 host2 pure-ftpd[3926344]: (?@205.210.31.234) [INFO] New connection from 205.210.31.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-12-25 21:08:49 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:58552: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-25 21:14:20 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:47536: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2025-12-25 21:15:12 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:38922: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.77.220.244
country_id: 6252001
description:
[2025-12-25 21:15:55 +0530] info [webmaild] 185.77.220.244 - info@nsteeleng.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.105
country_id: 2635167
description:
Dec 25 21:17:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=35.203.211.105, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<L0d5schGHd8jy9Np>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.105
country_id: 2635167
description:
Dec 25 21:18:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.211.105, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<cXuDtshGLO8jy9Np>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.58.14
country_id: 1269750
description:
Dec 25 21:20:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.237.58.14, lip=66.85.158.91, TLS, session=<8qIiu8hGRIVn7ToO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.103
country_id: 3175395
description:
Dec 25 21:20:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=185.197.8.103, lip=66.85.158.91, TLS, session=<KZkdu8hGXoK5xQhn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.232.165.129
country_id: 798544
description:
Dec 25 21:20:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact>, method=PLAIN, rip=91.232.165.129, lip=66.85.158.91, TLS, session=<BqRAvMhGzoxb6KWB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.157.68
country_id: 690791
description:
Dec 25 21:20:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=37.221.157.68, lip=66.85.158.91, TLS, session=<+ig/vMhG4qIl3Z1E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 48.214.144.191
country_id: 6252001
description:
Dec 25 21:25:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=48.214.144.191, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9JcZzshGEuQw1pC/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.105
country_id: 2635167
description:
Dec 25 21:25:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.105, lip=66.85.158.92, TLS, session=<kVT5z8hGrugjy9Np>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 25 21:32:18 host2 sshd[3952547]: Disconnected from invalid user admin 2.57.121.112 port 39564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-25 21:35:38 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:37087: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.27.184
country_id: 6252001
description:
Dec 25 21:36:49 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.83.27.184, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<ELHa9shGGtcUUxu4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.105.176
country_id: 3469034
description:
Dec 25 21:39:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=187.120.105.176, lip=66.85.158.91, TLS, session=<UchM/8hGkpe7eGmw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.85.111.248
country_id: 3469034
description:
Dec 25 21:39:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=187.85.111.248, lip=66.85.158.91, TLS, session=</nORAMlGhJG7VW/4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-25 21:40:04 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:18401: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-25 21:40:36 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:28427: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.188
country_id: 6252001
description:
Dec 25 21:43:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.188, lip=66.85.158.91, session=<JoxPDslGefxAPsW8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.81
country_id: 6252001
description:
Dec 25 21:43:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.81, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ayfJDslGgzlBMQFR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Dec 25 21:43:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.182, lip=66.85.158.91, TLS: Connection closed, session=<eFUVD8lGUmdAPsW2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Dec 25 21:43:48 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<g4/aD8lGKqlBMQFQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.141
country_id: 6252001
description:
Dec 25 21:48:02 host2 pure-ftpd[3986594]: (?@147.185.132.141) [INFO] New connection from 147.185.132.141


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 25 21:48:04 host2 sshd[3986613]: Disconnected from invalid user gabriel 199.195.248.191 port 52844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Dec 25 21:50:17 host2 sshd[3988720]: Disconnected from invalid user opscode 152.32.189.21 port 56148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Dec 25 21:51:17 host2 sshd[3989717]: Disconnected from invalid user titus 106.51.1.63 port 53890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Dec 25 21:51:43 host2 sshd[3990053]: Disconnected from invalid user test1 101.36.119.50 port 51978 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.189.21
country_id: 1819730
description:
Dec 25 21:50:53 host2 sshd[3989269]: Disconnected from invalid user ravi 152.32.189.21 port 59538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Dec 25 21:51:57 host2 sshd[3990284]: Disconnected from invalid user suriya 106.51.1.63 port 37382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 25 21:52:32 host2 sshd[3990837]: Disconnected from invalid user alex 199.195.248.191 port 43434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.1.63
country_id: 1269750
description:
Dec 25 21:52:33 host2 sshd[3990855]: Disconnected from invalid user l 106.51.1.63 port 49128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Dec 25 21:54:54 host2 sshd[3993492]: Disconnected from invalid user khalil 101.36.119.50 port 34524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 25 21:54:57 host2 sshd[3993541]: Disconnected from invalid user h 64.227.176.54 port 55662 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 21:55:43 host2 pure-ftpd[3994579]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 25 21:56:14 host2 sshd[3995088]: Disconnected from invalid user developer 64.227.176.54 port 45190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.44.99.206
country_id: 2300660
description:
Dec 25 21:56:35 host2 sshd[3995446]: Disconnected from invalid user hadoop 196.44.99.206 port 38110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 25 21:56:54 host2 sshd[3995775]: Disconnected from invalid user oracle 201.76.120.30 port 42654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2025-12-25 21:59:19 dovecot_login authenticator failed for H=(Ws1YuG5Y) [158.94.208.110]:54520: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2025-12-25 21:59:43 dovecot_login authenticator failed for H=(b4V4FFxc9G) [158.94.208.110]:62642: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 25 21:59:44 host2 sshd[3998678]: Disconnected from invalid user testuser 201.76.120.30 port 41554 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.110
country_id: 2921044
description:
2025-12-25 22:00:30 dovecot_login authenticator failed for H=(ZGj5H0zdh) [158.94.208.110]:62035: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 25 22:01:31 host2 sshd[4000727]: Disconnected from invalid user sipv 64.227.176.54 port 46292 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.61.37.18
country_id: 2300660
description:
Dec 25 22:01:56 host2 sshd[4001098]: Disconnected from invalid user webuser 196.61.37.18 port 50376 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec 25 22:03:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<D7+hVMlG5R9APpzU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Dec 25 22:03:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<eTqkVclGMIpAPpzU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 22:10:13 host2 sshd[4009707]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 25 22:11:59 host2 sshd[4011318]: Disconnected from invalid user admin 2.57.121.112 port 28367 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.148
country_id: 6252001
description:
Dec 25 22:18:41 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.148, lip=66.85.158.91, TLS: Connection closed, session=<pFCXjMlGEsnHLZqU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.222.54
country_id: 1269750
description:
2025-12-25 22:19:45 dovecot_login authenticator failed for H=(aes-static-089.140.22.125.airtel.in) [122.187.222.54]:58514: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2025-12-25 22:20:05 dovecot_login authenticator failed for H=([74.195.53.129]) [74.195.53.129]:48186: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.243
country_id: 3469034
description:
Dec 25 22:26:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=179.189.201.243, lip=66.85.158.91, TLS, session=<LGKlpclGdcqzvcnz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.171.35
country_id: 3469034
description:
Dec 25 22:26:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=177.130.171.35, lip=66.85.158.91, TLS, session=<d6bppslGcMCxgqsj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 22:31:12 host2 sshd[4030134]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Dec 25 22:33:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=167.94.146.60, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<RyddwslG4LmnXpI8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.180
country_id: 6252001
description:
Dec 25 22:35:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.180, lip=66.85.158.92, session=<bJxzx8lGuYVBMQG0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Dec 25 22:35:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.172, lip=66.85.158.92, TLS: Connection closed, session=<YnosyMlGOOhBMQGs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 25 22:35:43 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<deuEyclGMJ7PWvQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.109
country_id: 2186224
description:
2025-12-25 22:39:17 dovecot_login authenticator failed for H=([121.73.169.109]) [121.73.169.109]:46464: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-12-25 22:39:44 dovecot_login authenticator failed for H=([65.20.185.185]) [65.20.185.185]:43178: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.50.103.212
country_id: 1605651
description:
Dec 25 22:45:28 host2 sshd[4045866]: Disconnected from invalid user jenkins 147.50.103.212 port 42840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.36.180
country_id: 2921044
description:
Dec 25 22:45:33 host2 sshd[4045919]: Disconnected from invalid user deploy 167.71.36.180 port 57752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.50.103.212
country_id: 1605651
description:
Dec 25 22:46:51 host2 sshd[4047193]: Disconnected from invalid user delme 147.50.103.212 port 38030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2025-12-25 22:47:33 dovecot_login authenticator failed for H=(nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:54558: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.36.180
country_id: 2921044
description:
Dec 25 22:48:13 host2 sshd[4048457]: Disconnected from invalid user auditor 167.71.36.180 port 11498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-25 22:51:41 dovecot_login authenticator failed for H=([182.95.51.166]) [182.95.51.166]:56526: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-12-25 22:52:00 dovecot_login authenticator failed for H=(78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:52556: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 160.202.34.42
country_id: 1831722
description:
Dec 25 22:53:09 host2 pure-ftpd[4054182]: (?@160.202.34.42) [INFO] New connection from 160.202.34.42


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 25 22:58:19 host2 pure-ftpd[4060806]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.70.126.83
country_id: 1269750
description:
Dec 25 23:11:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.70.126.83, lip=66.85.158.91, TLS, session=<uneyRspGr8FnRn5T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.66
country_id: 933860
description:
Dec 25 23:11:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.216.209.66, lip=66.85.158.91, TLS, session=<sacaSMpGqqcp2NFC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 25 23:12:40 host2 sshd[4079511]: Disconnected from invalid user user 2.57.121.25 port 18620 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 212.73.148.11
country_id: 798549
description:
Dec 25 23:12:59 host2 pure-ftpd[4079908]: (?@212.73.148.11) [INFO] New connection from 212.73.148.11


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 212.73.148.11
country_id: 798549
description:
Dec 25 23:13:26 host2 pure-ftpd[4080411]: (?@212.73.148.11) [INFO] New connection from 212.73.148.11


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 212.73.148.11
country_id: 798549
description:
Dec 25 23:13:31 host2 pure-ftpd[4080491]: (?@212.73.148.11) [INFO] New connection from 212.73.148.11


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2025-12-25 23:17:29 +0530] info [cpaneld] 38.35.225.197 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Dec 25 23:18:18 host2 sshd[4085261]: Disconnected from invalid user git 124.155.125.131 port 33704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Dec 25 23:19:26 host2 sshd[4086562]: Disconnected from invalid user info 146.190.93.207 port 50224 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.126.219
country_id: 6252001
description:
Dec 25 23:19:36 host2 pure-ftpd[4086761]: (?@135.237.126.219) [INFO] New connection from 135.237.126.219


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.155.125.131
country_id: 1861060
description:
Dec 25 23:23:44 host2 sshd[4092482]: Disconnected from invalid user vpn 124.155.125.131 port 58044 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.155.125.131
country_id: 1861060
description:
Dec 25 23:24:18 host2 sshd[4093039]: Disconnected from invalid user cod4server 124.155.125.131 port 51904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Dec 25 23:25:30 host2 sshd[4094442]: Disconnected from invalid user summer 146.190.93.207 port 50922 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Dec 25 23:25:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.70, lip=66.85.158.91, TLS handshaking: Connection closed, session=<cLYPfcpG+I+4aYtG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Dec 25 23:26:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=184.105.139.70, lip=66.85.158.91, TLS: Connection closed, session=<seQpf8pGlg64aYtG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.131.159
country_id: 6252001
description:
Dec 25 23:27:08 host2 sshd[4096378]: Invalid user cloudtourssrilan_travel from 124.198.131.159 port 51853


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.93.207
country_id: 1880251
description:
Dec 25 23:27:19 host2 sshd[4096549]: Disconnected from invalid user user1 146.190.93.207 port 58106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2025-12-25 23:28:31 dovecot_login authenticator failed for H=([182.95.119.30]) [182.95.119.30]:40524: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-12-25 23:29:07 dovecot_login authenticator failed for H=([122.187.234.56]) [122.187.234.56]:54602: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-25 23:29:35 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:33874: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2025-12-25 23:31:58 dovecot_login authenticator failed for H=([182.95.85.212]) [182.95.123.202]:60686: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2025-12-25 23:32:15 dovecot_login authenticator failed for H=([176.30.212.99]) [176.30.212.99]:40350: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.150
country_id: 6252001
description:
Dec 25 23:41:38 host2 pure-ftpd[4111731]: (?@195.184.76.150) [INFO] New connection from 195.184.76.150


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.84
country_id: 6252001
description:
Dec 25 23:41:38 host2 pure-ftpd[4111735]: (?@195.184.76.84) [INFO] New connection from 195.184.76.84


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-12-25 23:43:19 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:47386: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.26.214.147
country_id: 6252001
description:
Dec 25 23:45:15 host2 sshd[4115663]: Disconnected from invalid user solar 154.26.214.147 port 58990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-25 23:45:34 dovecot_login authenticator failed for H=([59.145.74.209]) [122.184.120.98]:50456: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.26.214.147
country_id: 6252001
description:
Dec 25 23:45:51 host2 sshd[4116310]: Disconnected from invalid user dd 154.26.214.147 port 44742 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-25 23:46:03 dovecot_login authenticator failed for H=([128.185.13.33]) [122.184.123.118]:47968: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Dec 25 23:47:43 host2 sshd[4117899]: Disconnected from invalid user deploy 103.231.14.54 port 42072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.26.214.147
country_id: 6252001
description:
Dec 25 23:49:42 host2 sshd[4119741]: Disconnected from invalid user webadm 154.26.214.147 port 43948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 25 23:50:18 host2 sshd[4120517]: Disconnected from invalid user user 2.57.121.25 port 6507 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.231.14.54
country_id: 1819730
description:
Dec 25 23:50:24 host2 sshd[4120631]: Disconnected from invalid user fernando 103.231.14.54 port 33168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Dec 25 23:51:43 host2 sshd[4122009]: Disconnected from invalid user team06 103.231.14.54 port 57136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.180
country_id: 690791
description:
Dec 25 23:53:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=185.17.124.180, lip=66.85.158.91, TLS, session=<Hers3MpGWo+5EXy0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Dec 25 23:52:21 host2 sshd[4122570]: Disconnected from invalid user liam 103.231.14.54 port 42838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.25
country_id: 3175395
description:
Dec 25 23:52:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=217.26.178.25, lip=66.85.158.91, TLS, session=<j7vd28pGKuDZGrIZ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 25 23:55:58 host2 sshd[4126690]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.249.23
country_id: 3865483
description:
Dec 25 23:56:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=179.0.249.23, lip=66.85.158.91, TLS, session=<Mfjp6MpGIYizAPkX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.157
country_id: 2510769
description:
Dec 25 23:56:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=139.28.190.157, lip=66.85.158.91, TLS, session=<zw0y6spGh92LHL6d>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 00:00:52 host2 pure-ftpd[4131950]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 00:07:23 host2 sshd[4139243]: Disconnected from invalid user admin 2.57.121.112 port 29102 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.121.123.108
country_id: 6252001
description:
Dec 26 00:07:48 host2 pure-ftpd[4139610]: (?@20.121.123.108) [INFO] New connection from 20.121.123.108


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 69.164.217.245
country_id: 6252001
description:
Dec 26 00:10:10 host2 pure-ftpd[4142374]: (?@69.164.217.245) [INFO] New connection from 69.164.217.245


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.132.137
country_id: 1819730
description:
Dec 26 00:10:39 host2 sshd[4142878]: Disconnected from invalid user sumit 128.1.132.137 port 50640 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.184
country_id: 6252001
description:
Dec 26 00:11:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.184, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<PDWzH8tGFtnG6xi4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.164.217.74
country_id: 6252001
description:
Dec 26 00:11:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=69.164.217.74, lip=66.85.158.91, session=<GpW+H8tGkulFpNlK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.1.132.137
country_id: 1819730
description:
Dec 26 00:15:20 host2 sshd[4148202]: Disconnected from invalid user zenith 128.1.132.137 port 44040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.254.166.14
country_id: 1269750
description:
Dec 26 00:15:24 host2 sshd[4148241]: Disconnected from invalid user user 205.254.166.14 port 16495 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.233.151.14
country_id: 3469034
description:
Dec 26 00:15:53 host2 sshd[4148642]: Disconnected from invalid user dev 170.233.151.14 port 44066 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 00:16:51 host2 sshd[4149510]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.233.151.14
country_id: 3469034
description:
Dec 26 00:17:05 host2 sshd[4149744]: Disconnected from invalid user sumit 170.233.151.14 port 51876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.233.151.14
country_id: 3469034
description:
Dec 26 00:16:30 host2 sshd[4149193]: Disconnected from invalid user ubuntu 170.233.151.14 port 57658 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-26 00:17:47 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:38082: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Dec 26 00:18:15 host2 sshd[4150787]: Disconnected from invalid user admin 103.182.132.154 port 50102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.233.151.14
country_id: 3469034
description:
Dec 26 00:18:53 host2 sshd[4151363]: Disconnected from invalid user minecraft 170.233.151.14 port 58828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-26 00:19:03 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:49866: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.154
country_id: 732800
description:
2025-12-26 00:19:11 dovecot_login authenticator failed for H=(92.62.243.154.fibermax.bg) [92.62.243.154]:39270: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-26 00:22:35 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:64477: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 00:24:10 host2 sshd[4156437]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.254.166.14
country_id: 1269750
description:
Dec 26 00:26:47 host2 sshd[4159612]: Disconnected from invalid user runner 205.254.166.14 port 59416 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.114.175.11
country_id: 2510769
description:
Dec 26 00:27:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.114.175.11, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=</QbXWctGf+i5cq8L>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.202.97.215
country_id: 3865483
description:
Dec 26 00:31:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=143.202.97.215, lip=66.85.158.91, TLS, session=<RFKYZstGBsKPymHX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.172
country_id: 3175395
description:
Dec 26 00:31:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=217.26.179.172, lip=66.85.158.91, TLS, session=<KZjOZ8tGZYLZGrOs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 26 00:37:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<Mr68fctG1JuLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-26 00:39:03 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:32840: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-12-26 00:39:22 dovecot_login authenticator failed for H=(223-197-145-141.static.imsbiz.com) [223.197.145.141]:56071: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 26 00:39:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<ThSnhctGpOWLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 00:44:53 host2 sshd[4177194]: Disconnected from invalid user admin 2.57.121.112 port 24472 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 177.44.71.80
country_id: 3469034
description:
Dec 26 00:49:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=177.44.71.80, lip=66.85.158.91, TLS, session=<6Yg8pctGGd6xLEdQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.211.194
country_id: 933860
description:
Dec 26 00:49:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.216.211.194, lip=66.85.158.91, TLS, session=<IouDpstGAscp2NPC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-26 00:57:37 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:38252: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-26 00:58:01 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:33989: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 01:04:27 host2 sshd[3689]: Disconnected from invalid user user 2.57.121.25 port 25644 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.181
country_id: 6252001
description:
Dec 26 01:10:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=45.79.207.181, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<I1FT88tGvrgtT8+1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Dec 26 01:10:51 host2 sshd[9936]: Disconnected from invalid user hz 103.49.239.184 port 38744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-26 01:11:14 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:54804: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.216.116.13
country_id: 1819730
description:
Dec 26 01:13:43 host2 sshd[13174]: Disconnected from invalid user ubuntu 185.216.116.13 port 48160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-12-26 01:14:31 dovecot_login authenticator failed for H=(nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:54948: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Dec 26 01:14:46 host2 sshd[14288]: Disconnected from invalid user ubuntu 23.91.96.70 port 41370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Dec 26 01:15:05 host2 sshd[14689]: Disconnected from invalid user ubuntu 185.216.116.13 port 43578 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.239.184
country_id: 1643084
description:
Dec 26 01:18:03 host2 sshd[17806]: Disconnected from invalid user ubuntu 103.49.239.184 port 44060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.184
country_id: 1643084
description:
Dec 26 01:17:20 host2 sshd[16994]: Disconnected from invalid user odoo 103.49.239.184 port 34410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.216.116.13
country_id: 1819730
description:
Dec 26 01:18:13 host2 sshd[17987]: Disconnected from invalid user erp 185.216.116.13 port 46228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.91.96.70
country_id: 1819730
description:
Dec 26 01:19:50 host2 sshd[19366]: Disconnected from invalid user admin 23.91.96.70 port 56590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 01:21:58 host2 sshd[21928]: Disconnected from invalid user admin 2.57.121.112 port 61619 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-12-26 01:22:22 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:58678: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-12-26 01:22:47 dovecot_login authenticator failed for H=042.36.246.220.static.netvigator.com [220.246.36.42]:52848: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.127.133
country_id: 6252001
description:
Dec 26 01:24:00 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.127.133, lip=66.85.158.92, TLS, session=<ZxJVI8xGGr6s7H+F>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.91.96.70
country_id: 1819730
description:
Dec 26 01:26:41 host2 sshd[26782]: Disconnected from invalid user abc1 23.91.96.70 port 50006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.112.242
country_id: 1880251
description:
Dec 26 01:26:55 host2 sshd[27008]: Disconnected from invalid user www-data 107.150.112.242 port 43486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.112.242
country_id: 1880251
description:
Dec 26 01:27:33 host2 sshd[27626]: Disconnected from invalid user jenkins 107.150.112.242 port 55626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.112.242
country_id: 1880251
description:
Dec 26 01:29:23 host2 sshd[29510]: Disconnected from invalid user administrator 107.150.112.242 port 35576 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.112.242
country_id: 1880251
description:
Dec 26 01:29:59 host2 sshd[30099]: Disconnected from invalid user portal 107.150.112.242 port 47710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.158.114
country_id: 1512440
description:
Dec 26 01:30:12 host2 sshd[30472]: Disconnected from invalid user administrator 45.138.158.114 port 33514 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.188.180
country_id: 1819730
description:
2025-12-26 01:31:15 dovecot_login authenticator failed for H=180.188.76.219.static.netvigator.com [219.76.188.180]:61375: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.158.114
country_id: 1512440
description:
Dec 26 01:31:42 host2 sshd[32256]: Disconnected from invalid user xcc 45.138.158.114 port 34266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 01:31:46 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:34670: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.138.158.114
country_id: 1512440
description:
Dec 26 01:32:38 host2 sshd[33171]: Disconnected from invalid user portal 45.138.158.114 port 32884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.138.158.114
country_id: 1512440
description:
Dec 26 01:35:07 host2 sshd[35690]: Disconnected from invalid user servidor 45.138.158.114 port 52872 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 38.58.182.203
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 38.58.182.203: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 01:41:10 host2 sshd[42024]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 01:41:17 host2 sshd[42106]: Disconnected from invalid user user 2.57.121.25 port 22421 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 187.85.105.233
country_id: 3469034
description:
Dec 26 01:42:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=187.85.105.233, lip=66.85.158.91, TLS, session=<UJApZMxGkKK7VWnp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.28.188
country_id: 933860
description:
Dec 26 01:42:48 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=83.143.28.188, lip=66.85.158.91, TLS, session=<WZ5nZcxGIL1Tjxy8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-12-26 01:49:19 dovecot_login authenticator failed for H=([83.136.176.12]) [83.136.176.12]:40951: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2025-12-26 01:49:50 dovecot_login authenticator failed for H=([152.52.144.161]) [128.185.212.178]:60668: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.88.28.122
country_id: 1643084
description:
Dec 26 01:54:49 host2 sshd[56968]: Disconnected from invalid user teste 36.88.28.122 port 37816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.88.28.122
country_id: 1643084
description:
Dec 26 01:55:40 host2 sshd[57936]: Disconnected from invalid user ubuntu 36.88.28.122 port 46392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.158.254.18
country_id: 241170
description:
Dec 26 01:56:12 host2 sshd[58539]: Disconnected from invalid user es 197.158.254.18 port 38816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.79
country_id: 2635167
description:
Dec 26 01:58:04 host2 sshd[60735]: Disconnected from invalid user leo 185.196.9.79 port 42640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 01:58:58 host2 sshd[61643]: Disconnected from invalid user admin 2.57.121.112 port 49532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Dec 26 02:00:05 host2 sshd[62879]: Disconnected from invalid user user 34.92.81.41 port 51736 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 02:01:54 host2 sshd[64683]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.9.79
country_id: 2635167
description:
Dec 26 02:02:41 host2 sshd[65378]: Disconnected from invalid user oracle 185.196.9.79 port 33804 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.233
country_id: 6252001
description:
Dec 26 02:03:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.233, lip=66.85.158.92, session=<sXErr8xG1OBHBobp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.9.79
country_id: 2635167
description:
Dec 26 02:03:48 host2 sshd[66444]: Disconnected from invalid user tiktok 185.196.9.79 port 60070 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 69.164.217.74
country_id: 6252001
description:
Dec 26 02:03:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=69.164.217.74, lip=66.85.158.91, session=<QQy5sMxGn8JFpNlK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.114.250
country_id: 1643084
description:
Dec 26 02:04:56 host2 sshd[67610]: Disconnected from invalid user rftest 103.52.114.250 port 40890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Dec 26 02:05:35 host2 sshd[68393]: Disconnected from invalid user agotoz 34.92.81.41 port 51450 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 02:05:40 host2 pure-ftpd[68490]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.114.250
country_id: 1643084
description:
Dec 26 02:05:32 host2 sshd[68342]: Disconnected from invalid user gera 103.52.114.250 port 39500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.199.196
country_id: 1861060
description:
Dec 26 02:05:23 host2 sshd[68204]: Disconnected from invalid user scan 134.122.199.196 port 36524 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 134.122.199.196
country_id: 1861060
description:
Dec 26 02:07:00 host2 sshd[69759]: Received disconnect from 134.122.199.196 port 46688:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 134.122.199.196
country_id: 1861060
description:
Dec 26 02:06:12 host2 sshd[69086]: Disconnected from invalid user ec2-user 134.122.199.196 port 59056 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Dec 26 02:10:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Gbn8yMxGsDnUZija>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.37.113
country_id: 6252001
description:
Dec 26 02:11:10 host2 sshd[74394]: Disconnected from invalid user ubuntu 23.94.37.113 port 36586 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 23.94.37.113
country_id: 6252001
description:
Dec 26 02:11:38 host2 sshd[74758]: Received disconnect from 23.94.37.113 port 48988:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.94.37.113
country_id: 6252001
description:
Dec 26 02:13:59 host2 sshd[77325]: Disconnected from invalid user pablo 23.94.37.113 port 54094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.81.41
country_id: 1819730
description:
Dec 26 02:14:47 host2 sshd[78338]: Disconnected from invalid user filippo 34.92.81.41 port 50100 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.111
country_id: 6252001
description:
Dec 26 02:15:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.111, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Atkf3MxGQ93G6xhv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.224.173.151
country_id: 3175395
description:
2025-12-26 02:26:14 dovecot_login authenticator failed for H=([83.224.173.151]) [83.224.173.151]:56986: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.154.83.24
country_id: 1605651
description:
2025-12-26 02:26:41 dovecot_login authenticator failed for H=([203.154.83.24]) [203.154.83.24]:44752: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.108
country_id: 6252001
description:
Dec 26 02:30:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.108, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0SFXEs1GysnG6xhs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.61.0
country_id: 1819730
description:
Dec 26 02:31:19 host2 sshd[93902]: Disconnected from invalid user filippo 20.255.61.0 port 51168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 02:35:37 host2 sshd[97457]: Disconnected from invalid user admin 2.57.121.112 port 42493 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-26 02:38:12 dovecot_login authenticator failed for H=([190.117.96.174]) [190.117.96.174]:47178: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-12-26 02:37:33 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:53250: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-12-26 02:39:56 dovecot_login authenticator failed for H=([183.171.53.82]) [183.171.53.82]:38000: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-12-26 02:40:16 dovecot_login authenticator failed for H=(mamanguape.static.gvt.net.br) [177.207.248.5]:42421: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-12-26 02:40:23 dovecot_login authenticator failed for H=([27.123.111.110]) [27.123.111.110]:34922: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.38.0.41
country_id: 6252001
description:
2025-12-26 02:40:40 dovecot_login authenticator failed for H=([45.38.0.41]) [45.38.0.41]:4589: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-26 02:41:32 dovecot_login authenticator failed for H=(103.51.26.198.sukaininfoway.com) [103.51.26.198]:43479: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.255.61.0
country_id: 1819730
description:
Dec 26 02:42:16 host2 sshd[103104]: Disconnected from invalid user pablo 20.255.61.0 port 43348 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.202.148
country_id: 1269750
description:
Dec 26 02:47:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=103.84.202.148, lip=66.85.158.91, TLS, session=<JEzaTM1GAdFnVMqU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.220
country_id: 1269750
description:
Dec 26 02:47:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=103.164.246.220, lip=66.85.158.91, TLS, session=<sOAVTs1GBKRnpPbc>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.96.166.26
country_id: 6252001
description:
[2025-12-26 02:48:51 +0530] info [webmaild] 199.96.166.26 - info@ajsstarlog.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.255.61.0
country_id: 1819730
description:
Dec 26 02:51:18 host2 sshd[111477]: Disconnected from invalid user user 20.255.61.0 port 44228 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-12-26 03:01:37 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-26 03:01:55 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:47896: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 26 03:04:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.140, lip=66.85.158.92, TLS: Connection closed, session=<WCOIis1GBBtChJmM>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 03:08:01 host2 pure-ftpd[127261]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 66.85.155.91
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 66.85.155.91: 255 connections per 30 seconds to 53 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 26 03:21:33 host2 pure-ftpd[140166]: (?@66.132.153.140) [INFO] New connection from 66.132.153.140


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.136.102
country_id: 1227603
description:
Dec 26 03:21:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=175.157.136.102, lip=66.85.158.91, TLS handshaking: Connection closed, session=<VG54yM1G25WvnYhm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.76.147.145
country_id: 1643084
description:
Dec 26 03:24:18 host2 sshd[142516]: Disconnected from invalid user nexus 110.76.147.145 port 49362 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec 26 03:24:20 host2 sshd[142554]: Disconnected from invalid user administrador 203.150.107.244 port 56182 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.136.102
country_id: 1227603
description:
Dec 26 03:24:46 host2 dovecot[1881837]: imap-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=175.157.136.102, lip=66.85.158.91, TLS, session=<lVA5081Gf9uvnYhm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 03:26:13 host2 sshd[144280]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.181.167.34
country_id: 3865483
description:
Dec 26 03:26:09 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=45.181.167.34, lip=66.85.158.91, TLS, session=<dDjs1s1GYJQttaci>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.32
country_id: 3865483
description:
Dec 26 03:26:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=179.0.249.32, lip=66.85.158.91, TLS, session=<+61Y2M1GI6CzAPkg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Dec 26 03:26:40 host2 sshd[144555]: Disconnected from invalid user git 209.141.53.124 port 43480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.76.147.145
country_id: 1643084
description:
Dec 26 03:27:14 host2 sshd[144904]: Disconnected from invalid user git 110.76.147.145 port 42928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 110.76.147.145
country_id: 1643084
description:
Dec 26 03:27:55 host2 sshd[145385]: Disconnected from invalid user ubuntu 110.76.147.145 port 56676 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Dec 26 03:27:38 host2 sshd[145131]: Disconnected from invalid user test11 209.141.53.124 port 56516 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.106.133
country_id: 3469034
description:
Dec 26 03:30:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=187.120.106.133, lip=66.85.158.91, TLS, session=<jAJx5c1G1ri7eGqF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec 26 03:29:25 host2 sshd[146717]: Disconnected from invalid user admin 203.150.107.244 port 52758 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.70.126.243
country_id: 1269750
description:
Dec 26 03:29:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.70.126.243, lip=66.85.158.91, TLS, session=<J9YK5M1GxINnRn7z>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 03:30:12 host2 sshd[147541]: Disconnected from invalid user user 2.57.121.25 port 27922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Dec 26 03:30:55 host2 sshd[148315]: Disconnected from invalid user admin 209.141.53.124 port 52172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.52
country_id: 6252001
description:
Dec 26 03:31:44 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.52, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hysq7M1GJN+TuYQ0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 26 03:33:15 host2 pure-ftpd[150368]: (?@66.132.153.114) [INFO] New connection from 66.132.153.114


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 26 03:33:19 host2 pure-ftpd[150437]: (?@66.132.153.114) [INFO] New connection from 66.132.153.114


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 26 03:33:23 host2 pure-ftpd[150488]: (?@66.132.153.114) [INFO] New connection from 66.132.153.114


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.150.107.244
country_id: 1605651
description:
Dec 26 03:35:29 host2 sshd[152412]: Disconnected from invalid user test11 203.150.107.244 port 56894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec 26 03:36:41 host2 sshd[153734]: Disconnected from invalid user demo1 203.150.107.244 port 52078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Dec 26 03:37:20 host2 sshd[154391]: Disconnected from invalid user share 103.51.216.210 port 46154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Dec 26 03:39:39 host2 sshd[156614]: Disconnected from invalid user sc 146.158.162.24 port 40148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.53.124
country_id: 6252001
description:
Dec 26 03:40:33 host2 sshd[157528]: Disconnected from invalid user lighthouse 209.141.53.124 port 54280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Dec 26 03:41:44 host2 sshd[158695]: Disconnected from invalid user ts3 146.158.162.24 port 54682 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.51.216.210
country_id: 1269750
description:
Dec 26 03:43:00 host2 sshd[159986]: Disconnected from invalid user backoffice 103.51.216.210 port 47106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.129.38.140
country_id: 1643084
description:
Dec 26 03:43:52 host2 sshd[160753]: Disconnected from invalid user admin 43.129.38.140 port 48264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Dec 26 03:43:58 host2 sshd[160876]: Disconnected from invalid user lol 52.224.109.126 port 51018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 26 03:44:44 host2 sshd[162229]: Disconnected from invalid user sabine 197.211.55.20 port 60418 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.224.109.126
country_id: 6252001
description:
Dec 26 03:45:06 host2 sshd[162823]: Disconnected from invalid user vpnuser 52.224.109.126 port 36000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.158.162.24
country_id: 2510769
description:
Dec 26 03:45:10 host2 sshd[162899]: Disconnected from invalid user mp 146.158.162.24 port 55910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Dec 26 03:44:31 host2 sshd[161805]: Disconnected from invalid user www 52.224.109.126 port 50194 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.219.125.194
country_id: 6252001
description:
Dec 26 03:46:16 host2 sshd[164392]: Disconnected from invalid user bass 154.219.125.194 port 56778 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 03:46:49 host2 sshd[165141]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Dec 26 03:46:52 host2 sshd[165175]: Disconnected from invalid user linda 197.211.55.20 port 59722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.51.216.210
country_id: 1269750
description:
Dec 26 03:47:00 host2 sshd[165477]: Disconnected from invalid user sakura 103.51.216.210 port 46722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.109.126
country_id: 6252001
description:
Dec 26 03:46:20 host2 sshd[164492]: Disconnected from invalid user ts3 52.224.109.126 port 53222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.173.2.164
country_id: 1643084
description:
Dec 26 03:46:46 host2 sshd[165006]: Disconnected from invalid user qa 43.173.2.164 port 42976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.108.77.116
country_id: 3686110
description:
Dec 26 03:51:32 host2 sshd[170459]: Disconnected from invalid user ssh 190.108.77.116 port 35256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 26 03:53:13 host2 sshd[172271]: Disconnected from invalid user wireguard 8.243.50.114 port 35300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.108.77.116
country_id: 3686110
description:
Dec 26 03:53:04 host2 sshd[172047]: Disconnected from invalid user cortega 190.108.77.116 port 10161 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-26 03:53:09 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:63877: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.196
country_id: 6252001
description:
Dec 26 03:54:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.196, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<dOXiO85GvMTG6xjE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-12-26 03:55:05 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:60451: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.31
country_id: 1522867
description:
2025-12-26 03:54:42 dovecot_login authenticator failed for H=([212.116.247.31]) [212.116.247.31]:52030: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.108.77.116
country_id: 3686110
description:
Dec 26 03:55:58 host2 sshd[175119]: Disconnected from invalid user test 190.108.77.116 port 24156 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 26 03:56:14 host2 sshd[175327]: Disconnected from invalid user sftpuser 52.187.9.8 port 34000 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 26 03:55:19 host2 sshd[174371]: Disconnected from invalid user stefano 8.243.50.114 port 48784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.172.221
country_id: 1861060
description:
Dec 26 03:55:48 host2 sshd[174944]: Disconnected from invalid user oracle 160.251.172.221 port 38014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.108.77.116
country_id: 3686110
description:
Dec 26 03:56:42 host2 sshd[175644]: Disconnected from invalid user oracle 190.108.77.116 port 33294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.172.221
country_id: 1861060
description:
Dec 26 03:59:04 host2 sshd[177823]: Disconnected from invalid user ladmin 160.251.172.221 port 53068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 26 03:59:21 host2 sshd[178052]: Disconnected from invalid user test 8.243.50.114 port 47488 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.108.77.116
country_id: 3686110
description:
Dec 26 04:00:31 host2 sshd[179292]: Disconnected from invalid user zabbix 190.108.77.116 port 35252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 26 04:00:37 host2 sshd[179348]: Disconnected from invalid user cortega 8.243.50.114 port 47058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 26 04:02:03 host2 sshd[180571]: Disconnected from invalid user stefano 52.187.9.8 port 34198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 26 04:03:25 host2 sshd[181720]: Disconnected from invalid user cortega 52.187.9.8 port 52566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 26 04:04:54 host2 sshd[183494]: Disconnected from invalid user wireguard 52.187.9.8 port 44346 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.174
country_id: 6252001
description:
Dec 26 04:04:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.174, lip=66.85.158.92, TLS, session=<z7oPY85G9vvN0h+u>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 04:10:31 host2 pure-ftpd[189741]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 26 04:10:54 host2 sshd[189939]: Disconnected from invalid user bitrix 58.98.199.45 port 39285 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.75
country_id: 2635167
description:
Dec 26 04:14:55 host2 dovecot[1881837]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.75, lip=66.85.158.92, TLS, session=<rz6Xhs5GWaG594lL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-26 04:15:17 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:53175: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.246.158
country_id: 2077456
description:
2025-12-26 04:15:52 dovecot_login authenticator failed for H=([120.157.246.158]) [120.157.246.158]:59218: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 26 04:19:07 host2 sshd[199396]: Disconnected from invalid user luciano 58.98.199.45 port 54953 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 26 04:21:28 host2 sshd[202480]: Disconnected from invalid user ws 58.98.199.45 port 43532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-26 04:22:59 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:36048: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2025-12-26 04:23:41 dovecot_login authenticator failed for H=(nsg-corporate-169.76.187.122.airtel.in) [182.95.124.202]:47512: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.162
country_id: 798544
description:
Dec 26 04:26:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=31.179.228.162, lip=66.85.158.91, TLS, session=<ACaGrs5G9dYfs+Si>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.210.189.21
country_id: 3277605
description:
Dec 26 04:26:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=178.210.189.21, lip=66.85.158.91, TLS, session=<NbWUr85GLqmy0r0V>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.211
country_id: 3017382
description:
Dec 26 04:28:52 host2 pure-ftpd[212898]: (?@91.196.152.211) [INFO] New connection from 91.196.152.211


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.214
country_id: 3017382
description:
Dec 26 04:28:52 host2 pure-ftpd[212894]: (?@91.196.152.214) [INFO] New connection from 91.196.152.214


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.0.171.42
country_id: 298795
description:
Dec 26 04:30:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=95.0.171.42, lip=66.85.158.91, TLS, session=<WmJ5u85Gt6lfAKsq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-26 04:29:11 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:54238: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.169.255
country_id: 3469034
description:
Dec 26 04:30:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.130.169.255, lip=66.85.158.91, TLS, session=<AmKhvM5G+s+xgqn/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.83.97
country_id: 1880251
description:
Dec 26 04:59:46 host2 sshd[242968]: Disconnected from invalid user wk 43.134.83.97 port 46474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.83.97
country_id: 1880251
description:
Dec 26 05:00:29 host2 sshd[243734]: Disconnected from invalid user test 43.134.83.97 port 43688 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Dec 26 05:01:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<r8pTLc9G8N1ChJl7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 26 05:01:37 host2 sshd[244481]: Disconnected from invalid user extern 41.216.178.119 port 54216 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.193.72
country_id: 130758
description:
Dec 26 05:01:40 host2 sshd[244509]: Disconnected from invalid user extern 85.133.193.72 port 32940 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 85.133.193.72
country_id: 130758
description:
Dec 26 05:04:44 host2 sshd[246974]: Received disconnect from 85.133.193.72 port 41054:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.134.83.97
country_id: 1880251
description:
Dec 26 05:05:49 host2 sshd[248839]: Disconnected from invalid user vaibhav 43.134.83.97 port 50424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.193.72
country_id: 130758
description:
Dec 26 05:06:18 host2 sshd[249681]: Disconnected from invalid user vhserver 85.133.193.72 port 53036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 26 05:10:14 host2 sshd[252699]: Disconnected from invalid user ftpuser 41.216.178.119 port 44494 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 26 05:10:58 host2 sshd[253208]: Disconnected from invalid user wsq 41.216.178.119 port 36146 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 05:13:01 host2 pure-ftpd[254753]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2025-12-26 05:13:57 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:44597: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.58.47.167
country_id: 6252001
description:
[2025-12-26 05:22:07 +0530] info [whostmgrd] 71.58.47.167 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-26 05:21:17 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:60900: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.222
country_id: 3865483
description:
Dec 26 05:26:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=179.0.251.222, lip=66.85.158.91, TLS, session=<UT/chM9GrqmzAPve>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.8
country_id: 3175395
description:
Dec 26 05:26:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=185.15.171.8, lip=66.85.158.91, TLS, session=<sHgYhs9GS6S5D6sI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.134.113.36
country_id: 1269750
description:
Dec 26 05:29:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.134.113.36, lip=66.85.158.91, TLS, session=<kiLGkc9GbNVnhnEk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.249
country_id: 3469034
description:
Dec 26 05:30:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.89.136.249, lip=66.85.158.91, TLS, session=<6NEFk89GcuC+WYj5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 05:35:45 host2 sshd[273939]: Disconnected from invalid user admin 2.57.121.112 port 30222 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.3.62
country_id: 6252001
description:
[2025-12-26 05:37:55 +0530] info [webmaild] 140.235.3.62 - info@ayuzonelanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-26 05:38:38 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:57160: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-26 05:40:14 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:33629: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-26 05:40:41 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:50241: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.35
country_id: 6252001
description:
Dec 26 05:42:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.195.35, lip=66.85.158.92, session=<WQwtvs9G4LwUQcMj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.54
country_id: 6252001
description:
Dec 26 05:46:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.54, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0GS4z89GStfN0h82>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 05:53:20 host2 sshd[287520]: Disconnected from invalid user user 2.57.121.25 port 9824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-12-26 05:56:35 dovecot_login authenticator failed for H=([123.209.106.190]) [123.209.106.190]:37102: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.196
country_id: 3996063
description:
2025-12-26 05:56:47 dovecot_login authenticator failed for H=(201.173.216.196-clientes-izzi.mx) [201.173.216.196]:36283: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-26 05:57:10 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:46469: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.7.77
country_id: 6252001
description:
Dec 26 05:58:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.122.7.77, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<7sSF+M9GRs6GegdN>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.181.171.159
country_id: 2017370
description:
[2025-12-26 06:08:49 +0530] info [webmaild] 5.181.171.159 - info@tradeceylon.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 06:11:23 host2 sshd[303663]: Disconnected from invalid user admin 2.57.121.112 port 27973 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.117.47
country_id: 2921044
description:
Dec 26 06:11:45 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=46.101.117.47, lip=66.85.158.91, session=<2htqKNBGuKYuZXUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-26 06:14:31 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:52315: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2025-12-26 06:15:14 dovecot_login authenticator failed for H=(static-200-85-150173.vnet.bo) [200.85.150.173]:51582: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 06:15:35 host2 pure-ftpd[307263]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2025-12-26 06:16:13 dovecot_login authenticator failed for H=(171.140.212.218.starhub.net.sg) [218.212.140.171]:37553: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.219.159
country_id: 3374766
description:
2025-12-26 06:16:27 dovecot_login authenticator failed for H=([41.215.219.159]) [41.215.219.159]:49973: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.253
country_id: 3469034
description:
Dec 26 06:21:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=191.240.36.253, lip=66.85.158.91, TLS, session=<9ikWS9BG0te/8CT9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.84
country_id: 3175395
description:
Dec 26 06:21:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.15.169.84, lip=66.85.158.91, TLS, session=<lxjySdBG24e5D6lU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-26 06:24:44 dovecot_login authenticator failed for H=([187.8.120.90]) [187.8.120.90]:51603: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-26 06:25:23 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:34824: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-26 06:29:07 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:37896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2025-12-26 06:29:35 dovecot_login authenticator failed for H=(cm-46.212.35.53.get.no) [46.212.35.53]:46713: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.105.235.55
country_id: 3017382
description:
[2025-12-26 06:29:58 +0530] info [cpaneld] 46.105.235.55 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.133
country_id: 6252001
description:
Dec 26 06:32:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.194.133, lip=66.85.158.91, session=<4yncc9BGrIcUQcKF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.12
country_id: 6252001
description:
Dec 26 06:37:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.12, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<vXlhhdBG5M3G6xgM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.208.104.128
country_id: 3175395
description:
Dec 26 06:38:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=185.208.104.128, lip=66.85.158.91, TLS, session=<jQM8htBGyd650GiA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.188
country_id: 3469034
description:
Dec 26 06:38:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=187.120.72.188, lip=66.85.158.91, TLS, session=<ZSNuh9BGL867eEi8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.9
country_id: 1605651
description:
Dec 26 06:39:05 host2 sshd[326867]: Disconnected from invalid user dockeruser 122.155.223.9 port 58874 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.155.223.9
country_id: 1605651
description:
Dec 26 06:39:44 host2 sshd[327319]: Disconnected from invalid user erpnext 122.155.223.9 port 56208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.9
country_id: 1605651
description:
Dec 26 06:40:22 host2 sshd[328225]: Disconnected from invalid user thomas 122.155.223.9 port 45312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 26 06:41:46 host2 sshd[329188]: Disconnected from invalid user hostinger 103.132.243.250 port 42552 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.175.213.4
country_id: 6252001
description:
Dec 26 06:41:16 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.175.213.4, lip=66.85.158.91, session=<PDj6kdBGpGJCr9UE>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 128.199.26.0
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 128.199.26.0: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.75
country_id: 3865483
description:
Dec 26 06:41:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.252.75, lip=66.85.158.91, TLS, session=<9GcSkdBGgOizAPxL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.200
country_id: 2510769
description:
Dec 26 06:41:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=139.28.190.200, lip=66.85.158.91, TLS, session=<16VUktBGj5yLHL7I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Dec 26 06:42:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, TLS: Connection closed, session=<Mb3flNBG6H2nXpIy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.182.134.75
country_id: 130758
description:
Dec 26 06:42:12 host2 sshd[329544]: Disconnected from invalid user suporte 94.182.134.75 port 35092 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.83.255.165
country_id: 6252001
description:
[2025-12-26 06:44:06 +0530] info [webmaild] 172.83.255.165 - info@neotechlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.118
country_id: 6252001
description:
Dec 26 06:44:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=192.155.90.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<E9WxnNBGJhfAm1p2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 26 06:44:34 host2 sshd[331823]: Disconnected from invalid user control 103.132.243.250 port 36150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 26 06:45:12 host2 sshd[332436]: Disconnected from invalid user ubuntu 103.132.243.250 port 35286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.44.29.6
country_id: 1819730
description:
Dec 26 06:46:35 host2 sshd[333394]: Disconnected from invalid user user53 154.44.29.6 port 51104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 06:46:43 host2 sshd[333477]: Disconnected from invalid user admin 2.57.121.112 port 60165 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.44.29.6
country_id: 1819730
description:
Dec 26 06:45:59 host2 sshd[333000]: Disconnected from invalid user thomas 154.44.29.6 port 41704 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.1
country_id: 6252001
description:
Dec 26 06:48:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.1, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JXfPqtBGHb5b5qgB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.3
country_id: 6252001
description:
Dec 26 06:48:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.3, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<eVNnrNBGw75b5qgD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.6
country_id: 6252001
description:
Dec 26 06:48:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.6, lip=66.85.158.91, TLS: Connection closed, session=<DVOWrNBGyd9b5qgG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:49:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<vQfCr9BGruUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:50:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<VhKHtNBGYNYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:52:27 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<wqD2udBGCqcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:53:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Xcoav9BGaKEDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:54:03 host2 dovecot[1881837]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<8Neuv9BGer0DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 26 06:53:52 host2 sshd[338781]: Disconnected from invalid user es 201.124.168.139 port 35122 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:55:31 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<D270xNBGbKIDhBfJ>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 26 07:00:36 host2 sshd[345076]: Received disconnect from 201.124.168.139 port 59712:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 26 07:02:02 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<OkdA3NBGbJvPWvQc>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 26 07:01:59 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<TLkW3NBGiIvPWvQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 26 07:04:29 host2 sshd[347944]: Disconnected from invalid user teste 201.124.168.139 port 58954 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 26 07:06:05 host2 sshd[349594]: Received disconnect from 201.124.168.139 port 38426:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-26 07:07:27 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:63292: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-12-26 07:09:47 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [190.104.254.91]:37959: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.239.5
country_id: 3144096
description:
2025-12-26 07:10:42 dovecot_login authenticator failed for H=(cm-178.232.239.5.get.no) [178.232.239.5]:46788: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-26 07:11:26 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:56460: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-26 07:11:35 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:58667: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-26 07:11:50 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:57376: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-26 07:10:59 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:36238: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-12-26 07:10:59 dovecot_login authenticator failed for H=([182.78.107.6]) [182.78.107.6]:37300: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.173.57
country_id: 3144096
description:
2025-12-26 07:10:58 dovecot_login authenticator failed for H=([62.97.173.57]) [62.97.173.57]:57514: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.84
country_id: 1210997
description:
2025-12-26 07:11:22 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.84]:47456: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.146.192.27
country_id: 3175395
description:
2025-12-26 07:13:46 dovecot_login authenticator failed for H=(ADMIN) [72.146.192.27]:48500: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.128.120
country_id: 2921044
description:
Dec 26 07:14:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.128.120, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PlhXB9FGYn6kXIB4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 07:16:16 host2 sshd[357795]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 07:16:48 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:55234: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 07:18:12 host2 pure-ftpd[359203]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.94.192.162
country_id: 732800
description:
[2025-12-26 07:21:11 +0530] info [webmaild] 185.94.192.162 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 07:22:04 host2 sshd[362244]: Disconnected from invalid user admin 2.57.121.112 port 58339 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.127
country_id: 6252001
description:
Dec 26 07:31:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.127, lip=66.85.158.91, TLS: Connection closed, session=<5ZrwRNFGeobHLZp/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.228.131.33
country_id: 3017382
description:
Dec 26 07:32:12 host2 sshd[370722]: Disconnected from invalid user git 152.228.131.33 port 34272 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 26 07:33:02 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<QIwaS9FGgKvPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 26 07:33:03 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<CJYxS9FGmqvPWvQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.131.131.43
country_id: 1269750
description:
Dec 26 07:33:52 host2 sshd[372028]: Disconnected from invalid user yleng 34.131.131.43 port 56282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.228.131.33
country_id: 3017382
description:
Dec 26 07:34:49 host2 sshd[372833]: Disconnected from invalid user safeuser 152.228.131.33 port 51094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.32
country_id: 3175395
description:
Dec 26 07:35:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=185.15.169.32, lip=66.85.158.91, TLS, session=<ffvnUtFGMxK5D6kg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-26 07:35:40 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:43787: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.228.131.33
country_id: 3017382
description:
Dec 26 07:35:49 host2 sshd[373810]: Disconnected from invalid user testuser2 152.228.131.33 port 41584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.158
country_id: 798544
description:
Dec 26 07:35:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=91.238.166.158, lip=66.85.158.91, TLS, session=<SaTKUdFGCZxb7qae>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-12-26 07:36:00 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:48572: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 26 07:36:59 host2 sshd[374910]: Disconnected from invalid user matin 102.88.137.213 port 33765 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.131.131.43
country_id: 1269750
description:
Dec 26 07:37:04 host2 sshd[375001]: Disconnected from invalid user zhangsan 34.131.131.43 port 39686 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.240.250
country_id: 2921044
description:
Dec 26 07:38:17 host2 pure-ftpd[375915]: (?@164.92.240.250) [INFO] New connection from 164.92.240.250


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.131.131.43
country_id: 1269750
description:
Dec 26 07:38:54 host2 sshd[376297]: Disconnected from invalid user tang 34.131.131.43 port 52304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 07:39:04 host2 sshd[376501]: Disconnected from invalid user user 2.57.121.25 port 25224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-26 07:39:17 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:49824: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.155
country_id: 1605651
description:
Dec 26 07:41:44 host2 sshd[379782]: Disconnected from invalid user debian 103.13.215.155 port 45656 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-12-26 07:42:02 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:44149: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 26 07:42:03 host2 sshd[380147]: Disconnected from invalid user anita 102.88.137.213 port 17208 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.44
country_id: 2635167
description:
Dec 26 07:42:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=35.203.211.44, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<OLAtbdFGINEjy9Ms>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2025-12-26 07:42:38 dovecot_login authenticator failed for H=c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:54208: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 26 07:43:22 host2 sshd[381591]: Disconnected from invalid user myuser 102.88.137.213 port 49526 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.44
country_id: 2635167
description:
Dec 26 07:43:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.211.44, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<1GzOcNFGzv0jy9Ms>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.44
country_id: 2635167
description:
Dec 26 07:43:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=35.203.211.44, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<isHdcdFG1u8jy9Ms>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.215.155
country_id: 1605651
description:
Dec 26 07:44:10 host2 sshd[382467]: Disconnected from invalid user depot 103.13.215.155 port 59562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 26 07:44:40 host2 sshd[383320]: Disconnected from invalid user yleng 102.88.137.213 port 1245 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-26 07:44:52 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:50308: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-26 07:45:13 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:51219: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.28
country_id: 3017382
description:
Dec 26 07:46:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.28, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<iUZKfNFGbbFbxJgc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.118
country_id: 3017382
description:
Dec 26 07:46:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.118, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7Kb6etFG989bxJh2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.116
country_id: 3017382
description:
Dec 26 07:46:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.116, lip=66.85.158.91, TLS: Connection closed, session=<kzaae9FGk+1bxJh0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.31
country_id: 3017382
description:
Dec 26 07:46:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.31, lip=66.85.158.91, TLS: Connection closed, session=<O7h6fNFGnYlbxJgf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.44
country_id: 2635167
description:
Dec 26 07:52:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.44, lip=66.85.158.92, TLS, session=<t8Atj9FGyOgjy9Ms>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-26 07:53:34 dovecot_login authenticator failed for H=li2180-133.members.linode.com [192.46.237.133]:42038: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-12-26 07:53:46 dovecot_login authenticator failed for H=([210.56.12.205]) [210.56.12.205]:49690: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.192
country_id: 6252001
description:
Dec 26 07:55:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.192, lip=66.85.158.92, TLS, session=<oIjQm9FGaP/G6xjA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2025-12-26 07:58:47 dovecot_login authenticator failed for H=([178.170.251.33]) [178.170.251.33]:60398: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.216.25.38
country_id: 798544
description:
Dec 26 07:58:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=178.216.25.38, lip=66.85.158.91, TLS, session=<T/SZpdFGX+Sy2Bkm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.84.31
country_id: 3996063
description:
2025-12-26 07:59:12 dovecot_login authenticator failed for H=([187.161.84.31]) [187.161.84.31]:52208: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2025-12-26 07:59:23 dovecot_login authenticator failed for H=([125.19.162.102]) [125.19.162.102]:39564: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.119.198.81
country_id: 3932488
description:
Dec 26 07:59:39 host2 sshd[395583]: Disconnected from invalid user vpn 190.119.198.81 port 37534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.54.150.172
country_id: 732800
description:
Dec 26 07:59:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=84.54.150.172, lip=66.85.158.91, TLS, session=<Y3RPp9FGE9ZUNpas>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2025-12-26 07:59:09 dovecot_login authenticator failed for H=([103.129.195.43]) [103.129.195.43]:56220: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.146.192.27
country_id: 3175395
description:
2025-12-26 08:00:00 dovecot_login authenticator failed for H=(ADMIN) [72.146.192.27]:32950: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.198.81
country_id: 3932488
description:
Dec 26 08:00:56 host2 sshd[396920]: Disconnected from invalid user free 190.119.198.81 port 37658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Dec 26 08:02:30 host2 sshd[398172]: Disconnected from invalid user user02 20.123.146.95 port 39309 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.198.81
country_id: 3932488
description:
Dec 26 08:02:50 host2 sshd[398450]: Disconnected from invalid user postgres 190.119.198.81 port 51966 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 08:03:18 host2 sshd[398973]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.164.135.45
country_id: 1835841
description:
Dec 26 08:06:22 host2 sshd[401703]: Disconnected from invalid user abhi 43.164.135.45 port 39594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.215.228.51
country_id: 130758
description:
Dec 26 08:08:05 host2 sshd[402925]: Disconnected from invalid user erp 185.215.228.51 port 49020 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.160.75
country_id: 2186224
description:
2025-12-26 08:08:20 dovecot_login authenticator failed for H=([121.73.160.75]) [121.73.160.75]:39904: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-26 08:08:41 dovecot_login authenticator failed for H=([84.215.110.96]) [84.215.110.96]:33396: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.215.228.51
country_id: 130758
description:
Dec 26 08:09:12 host2 sshd[403857]: Disconnected from invalid user deploy 185.215.228.51 port 49104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-26 08:11:48 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:49480: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-12-26 08:12:10 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:65485: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.97
country_id: 6252001
description:
Dec 26 08:19:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.97, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<3ssE8tFGX9bN0h9h>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 08:20:49 host2 pure-ftpd[414697]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.169.15.182
country_id: 1522867
description:
2025-12-26 08:22:18 dovecot_login authenticator failed for H=31.169.15.182.dynamic.telecom.kz [31.169.15.182]:46143: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-26 08:22:29 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:51917: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.77.198.112
country_id: 2542007
description:
[2025-12-26 08:25:17 +0530] info [cpaneld] 105.77.198.112 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2025-12-26 08:30:07 +0530] info [cpaneld] 38.35.225.197 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 08:32:21 host2 sshd[424348]: Disconnected from invalid user admin 2.57.121.112 port 45935 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.238.252.46
country_id: 241170
description:
2025-12-26 08:33:34 dovecot_login authenticator failed for H=([156.238.252.46]) [156.238.252.46]:59510: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-26 08:33:09 dovecot_login authenticator failed for H=(cm-178.232.168.117.get.no) [178.232.168.117]:37059: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.137.105.106
country_id: 6252001
description:
Dec 26 08:52:27 host2 pure-ftpd[443224]: (?@23.137.105.106) [INFO] New connection from 23.137.105.106


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec 26 08:55:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=31.14.32.6, lip=66.85.158.92, TLS: Connection closed, session=<zqerctJGnpwfDiAG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec 26 08:56:09 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=31.14.32.6, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<JVNgdNJGTMQfDiAG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.31
country_id: 732800
description:
Dec 26 08:56:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.255.212.31, lip=66.85.158.91, TLS, session=<hotkc9JGy4S5/9Qf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.53
country_id: 3469034
description:
Dec 26 08:56:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=177.44.71.53, lip=66.85.158.91, TLS, session=<s6+MdNJG3K2xLEc1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.74
country_id: 690791
description:
Dec 26 09:00:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=194.44.140.74, lip=66.85.158.91, TLS, session=<x8Y1gdJGJ+jCLIxK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.127.94.62
country_id: 798544
description:
Dec 26 08:59:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=128.127.94.62, lip=66.85.158.91, TLS, session=<rhYrgNJGnayAf14+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 09:00:08 host2 sshd[449992]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 09:07:13 host2 sshd[456235]: Disconnected from invalid user admin 2.57.121.112 port 34380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-12-26 09:08:00 dovecot_login authenticator failed for H=([122.187.230.13]) [122.187.230.13]:44106: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-26 09:09:03 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:53638: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-26 09:08:45 dovecot_login authenticator failed for H=([128.185.222.80]) [128.185.229.126]:33454: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.115
country_id: 6252001
description:
Dec 26 09:19:58 host2 pure-ftpd[465719]: (?@147.185.132.115) [INFO] New connection from 147.185.132.115


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 26 09:23:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<1LqX1NJGuNIjygmF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 09:23:29 host2 pure-ftpd[468695]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-26 09:30:11 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:51064: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2025-12-26 09:30:26 dovecot_login authenticator failed for H=([122.184.128.193]) [182.95.185.170]:49158: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.106
country_id: 6252001
description:
Dec 26 09:35:40 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.106, lip=66.85.158.91, TLS, session=<r7KvAdNGOvjG6xhq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 09:38:27 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:53458: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-26 09:38:41 dovecot_login authenticator failed for H=([187.8.120.90]) [187.8.120.90]:37191: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 09:42:19 host2 sshd[484514]: Disconnected from invalid user admin 2.57.121.112 port 52542 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 09:47:13 host2 sshd[489484]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 26 09:56:19 host2 sshd[498362]: Disconnected from invalid user dev 150.5.169.176 port 58852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 26 09:59:11 host2 sshd[500562]: Disconnected from invalid user deployer 181.188.172.6 port 38653 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.164.246.209
country_id: 1269750
description:
Dec 26 09:59:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.164.246.209, lip=66.85.158.91, TLS, session=<AgIFVtNGB8lnpPbR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.255.158.241
country_id: 1643084
description:
2025-12-26 09:59:51 dovecot_login authenticator failed for H=([101.255.158.242]) [101.255.158.241]:37470: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.13
country_id: 3175395
description:
Dec 26 09:59:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.170.13, lip=66.85.158.91, TLS, session=<vUZQV9NGJLC5D6oN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-26 10:00:14 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:55712: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 26 10:02:56 host2 sshd[504169]: Disconnected from invalid user laura 150.5.169.176 port 46604 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.27
country_id: 798544
description:
Dec 26 10:02:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=178.216.29.27, lip=66.85.158.91, TLS, session=<e3UzYtNGNdCy2B0b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.91.42
country_id: 3469034
description:
Dec 26 10:03:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=177.22.91.42, lip=66.85.158.91, TLS, session=<oThUY9NGWpqxFlsq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 26 10:04:54 host2 sshd[506205]: Disconnected from invalid user deploy 181.188.172.6 port 54408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 26 10:05:21 host2 sshd[506842]: Disconnected from invalid user admin123 150.5.169.176 port 46720 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Dec 26 10:06:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS handshaking: Connection closed, session=<rkoUcNNGxGlChJmG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 26 10:06:21 host2 sshd[507891]: Disconnected from invalid user devops 103.255.147.244 port 41774 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 26 10:08:24 host2 sshd[509805]: Received disconnect from 141.95.162.162 port 33396:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 26 10:08:39 host2 sshd[509985]: Disconnected from invalid user devops 181.188.172.6 port 55022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 26 10:10:44 host2 sshd[512211]: Disconnected from invalid user user 181.188.172.6 port 33661 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 26 10:13:41 host2 sshd[515540]: Received disconnect from 141.95.162.162 port 45178:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 26 10:15:28 host2 sshd[517498]: Disconnected from invalid user ftp_user 103.255.147.244 port 33202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 26 10:16:48 host2 sshd[518638]: Disconnected from invalid user admin 141.95.162.162 port 48154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 26 10:17:20 host2 sshd[519147]: Disconnected from invalid user ubuntu 141.95.162.162 port 52968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-26 10:19:53 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62686: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 10:26:11 host2 pure-ftpd[526326]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.7.141.81
country_id: 1605651
description:
Dec 26 10:35:53 host2 sshd[533988]: Disconnected from invalid user prasad 61.7.141.81 port 54912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-26 10:37:41 dovecot_login authenticator failed for H=([128.185.231.6]) [128.185.231.6]:47628: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-26 10:37:14 dovecot_login authenticator failed for H=([186.239.41.74]) [186.239.41.74]:58337: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.7.141.81
country_id: 1605651
description:
Dec 26 10:37:26 host2 sshd[535442]: Disconnected from invalid user amssys 61.7.141.81 port 50614 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 61.7.141.81
country_id: 1605651
description:
Dec 26 10:38:14 host2 sshd[536223]: Disconnected from invalid user soporte 61.7.141.81 port 38154 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 10:44:24 host2 sshd[541127]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.240.250
country_id: 2921044
description:
Dec 26 10:50:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=164.92.240.250, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<O9GvDdRGZzSkXPD6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.117.47
country_id: 2921044
description:
Dec 26 10:51:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.117.47, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8hHKD9RGOHAuZXUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.162.75
country_id: 241170
description:
Dec 26 11:00:55 host2 sshd[554652]: Disconnected from invalid user debian 154.198.162.75 port 60480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 26 11:02:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS: Connection closed, session=<zRnFN9RGMNlChJl1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 26 11:03:30 host2 sshd[556815]: Disconnected from invalid user sk 85.206.171.113 port 48000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 26 11:03:38 host2 sshd[556926]: Disconnected from invalid user alba 162.240.156.34 port 49484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 26 11:04:14 host2 sshd[557435]: Disconnected from invalid user tes 162.240.156.34 port 33124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 26 11:05:40 host2 sshd[558650]: Disconnected from invalid user colin 85.206.171.113 port 37632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 26 11:05:51 host2 sshd[558822]: Disconnected from invalid user rafael 45.172.152.74 port 37054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 26 11:06:19 host2 sshd[559269]: Disconnected from invalid user production 162.240.156.34 port 52416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2025-12-26 11:07:20 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:55342: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-12-26 11:07:44 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:36172: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.208
country_id: 1643084
description:
Dec 26 11:09:09 host2 sshd[561408]: Disconnected from invalid user pq 103.172.205.208 port 52008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.52
country_id: 1819730
description:
Dec 26 11:10:19 host2 sshd[563107]: Disconnected from invalid user pq 123.58.213.52 port 60256 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 155.133.116.71
country_id: 798544
description:
Dec 26 11:10:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=155.133.116.71, lip=66.85.158.91, TLS, session=<WkEpU9RGTcKbhXRH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.212.167.152
country_id: 798544
description:
Dec 26 11:10:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=178.212.167.152, lip=66.85.158.91, TLS, session=<K1FHVNRGrsyy1KeY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.208
country_id: 1643084
description:
Dec 26 11:11:18 host2 sshd[564257]: Disconnected from invalid user vbox 103.172.205.208 port 54898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.205.208
country_id: 1643084
description:
Dec 26 11:12:40 host2 sshd[565470]: Disconnected from invalid user tes 103.172.205.208 port 52180 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.103.3.117
country_id: 690791
description:
Dec 26 11:13:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=176.103.3.117, lip=66.85.158.91, TLS, session=<M5wBYNRGkr+wZwN1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.130.33
country_id: 99237
description:
Dec 26 11:14:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.130.33, lip=66.85.158.91, TLS, session=<0dAXYdRGcbpBFIIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 11:18:32 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:49036: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-26 11:19:25 dovecot_login authenticator failed for H=([122.186.50.17]) [182.95.61.114]:37190: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-12-26 11:19:50 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net [96.56.228.149]:59538: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.93
country_id: 2635167
description:
Dec 26 11:20:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=35.203.211.93, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<jb9ReNRGsckjy9Nd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.93
country_id: 2635167
description:
Dec 26 11:21:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.211.93, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<F4mpfNRGrOkjy9Nd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-26 11:26:06 dovecot_login authenticator failed for H=2.135.31.74.dynamic.telecom.kz [2.135.31.74]:49335: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 11:26:25 host2 sshd[578294]: Disconnected from invalid user admin 2.57.121.112 port 62423 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2025-12-26 11:26:36 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:38718: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-26 11:26:21 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:34966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2025-12-26 11:26:22 dovecot_login authenticator failed for H=([122.169.40.221]) [103.26.53.164]:59244: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.93
country_id: 2635167
description:
Dec 26 11:28:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.93, lip=66.85.158.91, TLS, session=<u+qLlNRGpO0jy9Nd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-12-26 11:28:34 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:44647: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 11:29:09 host2 pure-ftpd[580375]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 11:31:22 host2 sshd[582186]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.249
country_id: 2635167
description:
Dec 26 11:33:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.249, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QsuFpdRG98xX7LD5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.184
country_id: 2635167
description:
Dec 26 11:33:02 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.184, lip=66.85.158.91, TLS, session=<wvRqpdRGjcFX7LC4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.242
country_id: 2635167
description:
Dec 26 11:33:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.242, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<KZB/p9RGh86594ny>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.227
country_id: 2635167
description:
Dec 26 11:34:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.227, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<fzN7qdRGaalX7LDj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.243
country_id: 2635167
description:
Dec 26 11:34:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.243, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<6nV2q9RGF4VX7LDz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.226
country_id: 2635167
description:
Dec 26 11:35:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.226, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<uNVxrdRGHaRX7LDi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.253
country_id: 2635167
description:
Dec 26 11:35:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.253, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<eVxsr9RG1dRX7LD9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.218
country_id: 2635167
description:
Dec 26 11:36:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.218, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Wk1ls9RG+8dX7LDa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.219
country_id: 2635167
description:
Dec 26 11:36:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.219, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<8OBrsdRGV6m594nb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.223
country_id: 2635167
description:
Dec 26 11:37:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.223, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<K5NetdRGjdy594nf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.233
country_id: 2635167
description:
Dec 26 11:38:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.233, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<jOZZt9RGw71X7LDp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 26 11:40:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS: Connection closed, session=<3YiJv9RGpMtChJl1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.32.190.134
country_id: 3175395
description:
Dec 26 11:42:11 host2 sshd[590909]: Disconnected from invalid user nodered 79.32.190.134 port 45504 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.147
country_id: 6252001
description:
Dec 26 11:42:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.147, lip=66.85.158.91, TLS, session=<Vzk8yNRG3ufN0h+T>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.223.60.209
country_id: 3932488
description:
Dec 26 11:44:22 host2 sshd[592637]: Disconnected from invalid user user3 190.223.60.209 port 55172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 26 11:45:08 host2 sshd[593365]: Disconnected from invalid user myuser 103.210.21.178 port 56752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.223.60.209
country_id: 3932488
description:
Dec 26 11:45:42 host2 sshd[594252]: Disconnected from invalid user angel 190.223.60.209 port 54300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.248
country_id: 2658434
description:
Dec 26 11:46:09 host2 sshd[594658]: Disconnected from invalid user nodered 185.196.11.248 port 39148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.223.60.209
country_id: 3932488
description:
Dec 26 11:46:20 host2 sshd[594848]: Disconnected from invalid user myuser 190.223.60.209 port 39738 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.148.235.124
country_id: 294640
description:
[2025-12-26 11:46:56 +0530] info [webmaild] 45.148.235.124 - info@stanthonys.biz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.248
country_id: 2658434
description:
Dec 26 11:47:11 host2 sshd[595505]: Disconnected from invalid user sfserver 185.196.11.248 port 50296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.223.60.209
country_id: 3932488
description:
Dec 26 11:47:46 host2 sshd[596315]: Disconnected from invalid user ubuntu 190.223.60.209 port 38870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 26 11:48:06 host2 sshd[596745]: Disconnected from invalid user dev 103.210.21.178 port 36660 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.196.11.248
country_id: 2658434
description:
Dec 26 11:48:42 host2 sshd[597333]: Received disconnect from 185.196.11.248 port 48878:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.130
country_id: 3469034
description:
Dec 26 11:49:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=190.89.137.130, lip=66.85.158.91, TLS, session=<5HEo4NRGBp6+WYmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.71
country_id: 3865483
description:
Dec 26 11:50:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=190.181.97.71, lip=66.85.158.91, TLS, session=<dqZX4dRG0qu+tWFH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.11.248
country_id: 2658434
description:
Dec 26 11:50:40 host2 sshd[599173]: Disconnected from invalid user hik 185.196.11.248 port 45662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.236.136.67
country_id: 1861060
description:
2025-12-26 11:50:51 dovecot_login authenticator failed for H=p1385068-omed01.tokyo.ocn.ne.jp [153.236.136.67]:48602: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.250.250
country_id: 1269750
description:
2025-12-26 11:51:06 dovecot_login authenticator failed for H=(nsg-corporate-250.250.187.122.airtel.in) [122.187.250.250]:43069: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.206
country_id: 1269750
description:
2025-12-26 11:50:21 dovecot_login authenticator failed for H=([182.95.87.3]) [182.95.124.206]:33662: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec 26 11:51:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<u01+6NRGNP/CpRCj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 11:52:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<nAaG6tRGzLoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 11:55:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<PZEV9dRGHM4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 11:56:31 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<HN1o+dRGjoMDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 11:58:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<dPEu/9RGzIgDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 11:58:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7zjJAdVGcqsDjyE/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 12:00:07 host2 sshd[608222]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 12:00:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<+0fTBtVGFM0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec 26 12:01:00 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=31.14.32.6, lip=66.85.158.92, TLS, session=<J8psCdVGhLcfDiAG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec 26 12:01:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=31.14.32.6, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<8jMuCtVGpuMfDiAG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.65.36.123
country_id: 6252001
description:
[2025-12-26 12:02:46 +0530] info [whostmgrd] 174.65.36.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.121.64.38
country_id: 6252001
description:
[2025-12-26 12:03:01 +0530] info [cpaneld] 23.121.64.38 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.74.102.234
country_id: 6252001
description:
[2025-12-26 12:03:01 +0530] info [cpaneld] 73.74.102.234 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.153.150.65
country_id: 6252001
description:
[2025-12-26 12:03:02 +0530] info [cpaneld] 73.153.150.65 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.74.126.239
country_id: 6252001
description:
[2025-12-26 12:02:47 +0530] info [cpaneld] 99.74.126.239 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.177.53.181
country_id: 6252001
description:
[2025-12-26 12:02:57 +0530] info [cpaneld] 198.177.53.181 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.68.97.76
country_id: 6252001
description:
[2025-12-26 12:02:59 +0530] info [cpaneld] 72.68.97.76 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.122.146.93
country_id: 6252001
description:
[2025-12-26 12:02:39 +0530] info [cpaneld] 73.122.146.93 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.135.205.207
country_id: 6252001
description:
[2025-12-26 12:02:49 +0530] info [cpaneld] 74.135.205.207 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.181.125.247
country_id: 6252001
description:
[2025-12-26 12:02:58 +0530] info [cpaneld] 67.181.125.247 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.162.171.145
country_id: 6252001
description:
[2025-12-26 12:02:41 +0530] info [cpaneld] 75.162.171.145 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.114.199.247
country_id: 6252001
description:
[2025-12-26 12:02:44 +0530] info [cpaneld] 99.114.199.247 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.222.131.118
country_id: 6252001
description:
[2025-12-26 12:02:50 +0530] info [cpaneld] 107.222.131.118 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.179.105.117
country_id: 6252001
description:
[2025-12-26 12:03:00 +0530] info [whostmgrd] 98.179.105.117 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 12:04:10 host2 sshd[611743]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.59.192.250
country_id: 6252001
description:
[2025-12-26 12:04:31 +0530] info [whostmgrd] 184.59.192.250 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.72.38.66
country_id: 6252001
description:
[2025-12-26 12:04:32 +0530] info [cpaneld] 73.72.38.66 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.44.61
country_id: 6252001
description:
[2025-12-26 12:04:33 +0530] info [cpaneld] 129.222.44.61 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.72.156
country_id: 6252001
description:
[2025-12-26 12:04:35 +0530] info [cpaneld] 76.32.72.156 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.4
country_id: 2750405
description:
Dec 26 12:04:37 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 2 secs): user=<>, rip=31.14.32.4, lip=66.85.158.92, TLS, session=<4spdFtVG3K4fDiAE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.91.128.251
country_id: 6252001
description:
[2025-12-26 12:04:26 +0530] info [cpaneld] 24.91.128.251 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.133.157.149
country_id: 6252001
description:
[2025-12-26 12:04:28 +0530] info [cpaneld] 76.133.157.149 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.23.39
country_id: 6252001
description:
[2025-12-26 12:04:29 +0530] info [cpaneld] 47.149.23.39 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-26 12:06:01 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:38335: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.4
country_id: 2750405
description:
Dec 26 12:05:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=31.14.32.4, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Uh9QGNVGAOAfDiAE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-26 12:05:30 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:45633: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-12-26 12:09:41 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:33840: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.236
country_id: 294640
description:
2025-12-26 12:09:55 dovecot_login authenticator failed for H=(2-54-99-236.orange.net.il) [2.54.99.236]:55697: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.132
country_id: 3469034
description:
Dec 26 12:11:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=191.240.36.132, lip=66.85.158.91, TLS, session=<npbtLNVGb9O/8CSE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.12.32
country_id: 798544
description:
Dec 26 12:11:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=89.186.12.32, lip=66.85.158.91, TLS, session=<e4nwLdVGsM1Zugwg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.50.220
country_id: 953987
description:
Dec 26 12:11:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=102.129.50.220, lip=66.85.158.91, TLS, session=<X28bLtVGD95mgTLc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.12
country_id: 3175395
description:
Dec 26 12:11:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=217.26.178.12, lip=66.85.158.91, TLS, session=<kHffLNVGVMbZGrIM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.22
country_id: 1880251
description:
Dec 26 12:13:52 host2 sshd[621662]: Disconnected from invalid user miladmim 101.47.51.22 port 38052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.22
country_id: 1880251
description:
Dec 26 12:17:32 host2 sshd[625316]: Disconnected from invalid user frappe 101.47.51.22 port 57774 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.22
country_id: 1880251
description:
Dec 26 12:21:19 host2 sshd[628600]: Disconnected from invalid user testuser 101.47.51.22 port 43060 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.249.49
country_id: 3865483
description:
Dec 26 12:24:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=179.0.249.49, lip=66.85.158.91, TLS, session=<ezSTW9VGouOzAPkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.130.207.89
country_id: 2623032
description:
Dec 26 12:24:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=212.130.207.89, lip=66.85.158.91, TLS, session=<DHLWXNVGetnUgs9Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-26 12:25:58 dovecot_login authenticator failed for H=([65.20.150.36]) [65.20.150.36]:40120: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 26 12:26:09 host2 sshd[632840]: Disconnected from invalid user test 154.198.215.66 port 39400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 26 12:26:20 host2 sshd[633000]: Disconnected from invalid user dev 95.231.213.73 port 53472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 26 12:26:44 host2 sshd[633213]: Disconnected from invalid user backend 66.116.199.234 port 44710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 26 12:27:25 host2 sshd[633619]: Disconnected from invalid user sshtunnel 66.116.199.234 port 36400 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.215.66
country_id: 241170
description:
Dec 26 12:27:28 host2 sshd[633658]: Disconnected from invalid user VPN 154.198.215.66 port 35348 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 12:28:59 host2 sshd[634752]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.78
country_id: 1269750
description:
2025-12-26 12:29:07 dovecot_login authenticator failed for H=(nsg-corporate-78.225.187.122.airtel.in) [122.187.225.78]:33799: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 26 12:28:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<Xpj/bNVGxr6LonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.142
country_id: 1269750
description:
2025-12-26 12:29:39 dovecot_login authenticator failed for H=([152.52.238.92]) [182.95.184.142]:59942: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 26 12:30:50 host2 sshd[636217]: Disconnected from invalid user wangbo 206.81.27.245 port 36012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 26 12:32:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<TtJceNVGvP/CpRCm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 12:32:01 host2 pure-ftpd[637080]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 26 12:32:04 host2 sshd[637177]: Disconnected from invalid user testadmin 95.231.213.73 port 47914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.13.24.157
country_id: 2464461
description:
Dec 26 12:32:37 host2 sshd[637641]: Disconnected from invalid user VPN 197.13.24.157 port 42710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 26 12:33:22 host2 sshd[638351]: Disconnected from invalid user wangbo 95.231.213.73 port 51358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 26 12:35:05 host2 sshd[640023]: Disconnected from invalid user oleg 95.231.213.73 port 35894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.13.24.157
country_id: 2464461
description:
Dec 26 12:34:20 host2 sshd[639256]: Disconnected from invalid user sshtunnel 197.13.24.157 port 48696 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-12-26 12:34:36 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:51032: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 26 12:35:29 host2 sshd[640400]: Disconnected from invalid user botuser 66.116.199.234 port 39290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Dec 26 12:36:21 host2 sshd[641103]: Disconnected from invalid user sara 51.254.103.32 port 40802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 26 12:36:39 host2 sshd[641284]: Disconnected from invalid user ubuntu 206.81.27.245 port 39844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-12-26 12:37:07 dovecot_login authenticator failed for H=([130.185.96.113]) [130.185.96.113]:53870: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.254.103.32
country_id: 3017382
description:
Dec 26 12:36:21 host2 sshd[641103]: Received disconnect from 51.254.103.32 port 40802:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-26 12:37:24 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:60602: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 26 12:37:42 host2 sshd[642206]: Disconnected from invalid user ubuntu 206.81.27.245 port 45564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-26 12:38:50 dovecot_login authenticator failed for H=([128.185.235.110]) [128.185.235.110]:53786: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-26 12:39:09 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:44506: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.9
country_id: 6252001
description:
Dec 26 12:43:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.9, lip=66.85.158.91, TLS handshaking: Connection closed, session=<J3eTotVGsZ9b5qgJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 26 12:43:57 host2 sshd[647745]: Disconnected from invalid user server 192.210.233.234 port 57760 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.11
country_id: 6252001
description:
Dec 26 12:44:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.11, lip=66.85.158.91, TLS: Connection closed, session=<OoQyo9VGe8Rb5qgL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.34.166
country_id: 1819730
description:
Dec 26 12:43:29 host2 sshd[647409]: Disconnected from invalid user xerox 118.193.34.166 port 18150 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.3
country_id: 6252001
description:
Dec 26 12:44:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.3, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</lRXpNVGq8Zb5qgD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.15
country_id: 6252001
description:
Dec 26 12:44:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.15, lip=66.85.158.91, TLS: Connection closed, session=<17+FpNVGhZVb5qgP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.34.166
country_id: 1819730
description:
Dec 26 12:44:40 host2 sshd[648438]: Disconnected from invalid user merlin 118.193.34.166 port 36146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 26 12:44:51 host2 sshd[648577]: Disconnected from invalid user henry 192.210.233.234 port 41280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.34.166
country_id: 1819730
description:
Dec 26 12:45:18 host2 sshd[649119]: Disconnected from invalid user sk 118.193.34.166 port 47980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.34.166
country_id: 1819730
description:
Dec 26 12:45:54 host2 sshd[649919]: Disconnected from invalid user bodega 118.193.34.166 port 59804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 26 12:46:44 host2 sshd[650644]: Disconnected from invalid user ubuntu 192.210.233.234 port 44818 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.144
country_id: 6252001
description:
Dec 26 12:47:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.144, lip=66.85.158.91, session=<PKlTrtVGMu3G6xiQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.168
country_id: 6252001
description:
Dec 26 12:46:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.168, lip=66.85.158.92, session=<aBdoq9VG4OLG6xio>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-26 12:52:01 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:60450: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-26 12:52:21 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:41898: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.31
country_id: 1835841
description:
Dec 26 12:52:27 host2 sshd[656276]: Disconnected from invalid user leonardo 43.164.134.31 port 48454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.137.216
country_id: 1835841
description:
Dec 26 12:53:38 host2 sshd[657307]: Disconnected from invalid user internal 43.128.137.216 port 34890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Dec 26 12:53:53 host2 sshd[657492]: Disconnected from invalid user unity 103.161.207.2 port 45690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Dec 26 12:55:23 host2 sshd[659266]: Disconnected from invalid user unix 152.32.252.65 port 40276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.161.207.2
country_id: 1643084
description:
Dec 26 12:55:27 host2 sshd[659326]: Disconnected from invalid user sample 103.161.207.2 port 43180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Dec 26 12:56:36 host2 sshd[660817]: Disconnected from invalid user desarrollo 152.32.252.65 port 38250 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.55.85.202
country_id: 337996
description:
Dec 26 12:58:07 host2 sshd[662366]: Disconnected from invalid user mythtv 213.55.85.202 port 3926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.137.216
country_id: 1835841
description:
Dec 26 12:57:26 host2 sshd[661676]: Disconnected from invalid user pagar 43.128.137.216 port 59254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 26 12:58:26 host2 sshd[662720]: Disconnected from invalid user apagar 34.66.72.251 port 43796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.31
country_id: 1835841
description:
Dec 26 12:58:33 host2 sshd[662796]: Disconnected from invalid user coin 43.164.134.31 port 48648 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.128.137.216
country_id: 1835841
description:
Dec 26 12:59:36 host2 sshd[663888]: Disconnected from invalid user bodega 43.128.137.216 port 59314 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-26 13:00:25 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:38990: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-26 13:08:25 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:42658: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.225.186
country_id: 1269750
description:
2025-12-26 13:13:58 dovecot_login authenticator failed for H=([125.20.232.156]) [128.185.225.186]:36356: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.19
country_id: 1733045
description:
2025-12-26 13:14:27 dovecot_login authenticator failed for H=([49.124.153.19]) [49.124.153.19]:40770: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 13:16:46 host2 sshd[678641]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-12-26 13:18:30 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:48420: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-26 13:18:50 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:54082: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.206
country_id: 3017382
description:
Dec 26 13:23:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.206, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RJazMNZGwYRb51nO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.204
country_id: 3017382
description:
Dec 26 13:23:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.204, lip=66.85.158.91, TLS: Connection closed, session=<W0dTMdZGd9lb51nM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.119
country_id: 3017382
description:
Dec 26 13:23:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.119, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Ft0BMtZGB9Vb51l3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.112
country_id: 3017382
description:
Dec 26 13:23:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.112, lip=66.85.158.91, TLS: Connection closed, session=<oukxMtZGIaNb51lw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.255.158.241
country_id: 1643084
description:
2025-12-26 13:24:05 dovecot_login authenticator failed for H=([101.255.158.242]) [101.255.158.241]:60291: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-12-26 13:24:37 dovecot_login authenticator failed for H=(dhcp-192-211-156.in2cable.com) [203.192.211.156]:35420: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.219.57.146
country_id: 2510769
description:
[2025-12-26 13:24:42 +0530] info [cpaneld] 185.219.57.146 - corewebm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User corewebm has their account suspended. Login blocked.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.240.224
country_id: 2510769
description:
Dec 26 13:24:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.74.240.224, lip=66.85.158.91, TLS, session=<2N0UNNZGS7m5SvDg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.134
country_id: 690791
description:
Dec 26 13:25:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=194.44.140.134, lip=66.85.158.91, TLS, session=<Q0snNdZG/snCLIyG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.226.132.141
country_id: 6252001
description:
[2025-12-26 13:26:06 +0530] info [cpaneld] 73.226.132.141 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.91.244.67
country_id: 6252001
description:
[2025-12-26 13:26:08 +0530] info [cpaneld] 168.91.244.67 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.186.75
country_id: 6252001
description:
[2025-12-26 13:26:12 +0530] info [cpaneld] 172.59.186.75 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.23.154.226
country_id: 6252001
description:
[2025-12-26 13:26:14 +0530] info [whostmgrd] 73.23.154.226 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.43.190.93
country_id: 6252001
description:
[2025-12-26 13:26:15 +0530] info [cpaneld] 73.43.190.93 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.31.94.63
country_id: 6252001
description:
[2025-12-26 13:26:16 +0530] info [cpaneld] 65.31.94.63 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.35.253.81
country_id: 6252001
description:
[2025-12-26 13:26:17 +0530] info [cpaneld] 104.35.253.81 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.210.189.16
country_id: 3277605
description:
Dec 26 13:28:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=178.210.189.16, lip=66.85.158.91, TLS, session=<QY/wQNZGrqqy0r0Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.100.196
country_id: 798544
description:
Dec 26 13:28:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=85.202.100.196, lip=66.85.158.91, TLS, session=<4c0EQtZG57hVymTE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.124.197.37
country_id: 3017382
description:
[2025-12-26 13:34:21 +0530] info [cpaneld] 88.124.197.37 - dragon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 13:35:13 host2 pure-ftpd[693990]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-26 13:36:15 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62088: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.102.252.82
country_id: 1819730
description:
2025-12-26 13:36:29 dovecot_login authenticator failed for H=pcd720082.netvigator.com [218.102.252.82]:35448: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2025-12-26 13:36:42 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:46117: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2025-12-26 13:41:31 dovecot_login authenticator failed for H=([125.16.78.137]) [182.95.123.202]:37818: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-26 13:41:58 dovecot_login authenticator failed for H=([177.239.164.55]) [177.239.164.55]:39569: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 13:44:30 host2 sshd[700986]: Disconnected from invalid user admin 2.57.121.112 port 25184 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 26 13:45:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.116, lip=66.85.158.92, TLS handshaking: Connection closed, session=<S7hqgNZG2NlChJl0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Dec 26 13:51:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, session=<gpVNldZGsf4t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.132.32.143
country_id: 6252001
description:
2025-12-26 13:52:50 dovecot_login authenticator failed for H=(syn-072-132-032-143.res.spectrum.com) [72.132.32.143]:34030: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-12-26 13:53:02 dovecot_login authenticator failed for H=(182.239.78.49.hk.chinamobile.com) [182.239.78.49]:44704: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-26 13:53:22 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:39822: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-12-26 13:54:00 dovecot_login authenticator failed for H=([125.17.48.129]) [152.52.210.118]:44370: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 14:00:13 host2 sshd[714153]: Disconnected from invalid user user 2.57.121.25 port 44917 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.161.168.237
country_id: 6252001
description:
[2025-12-26 14:04:18 +0530] info [cpaneld] 73.161.168.237 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.185.16.251
country_id: 6252001
description:
[2025-12-26 14:04:20 +0530] info [cpaneld] 173.185.16.251 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.153.43.3
country_id: 6252001
description:
[2025-12-26 14:04:21 +0530] info [cpaneld] 99.153.43.3 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.228.120.155
country_id: 6252001
description:
[2025-12-26 14:04:22 +0530] info [whostmgrd] 134.228.120.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.178.239.247
country_id: 6252001
description:
[2025-12-26 14:04:23 +0530] info [cpaneld] 71.178.239.247 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.214.100.207
country_id: 6252001
description:
[2025-12-26 14:04:25 +0530] info [cpaneld] 76.214.100.207 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.171.130.15
country_id: 6252001
description:
[2025-12-26 14:04:26 +0530] info [cpaneld] 97.171.130.15 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.181.42
country_id: 3686110
description:
Dec 26 14:07:31 host2 sshd[720557]: Disconnected from invalid user ubuntu 152.200.181.42 port 49033 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.220
country_id: 2635167
description:
Dec 26 14:11:08 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.220, lip=66.85.158.92, TLS, session=<VqjW2tZGo6lX7LDc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 14:14:20 host2 sshd[727058]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.227
country_id: 3865483
description:
Dec 26 14:18:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=179.0.250.227, lip=66.85.158.91, TLS, session=<4afD8tZGp5uzAPrj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.28.249
country_id: 2300660
description:
Dec 26 14:17:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=41.139.28.249, lip=66.85.158.91, TLS, session=<PU5Y8dZGRoQpixz5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-26 14:22:47 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:39183: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-26 14:23:22 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:49444: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.26.179.239
country_id: 3175395
description:
Dec 26 14:26:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=217.26.179.239, lip=66.85.158.91, TLS, session=<iAwIEtdGYbTZGrPv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.79.82
country_id: 6252001
description:
Dec 26 14:27:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.14.79.82, lip=66.85.158.91, session=<9fzPE9dGJtQUDk9S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.196.87.135
country_id: 3469034
description:
Dec 26 14:27:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=131.196.87.135, lip=66.85.158.91, TLS, session=<L9YsE9dG+IODxFeH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2025-12-26 14:30:10 dovecot_login authenticator failed for H=([182.95.119.30]) [182.95.119.30]:39558: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.13
country_id: 1733045
description:
2025-12-26 14:30:29 dovecot_login authenticator failed for H=([49.124.153.13]) [49.124.153.13]:33154: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.78
country_id: 3624060
description:
2025-12-26 14:33:47 dovecot_login authenticator failed for H=([186.177.88.78]) [186.177.88.78]:60070: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-12-26 14:33:33 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:38683: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-26 14:35:25 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:50200: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.65
country_id: 6252001
description:
Dec 26 14:36:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.104.65, lip=66.85.158.92, session=<6JZaNddGYrcUQGhB>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 14:38:05 host2 pure-ftpd[747573]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-12-26 14:39:21 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:44570: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.37.221.141
country_id: 6252001
description:
[2025-12-26 14:40:27 +0530] info [cpaneld] 73.37.221.141 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-26 14:40:13 dovecot_login authenticator failed for H=([27.123.102.50]) [27.123.102.50]:42294: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.198.1.170
country_id: 6252001
description:
[2025-12-26 14:40:18 +0530] info [cpaneld] 71.198.1.170 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.59.225.184
country_id: 6252001
description:
[2025-12-26 14:40:22 +0530] info [cpaneld] 208.59.225.184 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.194.111.8
country_id: 6252001
description:
[2025-12-26 14:40:25 +0530] info [cpaneld] 71.194.111.8 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.101.11.131
country_id: 6252001
description:
[2025-12-26 14:40:21 +0530] info [cpaneld] 76.101.11.131 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.12.89.188
country_id: 6252001
description:
[2025-12-26 14:40:23 +0530] info [whostmgrd] 24.12.89.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.65.197.62
country_id: 6252001
description:
[2025-12-26 14:40:26 +0530] info [cpaneld] 108.65.197.62 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.202
country_id: 1880251
description:
Dec 26 14:44:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.202, lip=66.85.158.91, session=<Pz7lUtdGg8te587K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.207
country_id: 1880251
description:
Dec 26 14:44:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.207, lip=66.85.158.91, session=<fz6EU9dGR6de587P>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.205
country_id: 1880251
description:
Dec 26 14:45:10 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.205, lip=66.85.158.91, session=<edqKVNdGJ+de587N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.154
country_id: 1880251
description:
Dec 26 14:45:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.154, lip=66.85.158.91, session=<FV6/VNdGBaRe586a>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.11.44
country_id: 6252001
description:
[2025-12-26 14:46:47 +0530] info [cpaneld] 172.56.11.44 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.184.178.78
country_id: 6252001
description:
[2025-12-26 14:46:50 +0530] info [cpaneld] 173.184.178.78 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.124.183.147
country_id: 6252001
description:
[2025-12-26 14:46:52 +0530] info [cpaneld] 23.124.183.147 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.48.113.162
country_id: 6252001
description:
[2025-12-26 14:46:54 +0530] info [cpaneld] 45.48.113.162 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.23.48.36
country_id: 6252001
description:
[2025-12-26 14:46:43 +0530] info [cpaneld] 98.23.48.36 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.9.131.116
country_id: 6252001
description:
[2025-12-26 14:46:44 +0530] info [cpaneld] 71.9.131.116 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.23.191.0
country_id: 6252001
description:
[2025-12-26 14:46:48 +0530] info [whostmgrd] 75.23.191.0 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.4
country_id: 1814991
description:
Dec 26 14:49:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.4, lip=66.85.158.91, session=<5cP7ZNdG75Be584E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.0
country_id: 1814991
description:
Dec 26 14:49:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.0, lip=66.85.158.91, session=<Bf2aZddGb5Ze584A>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.2
country_id: 1814991
description:
Dec 26 14:50:20 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.2, lip=66.85.158.91, session=<6rgKZ9dGMdpe584C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.8
country_id: 1814991
description:
Dec 26 14:50:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.8, lip=66.85.158.91, session=<dBI/Z9dGHahe584I>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 14:52:56 host2 sshd[760493]: Disconnected from invalid user admin 2.57.121.112 port 22069 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec 26 14:53:42 host2 sshd[760985]: Disconnected from invalid user walter 193.106.245.20 port 58904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Dec 26 14:53:58 host2 sshd[761174]: Disconnected from invalid user sajid 41.111.162.34 port 36351 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-26 14:54:10 dovecot_login authenticator failed for H=([128.185.189.57]) [182.78.79.134]:40332: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-26 14:54:29 dovecot_login authenticator failed for H=([210.177.143.61]) [210.177.143.61]:35092: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.106.245.20
country_id: 798544
description:
Dec 26 14:55:36 host2 sshd[763366]: Disconnected from invalid user distro 193.106.245.20 port 33491 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Dec 26 14:56:28 host2 sshd[763988]: Disconnected from invalid user zgr 41.111.162.34 port 9495 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec 26 14:57:29 host2 sshd[765051]: Disconnected from invalid user maha 193.106.245.20 port 51381 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 26 14:57:31 host2 sshd[765069]: Disconnected from invalid user odin 187.210.77.100 port 45072 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 26 14:58:55 host2 sshd[765707]: Disconnected from invalid user tfj 187.210.77.100 port 56598 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 15:02:12 host2 sshd[767657]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.84.202.144
country_id: 1269750
description:
Dec 26 15:07:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.84.202.144, lip=66.85.158.91, TLS, session=<RQcPpNdGsrFnVMqQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.129.206.42
country_id: 3469034
description:
Dec 26 15:08:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.129.206.42, lip=66.85.158.91, TLS, session=<WmRdpddG3saxgc4q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-26 15:08:52 dovecot_login authenticator failed for H=([12.202.15.69]) [12.202.15.69]:47561: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-26 15:09:18 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:47166: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.254.2
country_id: 6252001
description:
Dec 26 15:10:33 host2 sshd[774212]: Disconnected from invalid user arjun 165.154.254.2 port 42240 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.254.2
country_id: 6252001
description:
Dec 26 15:11:15 host2 sshd[774938]: Disconnected from invalid user vpsuser 165.154.254.2 port 54030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-26 15:20:48 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:57906: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.60.138
country_id: 2300660
description:
Dec 26 15:40:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=41.139.60.138, lip=66.85.158.91, TLS, session=<+3bnGNhGxJEpizyK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 15:40:51 host2 pure-ftpd[799981]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.255.73.196
country_id: 1269750
description:
Dec 26 15:40:58 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=103.255.73.196, lip=66.85.158.91, TLS, session=<vrb5GthGIoVn/0nE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.14
country_id: 241170
description:
Dec 26 15:43:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.14, lip=66.85.158.91, session=<WUdeI9hGbsPE+2YO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:44:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Z29bKNhGrJQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:45:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<GUAxLNhGVO0DlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Dec 26 15:45:45 host2 sshd[803849]: Disconnected from invalid user zeppelin 128.199.168.119 port 41030 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:46:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dJvaLthGyq4DlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.244.88
country_id: 1819730
description:
Dec 26 15:47:40 host2 sshd[805657]: Disconnected from invalid user portal 165.154.244.88 port 50572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Dec 26 15:47:48 host2 sshd[805753]: Disconnected from invalid user dave 128.199.168.119 port 41660 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.168.119
country_id: 1880251
description:
Dec 26 15:48:35 host2 sshd[806667]: Disconnected from invalid user guest1 128.199.168.119 port 55788 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:48:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<WILiN9hGGqUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:49:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<AQ7iO9hGmtYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:51:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<s/twQNhGjMkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.11
country_id: 798549
description:
Dec 26 15:51:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.11, lip=66.85.158.91, TLS: Connection closed, session=</135QNhGPMBV2YwL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.16.194.197
country_id: 3865483
description:
Dec 26 15:51:40 host2 sshd[822189]: Disconnected from invalid user smbguest 190.16.194.197 port 34056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.244.88
country_id: 1819730
description:
Dec 26 15:52:07 host2 sshd[822517]: Disconnected from invalid user soporte 165.154.244.88 port 32850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.16.194.197
country_id: 3865483
description:
Dec 26 15:52:26 host2 sshd[822833]: Disconnected from invalid user soporte 190.16.194.197 port 48492 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:52:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<OW5HRdhGJMkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.11
country_id: 798549
description:
Dec 26 15:52:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.11, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<aHiNRthG+r1V2YwL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:53:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<AyqjSdhGYKQDlTsa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.16.194.197
country_id: 3865483
description:
Dec 26 15:53:11 host2 sshd[823349]: Disconnected from invalid user jens 190.16.194.197 port 34694 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.10
country_id: 798549
description:
Dec 26 15:54:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.10, lip=66.85.158.91, session=<bptrTNhGapXUSZQK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 15:59:59 host2 sshd[830086]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-26 15:59:57 dovecot_login authenticator failed for H=([182.95.63.50]) [182.95.63.50]:36432: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2025-12-26 16:00:19 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:55313: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-26 16:16:24 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:46440: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-26 16:16:46 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:42526: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-26 16:24:09 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:55976: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.56.146.181
country_id: 294640
description:
[2025-12-26 16:24:30 +0530] info [cpaneld] 62.56.146.181 - dragon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-26 16:24:47 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:43932: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-26 16:24:58 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:52906: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 16:43:41 host2 pure-ftpd[869592]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 16:47:53 host2 sshd[873650]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 16:50:28 host2 sshd[875924]: Disconnected from invalid user user 2.57.121.25 port 33538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.5.108.11
country_id: 2186224
description:
Dec 26 16:56:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=103.5.108.11, lip=66.85.158.91, TLS, session=<XeM3KtlGI4NnBWwL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.56
country_id: 3469034
description:
Dec 26 16:56:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=187.120.76.56, lip=66.85.158.91, TLS, session=<APz6KNlGXM67eEw4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.93
country_id: 3175395
description:
Dec 26 16:58:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.197.8.93, lip=66.85.158.91, TLS, session=<wCU+MNlG7IW5xQhd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.250
country_id: 298795
description:
Dec 26 16:58:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=45.67.155.250, lip=66.85.158.91, TLS, session=<OpNzMdlGB4YtQ5v6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 26 17:00:21 host2 sshd[885118]: Disconnected from invalid user  62.60.131.157 port 50934 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.178.225.45
country_id: 6252001
description:
[2025-12-26 17:00:58 +0530] info [cpaneld] 73.178.225.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.184.237.243
country_id: 6252001
description:
[2025-12-26 17:00:59 +0530] info [cpaneld] 192.184.237.243 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.222.161.239
country_id: 6252001
description:
[2025-12-26 17:01:02 +0530] info [whostmgrd] 98.222.161.239 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.34.96.107
country_id: 6252001
description:
[2025-12-26 17:01:03 +0530] info [cpaneld] 136.34.96.107 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.123.197.161
country_id: 6252001
description:
[2025-12-26 17:01:04 +0530] info [cpaneld] 99.123.197.161 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.96.10
country_id: 6252001
description:
[2025-12-26 17:01:01 +0530] info [cpaneld] 172.56.96.10 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.175.123.52
country_id: 6252001
description:
[2025-12-26 17:01:03 +0530] info [cpaneld] 67.175.123.52 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec 26 17:01:46 host2 pure-ftpd[886314]: (?@66.132.153.112) [INFO] New connection from 66.132.153.112


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-26 17:02:17 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61493: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 121.52.147.5
country_id: 1168579
description:
Dec 26 17:05:35 host2 sshd[889597]: Disconnected from invalid user marcela 121.52.147.5 port 41816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.214.145
country_id: 1562822
description:
Dec 26 17:07:15 host2 sshd[890903]: Disconnected from invalid user sjen 165.154.214.145 port 40200 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.251.206.110
country_id: 3932488
description:
Dec 26 17:08:41 host2 pure-ftpd[892293]: (?@132.251.206.110) [INFO] New connection from 132.251.206.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-12-26 17:10:41 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:55681: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 17:11:12 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:33572: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.52.51
country_id: 2921044
description:
[2025-12-26 17:13:37 +0530] info [webmaild] 178.16.52.51 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2025-12-26 17:14:11 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:39202: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2025-12-26 17:14:23 dovecot_login authenticator failed for H=([182.95.49.166]) [182.95.49.166]:54170: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.203
country_id: 3144096
description:
2025-12-26 17:17:19 dovecot_login authenticator failed for H=(cm-84.211.13.203.get.no) [84.211.13.203]:35579: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.190
country_id: 2287781
description:
2025-12-26 17:17:30 dovecot_login authenticator failed for H=([160.154.84.190]) [160.154.84.190]:7157: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-26 17:19:58 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:48264: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-12-26 17:20:22 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:59924: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 17:24:11 host2 sshd[906639]: Disconnected from invalid user user 2.57.121.25 port 42451 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 17:32:25 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:58418: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-26 17:33:13 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:58834: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-26 17:36:57 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:33322: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.102.252.82
country_id: 1819730
description:
2025-12-26 17:37:41 dovecot_login authenticator failed for H=pcd720082.netvigator.com [218.102.252.82]:52660: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-12-26 17:37:42 dovecot_login authenticator failed for H=ip-64-21-235-162.ideaone.net [64.21.235.162]:34391: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.223.20.191
country_id: 2077456
description:
2025-12-26 17:37:56 dovecot_login authenticator failed for H=194-223-20-191.tpgi.com.au [194.223.20.191]:55915: 535 Incorrect authentication data (set_id=contact)


