# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 09:03:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<EecT3FlGatU+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 09:04:11 host2 sshd[853223]: Disconnected from invalid user keagan 62.60.131.157 port 8719 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-20 09:05:56 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:54098: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-20 09:06:14 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:43455: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.162
country_id: 1149361
description:
2025-12-20 09:08:05 dovecot_login authenticator failed for ([149.54.15.162]) [149.54.15.162]:39318: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-20 09:08:27 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:56563: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-20 09:09:06 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (upeidel) [71.62.34.216]:42634: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Dec 20 09:09:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.3, lip=66.85.158.91, TLS: Connection closed, session=<M6Lb8VlG6O1V2YwD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-20 09:10:36 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:46530: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Dec 20 09:10:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<LJ5b81lGxJNV2YwD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-12-20 09:15:56 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:35072: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.202.195.148
country_id: 6251999
description:
2025-12-20 09:16:46 dovecot_login authenticator failed for ([209.202.195.148]) [209.202.195.148]:43570: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 09:17:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ZVzRC1pGQto+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-20 09:18:58 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (blatistry) [174.169.224.27]:53476: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-12-20 09:19:54 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:52506: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-20 09:20:07 dovecot_login authenticator failed for (cm-84.211.13.217.get.no) [84.211.13.217]:60813: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-20 09:20:03 dovecot_plain authenticator failed for (hoess) [5.31.15.108]:57198: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-20 09:19:12 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:60102: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 09:19:17 host2 sshd[865150]: Disconnected from invalid user admin 2.57.121.25 port 38543 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-12-20 09:19:32 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:47218: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.177
country_id: 2264397
description:
Dec 20 09:19:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.177, lip=66.85.158.92, session=<Jo1bFVpGEawtnIGx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 20 09:20:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.115, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OVWNF1pGFhxChJlz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-20 09:21:38 dovecot_plain authenticator failed for (paphydia) [102.53.15.180]:44687: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.80.99.140
country_id: 6252001
description:
2025-12-20 09:22:09 dovecot_plain authenticator failed for ec2-3-80-99-140.compute-1.amazonaws.com (EC2AMAZ-Q00RJOJ.ec2.internal) [3.80.99.140]:57439: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 09:22:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<3N1QHlpG7Oc+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.80.99.140
country_id: 6252001
description:
2025-12-20 09:22:15 dovecot_login authenticator failed for ec2-3-80-99-140.compute-1.amazonaws.com (EC2AMAZ-Q00RJOJ.ec2.internal) [3.80.99.140]:57439: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 09:22:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<F18GH1pG6tg+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 20 09:22:49 host2 sshd[868041]: Disconnected from invalid user admin 123.58.209.224 port 59574 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 20 09:23:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<8iCaI1pGJLU+PIds>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 09:24:25 host2 sshd[869342]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.255.38.183
country_id: 6252001
description:
Dec 20 09:25:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=38.255.38.183, lip=66.85.158.91, session=<f3sYKVpGms8m/ya3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 09:26:13 host2 sshd[870684]: Disconnected from invalid user  2.57.121.25 port 34064 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 20 09:27:16 host2 sshd[871365]: Disconnected from invalid user botuser 123.58.209.224 port 40462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 20 09:28:27 host2 sshd[872104]: Disconnected from invalid user itadmin 123.58.209.224 port 60168 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.176
country_id: 6252001
description:
Dec 20 09:29:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.176, lip=66.85.158.92, TLS, session=<K30UOlpGfv7G6xiw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.80.99.140
country_id: 6252001
description:
2025-12-20 09:32:37 dovecot_plain authenticator failed for ec2-3-80-99-140.compute-1.amazonaws.com (EC2AMAZ-Q00RJOJ.ec2.internal) [3.80.99.140]:64507: 535 Incorrect authentication data (set_id= info@idesignvector.com )


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 20 09:32:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<BJVdRFpGAMo+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-20 09:34:03 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (spatoxont) [89.67.37.2]:43896: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 09:37:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<vYRrU1pGorI+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-20 09:37:48 dovecot_login authenticator failed for (nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:40526: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.119
country_id: 2186224
description:
2025-12-20 09:38:06 dovecot_login authenticator failed for ([121.73.168.119]) [121.73.168.119]:49296: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.167.183
country_id: 2635167
description:
Dec 20 09:42:42 host2 sshd[883094]: Disconnected from invalid user useradmin 138.68.167.183 port 52360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.122
country_id: 1880251
description:
Dec 20 09:43:51 host2 sshd[884001]: Disconnected from invalid user ubuntu 45.78.201.122 port 33806 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 130.131.162.82
country_id: 6252001
description:
Dec 20 09:43:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=130.131.162.82, lip=66.85.158.91, session=<n1hhbFpGps2Cg6JS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-20 09:45:14 dovecot_plain authenticator failed for (deranter) [65.20.160.107]:55377: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 09:45:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<aVkXcVpGvtI+PIdj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 09:45:47 host2 pure-ftpd[886260]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-20 09:46:11 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (hypers) [24.15.216.41]:57154: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.167.183
country_id: 2635167
description:
Dec 20 09:47:27 host2 sshd[887417]: Disconnected from invalid user szy 138.68.167.183 port 35664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 09:48:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<EoP+elpGLNQ+PIce>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.64.199.71
country_id: 6252001
description:
[2025-12-20 09:48:36 +0530] info [webmaild] 174.64.199.71 - info@anandaobauae.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.67
country_id: 6252001
description:
Dec 20 09:51:16 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.67, lip=66.85.158.91, session=<Y2BuhlpGIelomDRD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 20 09:51:24 host2 sshd[890702]: Disconnected from invalid user ociisstd 36.95.194.52 port 40164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 20 09:52:45 host2 sshd[891586]: Disconnected from invalid user jtribino 36.95.194.52 port 51680 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-20 09:52:59 dovecot_login authenticator failed for ([182.74.13.219]) [182.74.12.86]:52812: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-20 09:53:14 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:47222: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.180.251
country_id: 6252001
description:
[2025-12-20 09:54:07 +0530] info [cpaneld] 130.12.180.251 - cloudtou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtou (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 20 09:54:35 host2 sshd[893644]: Disconnected from invalid user roman 36.95.194.52 port 57660 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 10:01:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<6hE9qVpGRKw+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 10:00:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<pFRzqFpGMMA+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 10:01:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<tOsqq1pG3OY+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-20 10:03:17 dovecot_login authenticator failed for ([62.97.170.54]) [62.97.170.54]:33600: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 10:03:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ZXr/sVpGDI4+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-12-20 10:03:42 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:48224: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.61
country_id: 6252001
description:
Dec 20 10:06:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.61, lip=66.85.158.92, TLS: Connection closed, session=<HYe2vFpGCKenXpI9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 10:07:21 host2 sshd[904504]: Disconnected from invalid user guest 2.57.121.25 port 42471 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 10:07:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<kDMTwFpGbqM+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-20 10:07:42 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (arming) [174.161.27.82]:35546: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-20 10:07:46 dovecot_plain authenticator failed for (adratusner) [199.192.123.12]:38298: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 20 10:08:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<LZo2xFpGQIM+PIdi>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.201.58.185
country_id: 6252001
description:
[2025-12-20 10:09:11 +0530] info [webmaild] 67.201.58.185 - info@lankaherbalsolutions.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 20 10:12:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<gSK+01pGRrM+PIdo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 10:15:44 host2 sshd[911763]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 20 10:19:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<WbgH6lpGAOA+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 20 10:20:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<RYNt7VpGMu4+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 10:20:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<FJeE7VpGoLM+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 10:20:16 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ansing) [87.103.126.54]:32423: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-20 10:20:21 dovecot_plain authenticator failed for (subculle) [94.201.22.158]:44269: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.79
country_id: 6252001
description:
Dec 20 10:25:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.150.79, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<WSz8AVtGlNOi2JZP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.79
country_id: 6252001
description:
Dec 20 10:26:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.150.79, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<vBkNBFtG5vCi2JZP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 10:27:12 host2 sshd[919330]: Disconnected from invalid user bonnie 62.60.131.157 port 18443 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-20 10:30:02 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:51086: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-12-20 10:30:38 dovecot_login authenticator failed for ([182.73.109.194]) [182.73.109.194]:36166: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 10:34:02 host2 sshd[924171]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.127
country_id: 6252001
description:
Dec 20 10:33:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=91.230.168.127, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WSGRHFtGF9Bb5qh/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.255
country_id: 6252001
description:
Dec 20 10:33:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.230.168.255, lip=66.85.158.91, TLS: Connection closed, session=<UsVMHVtG381b5qj/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.79
country_id: 6252001
description:
Dec 20 10:33:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.79, lip=66.85.158.92, TLS, session=<6fKFHVtGwv2i2JZP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 10:35:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<XNEhI1tGesQ+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 20 10:35:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<MvFJJVtG5so+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 20 10:39:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<KdWNMltGgMY+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-20 10:39:53 dovecot_plain authenticator failed for (gamet) [176.113.155.132]:59851: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-20 10:40:38 dovecot_login authenticator failed for ([200.148.171.233]) [189.56.0.19]:46069: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-20 10:40:21 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:43648: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-20 10:42:59 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (mendum) [73.176.157.57]:58020: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-20 10:45:14 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (collarking) [68.82.141.145]:46566: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 10:45:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<JcfrR1tG2sw+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 20 10:45:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, session=<sAlSSFtGOf/CpRCm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.63
country_id: 2635167
description:
Dec 20 10:45:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.63, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<okMwSVtGTdsjy9M/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 10:47:11 host2 sshd[935858]: Disconnected from invalid user admin 2.57.121.112 port 54991 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 10:47:57 host2 pure-ftpd[936359]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 10:48:36 host2 sshd[936855]: Disconnected from invalid user  2.57.121.25 port 37984 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-20 10:49:02 dovecot_plain authenticator failed for (undigers) [65.20.164.137]:48649: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-20 10:50:59 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (ganteopy) [24.23.125.83]:45932: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.63
country_id: 2635167
description:
Dec 20 10:51:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.63, lip=66.85.158.91, TLS, session=<OZc3XFtGrukjy9M/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 10:55:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<fF/Aa1tGmIY+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 11:02:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<dhNRhltGEpI+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:06:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<SXupkVtGnJcDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:06:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<0jafk1tG3pMDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 11:06:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=</E5RlFtGpM0+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 20 11:08:46 host2 sshd[958302]: Disconnected from invalid user elk 179.40.112.10 port 48258 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:08:51 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<HWHam1tGsuMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-20 11:09:31 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (canse) [73.129.57.71]:38076: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:09:30 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<+hY2nltGkOQDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 20 11:10:50 host2 sshd[960330]: Disconnected from invalid user jack 179.40.112.10 port 47032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 20 11:11:33 host2 sshd[960729]: Disconnected from invalid user wilson 179.40.112.10 port 60232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 20 11:12:14 host2 sshd[961093]: Disconnected from invalid user ftp-test 179.40.112.10 port 45198 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:12:21 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<MzhpqFtGescDiUnd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.172.63.91
country_id: 2635167
description:
[2025-12-20 11:12:34 +0530] info [cpaneld] 167.172.63.91 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 11:13:57 host2 sshd[962302]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:14:19 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<MmJzr1tGFooDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:15:49 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<GYPEtFtGtLcDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.208.156.50
country_id: 241170
description:
Dec 20 11:16:00 host2 sshd[964152]: Disconnected from invalid user xray 185.208.156.50 port 40838 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 11:16:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Ud60uFtGRp0+PIcs>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.199.60.176
country_id: 1880251
description:
[2025-12-20 11:16:58 +0530] info [cpaneld] 138.199.60.176 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-20 11:17:56 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (pladerpred) [73.196.144.25]:46068: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.208.156.50
country_id: 241170
description:
Dec 20 11:19:08 host2 sshd[966362]: Received disconnect from 185.208.156.50 port 57162:11: Bye Bye [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.187.155.130
country_id: 6252001
description:
[2025-12-20 11:19:11 +0530] info [webmaild] 50.187.155.130 - info@saara.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.50
country_id: 241170
description:
Dec 20 11:19:40 host2 sshd[966671]: Disconnected from invalid user tacuser 185.208.156.50 port 54502 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.26.39.178
country_id: 1819730
description:
Dec 20 11:19:52 host2 sshd[966928]: Disconnected from invalid user jack 118.26.39.178 port 46314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Dec 20 11:20:28 host2 sshd[967490]: Disconnected from invalid user elk 118.26.39.178 port 57210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-20 11:20:49 dovecot_plain authenticator failed for (fromass) [65.20.153.146]:41173: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 11:22:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<QchlzFtGUts+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Dec 20 11:23:45 host2 sshd[969230]: Disconnected from invalid user frappe 194.107.115.2 port 20144 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.138.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 192.111.138.28 - info@epid.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.2
country_id: 1512440
description:
Dec 20 11:25:43 host2 sshd[970619]: Disconnected from invalid user user1 194.107.115.2 port 52852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-20 11:25:43 dovecot_plain authenticator failed for (canse) [41.248.243.181]:44602: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-20 11:25:47 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (reques) [76.97.155.25]:49332: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 112.134.213.132
country_id: 1227603
description:
Dec 20 11:26:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=112.134.213.132, lip=66.85.158.91, TLS, session=<Ajvi2ltGc1xwhtWE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.254
country_id: 3017382
description:
Dec 20 11:27:10 host2 sshd[971546]: Disconnected from invalid user guestuser 51.91.98.254 port 45716 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.112
country_id: 6252001
description:
Dec 20 11:28:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.112, lip=66.85.158.92, session=<s5yE4ltGZPPG6xhw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.254
country_id: 3017382
description:
Dec 20 11:28:42 host2 sshd[972507]: Disconnected from invalid user mcserver 51.91.98.254 port 34376 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.98.254
country_id: 3017382
description:
Dec 20 11:29:11 host2 sshd[972884]: Disconnected from invalid user github 51.91.98.254 port 37810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 20 11:29:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<4uHc5VtGPuk+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.243.106.218
country_id: 2802361
description:
2025-12-20 11:31:13 dovecot_plain authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be (priperse) [81.243.106.218]:50194: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2025-12-20 11:31:40 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:54210: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-20 11:32:00 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.74]:23724: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 20 11:32:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<rhHD8FtGVM7BHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 11:33:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<9nGh81tG9qI+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.12
country_id: 798549
description:
Dec 20 11:36:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.12, lip=66.85.158.91, session=<6fJt/1tGSMRV2ZUM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-12-20 11:37:18 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:54790: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-20 11:38:06 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:55052: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 11:41:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<JttKD1xGZKc+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.198
country_id: 6252001
description:
Dec 20 11:40:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.198, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<liqxDFxG4sTN0h/G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 11:42:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<abBTFFxGytU+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.62.224.44
country_id: 3017382
description:
2025-12-20 11:47:22 dovecot_plain authenticator failed for ftp-mutu001.plug-it.com (tormen) [185.62.224.44]:36526: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 11:49:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<VD+bK1xGZpY+PIcf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 11:50:02 host2 pure-ftpd[987213]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-20 11:55:36 dovecot_plain authenticator failed for (tairrac) [65.20.250.163]:55822: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 12:00:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<pL1aU1xG/OM+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 20 12:00:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<reJvVFxGKr8+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2025-12-20 12:02:34 dovecot_plain authenticator failed for (ables) [50.202.197.108]:33789: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 12:03:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<7CXyX1xGXKQ+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 12:03:52 host2 sshd[997161]: Disconnected from invalid user moth3r 2.57.121.25 port 34484 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 12:05:21 host2 sshd[998352]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 12:05:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<Ue3vZlxGnKI+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 12:07:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<PMZObVxGcKg+PIdp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 12:10:49 host2 sshd[1002616]: Disconnected from invalid user  2.57.121.25 port 37962 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.7
country_id: 2750405
description:
Dec 20 12:13:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=31.14.32.7, lip=66.85.158.91, session=<2iLlglxGBpofDiAH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 20 12:13:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<SVzgglxGff7CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 12:14:25 host2 sshd[1005766]: Disconnected from invalid user admin 2.57.121.112 port 60685 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-20 12:15:52 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (calas) [73.197.194.98]:33508: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-20 12:18:48 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:54381: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2025-12-20 12:19:17 dovecot_login authenticator failed for ([125.23.243.66]) [125.23.41.122]:35752: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2025-12-20 12:21:13 dovecot_plain authenticator failed for (quely) [37.25.36.197]:60689: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-20 12:22:03 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (beaticits) [69.123.219.82]:37479: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 12:24:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<WRSZqVxGqOE+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 20 12:25:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, session=<7ATFrlxGTP7CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 20 12:27:53 host2 sshd[1017879]: Disconnected from invalid user git 45.121.147.47 port 57464 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Dec 20 12:28:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.53, lip=66.85.158.92, TLS: Connection closed, session=<QK9VuVxGwD+nXpI1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-20 12:29:22 dovecot_plain authenticator failed for (memism) [65.20.129.28]:60599: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 12:29:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<cQrGvVxGnpI+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 12:30:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<NTU+v1xGhOw+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 20 12:30:52 host2 sshd[1020154]: Disconnected from invalid user fmaster 23.242.166.38 port 54700 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 20 12:32:07 host2 sshd[1021033]: Disconnected from invalid user simone 45.121.147.47 port 56186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-20 12:32:09 dovecot_login authenticator failed for 2.135.31.74.dynamic.telecom.kz [2.135.31.74]:60223: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2025-12-20 12:32:46 dovecot_login authenticator failed for ([125.19.218.50]) [125.19.218.50]:36596: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 12:32:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<MBRyxlxGZqA+PIcd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.180.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 130.12.180.251 - dragon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-20 12:34:55 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:52988: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.43.162
country_id: 3686110
description:
2025-12-20 12:35:08 dovecot_login authenticator failed for ([190.85.43.162]) [190.85.43.162]:45052: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 20 12:36:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<i9A/1VxGEsw+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 20 12:37:46 host2 sshd[1025023]: Disconnected from invalid user reza 72.144.12.31 port 36726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 20 12:38:22 host2 sshd[1025415]: Disconnected from invalid user alan 72.144.12.31 port 49266 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 20 12:38:17 host2 sshd[1025340]: Disconnected from invalid user magento 23.242.166.38 port 49326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 20 12:39:23 host2 sshd[1025994]: Disconnected from invalid user farhan 23.242.166.38 port 52304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 12:40:03 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (oconis) [87.103.126.54]:45760: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 20 12:40:35 host2 sshd[1027106]: Received disconnect from 72.144.12.31 port 37516:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 20 12:41:43 host2 sshd[1027783]: Disconnected from invalid user fmaster 72.144.12.31 port 54472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 12:45:00 host2 sshd[1029904]: Disconnected from invalid user user 2.57.121.25 port 46440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 12:49:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<6eE3Al1GTr4+PIde>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 20 12:51:29 host2 sshd[1034390]: Disconnected from invalid user teamspeak3 125.21.59.218 port 35320 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 12:51:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<BpX3Cl1GupE+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 12:51:39 host2 sshd[1034523]: Disconnected from invalid user  2.57.121.25 port 30580 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 12:52:01 host2 pure-ftpd[1034815]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 20 12:53:48 host2 sshd[1035807]: Disconnected from invalid user mata 125.21.59.218 port 55346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 20 12:56:07 host2 sshd[1038561]: Disconnected from invalid user estest 196.189.124.195 port 57148 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.124.195
country_id: 337996
description:
Dec 20 12:59:07 host2 sshd[1041116]: Disconnected from invalid user ubuntu 196.189.124.195 port 34290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 20 13:02:02 host2 sshd[1043685]: Disconnected from invalid user payam 196.189.124.195 port 59918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 13:02:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<bmo9Ml1GQLY+PIM0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 13:03:35 host2 sshd[1045416]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 20 13:05:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<62acPF1GZNvPWvQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.81.232.29
country_id: 2264397
description:
Dec 20 13:11:07 host2 sshd[1052444]: Disconnected from invalid user admin 188.81.232.29 port 45564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-20 13:12:07 dovecot_plain authenticator failed for (grousing) [176.113.155.132]:47701: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 13:12:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<MAI4Vl1G0Nk+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 20 13:12:53 host2 sshd[1053705]: Disconnected from invalid user admin 115.85.80.12 port 33824 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 13:13:34 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 20 13:16:48 host2 sshd[1056508]: Disconnected from invalid user tjones 115.85.80.12 port 44298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 20 13:17:27 host2 sshd[1057079]: Disconnected from invalid user test2 115.85.80.12 port 34222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.81.232.29
country_id: 2264397
description:
Dec 20 13:18:38 host2 sshd[1057798]: Disconnected from invalid user demo 188.81.232.29 port 35784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 20 13:18:48 host2 sshd[1057898]: Disconnected from invalid user test2 115.85.80.12 port 59924 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.81.232.29
country_id: 2264397
description:
Dec 20 13:19:32 host2 sshd[1058463]: Disconnected from invalid user admin 188.81.232.29 port 44434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.81.232.29
country_id: 2264397
description:
Dec 20 13:21:17 host2 sshd[1059971]: Disconnected from invalid user user1 188.81.232.29 port 54932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 13:21:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<zBkLdl1GoIc+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 13:21:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<qMZddl1GILQ+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 13:22:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<0Oh5el1GOJs+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-20 13:26:30 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:33494: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.18
country_id: 6252001
description:
Dec 20 13:27:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.18, lip=66.85.158.91, session=<ZnDail1GCuSTuYQS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-12-20 13:27:20 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:56730: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 20 13:29:36 host2 sshd[1065136]: Disconnected from invalid user git 92.191.96.115 port 47946 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-20 13:29:58 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (bectroali) [73.171.230.200]:55114: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Dec 20 13:31:57 host2 sshd[1066928]: Disconnected from invalid user hdoop 156.238.252.133 port 42386 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-20 13:31:42 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (thiss) [68.52.119.193]:38844: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 20 13:33:05 host2 sshd[1067904]: Disconnected from invalid user tunnel 92.191.96.115 port 56932 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-20 13:33:12 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:48004: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 13:32:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<2wq/nF1Gzpc+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 20 13:32:29 host2 sshd[1067432]: Disconnected from invalid user nodered 92.191.96.115 port 3938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.28
country_id: 3996063
description:
2025-12-20 13:32:57 dovecot_login authenticator failed for (189.219.138.28-clientes-izzi.mx) [189.219.138.28]:35225: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Dec 20 13:34:25 host2 sshd[1068981]: Disconnected from invalid user admin 156.238.252.133 port 48866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 13:34:50 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (lishoely) [87.103.126.54]:22885: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.238.252.133
country_id: 241170
description:
Dec 20 13:36:05 host2 sshd[1070582]: Disconnected from invalid user admin 156.238.252.133 port 42850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 20 13:35:25 host2 sshd[1069915]: Disconnected from invalid user dev 92.191.96.115 port 41962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Dec 20 13:35:33 host2 sshd[1070052]: Disconnected from invalid user ubuntu 156.238.252.133 port 38442 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-20 13:36:55 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:42752: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-20 13:37:13 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:46651: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 13:36:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<c6u9rF1G5KE+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Dec 20 13:38:18 host2 sshd[1071884]: Disconnected from invalid user oem 156.238.252.133 port 51606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 13:38:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<r+Tds11GQMU+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-12-20 13:43:46 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:47424: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-12-20 13:44:05 dovecot_login authenticator failed for ([203.193.147.37]) [203.193.147.37]:61088: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.159.184.22
country_id: 798544
description:
Dec 20 13:44:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=93.159.184.22, lip=66.85.158.91, TLS, session=<WDHTxl1GVqVdn7gW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.139
country_id: 3175395
description:
Dec 20 13:44:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.15.171.139, lip=66.85.158.91, TLS, session=<KnHVxl1G+sS5D6uL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.94
country_id: 3175395
description:
Dec 20 13:44:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.197.9.94, lip=66.85.158.91, TLS, session=<JGx2x11Ga865xQle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.110.41
country_id: 798544
description:
Dec 20 13:44:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=85.202.110.41, lip=66.85.158.91, TLS, session=<s1Dox11GucxVym4p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.133
country_id: 3865483
description:
Dec 20 13:44:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=190.181.101.133, lip=66.85.158.91, TLS, session=<eZT1x11Gs5q+tWWF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.198
country_id: 3175395
description:
Dec 20 13:44:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.15.171.198, lip=66.85.158.91, TLS, session=<oFTVxl1GVp25D6vG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.237
country_id: 3469034
description:
Dec 20 13:44:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=191.53.107.237, lip=66.85.158.91, TLS, session=<vhn3x11GiZm/NWvt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.150
country_id: 3469034
description:
Dec 20 13:44:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=177.44.71.150, lip=66.85.158.91, TLS, session=<oIOWyF1G6pyxLEeW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 20 13:47:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<BDw30l1GioQ+PIdg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.193
country_id: 1210997
description:
Dec 20 13:49:36 host2 sshd[1080317]: Disconnected from invalid user ubuntu 103.172.112.193 port 50090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 13:49:47 host2 sshd[1080437]: Disconnected from invalid user martina 62.60.131.157 port 9227 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 13:49:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<J+Tp211GdrU+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 20 13:50:12 host2 sshd[1081134]: Disconnected from invalid user logstash 101.36.120.76 port 47944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 20 13:50:43 host2 sshd[1081708]: Disconnected from invalid user deploy 198.98.56.227 port 36474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 20 13:51:54 host2 sshd[1083153]: Disconnected from invalid user newuser 198.98.56.227 port 33018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 20 13:51:18 host2 sshd[1082499]: Disconnected from invalid user admin 198.98.56.227 port 48862 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 13:51:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<xcQS4l1Gfsc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 13:52:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<CgGm5F1GeqE+PIcg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 13:55:03 host2 sshd[1087941]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 20 13:54:53 host2 sshd[1087572]: Disconnected from invalid user ubuntu 101.36.120.76 port 36122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2025-12-20 13:55:15 dovecot_login authenticator failed for ([125.19.173.189]) [182.95.181.166]:34394: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.4
country_id: 1643084
description:
Dec 20 13:55:18 host2 sshd[1088273]: Disconnected from invalid user ryan 103.172.204.4 port 38960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-20 13:55:37 dovecot_login authenticator failed for ([49.0.40.238]) [49.0.40.238]:34342: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.214.145
country_id: 1562822
description:
Dec 20 13:55:54 host2 sshd[1089080]: Disconnected from invalid user patrol 165.154.214.145 port 40472 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.4
country_id: 1643084
description:
Dec 20 13:56:05 host2 sshd[1089404]: Disconnected from invalid user ganesh 103.172.204.4 port 60922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 13:56:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<nRtR9F1GGpk+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-20 13:58:10 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:60837: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.214.145
country_id: 1562822
description:
Dec 20 13:57:19 host2 sshd[1090829]: Disconnected from invalid user gateway 165.154.214.145 port 53844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Dec 20 13:57:24 host2 sshd[1090909]: Disconnected from invalid user ubuntu 81.215.228.18 port 48754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.220.210
country_id: 2403846
description:
2025-12-20 13:58:00 dovecot_login authenticator failed for ([196.216.220.210]) [196.216.220.210]:60115: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Dec 20 13:58:30 host2 sshd[1092341]: Disconnected from invalid user logstash 81.215.228.18 port 44848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 20 14:00:53 host2 sshd[1095613]: Disconnected from invalid user webapp 101.36.120.76 port 51186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 20 14:02:56 host2 sshd[1098391]: Disconnected from invalid user ubuntu 101.36.120.76 port 49658 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 20 14:03:49 host2 sshd[1099255]: Disconnected from invalid user andrew 101.36.120.76 port 52510 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 14:07:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<jXEoGV5Gmpw+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-20 14:06:42 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:37638: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-12-20 14:06:58 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:36575: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-20 14:09:35 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (terom) [76.16.7.82]:38122: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2025-12-20 14:11:18 dovecot_plain authenticator failed for (joing) [46.35.178.104]:38454: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 14:11:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<iyB1KV5Giuo+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 14:13:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<5Zu+Ll5GwNk+PIcf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.172.63.91
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 167.172.63.91 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 14:15:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<LFW4Nl5GzJMDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-20 14:17:16 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:45738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 14:18:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<pbhOQV5GHuI+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-12-20 14:17:40 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:46188: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 14:17:46 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<MneEP15GaoUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 14:19:39 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<rSY6Rl5GCJsDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 14:19:39 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<Ask+Rl5GApsDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-20 14:20:51 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (sochastry) [98.222.93.199]:54458: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-20 14:25:19 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (turoitch) [67.173.58.47]:41228: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 14:25:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<0ayKW15GpOc+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-20 14:30:11 dovecot_login authenticator failed for (nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:54486: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2025-12-20 14:29:48 dovecot_login authenticator failed for ([177.236.146.191]) [177.236.146.191]:41126: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-20 14:30:05 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (mastic) [98.193.112.85]:40814: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 14:30:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<snSPbl5GbLk+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-20 14:31:58 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (mogently) [73.197.236.163]:49626: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-20 14:32:50 dovecot_plain authenticator failed for (cutoraty) [199.192.123.12]:58864: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-20 14:34:09 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (nouts) [71.62.34.216]:35884: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.199.23
country_id: 6252001
description:
Dec 20 14:33:35 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.199.23, lip=66.85.158.91, session=<0n0ReF5GPtlHBscX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.199.23
country_id: 6252001
description:
Dec 20 14:33:35 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.199.23, lip=66.85.158.91, session=<LXYTeF5G4tlHBscX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-20 14:34:29 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:41658: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-12-20 14:34:30 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:58246: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 14:34:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<UzBxfF5GqKQ+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-12-20 14:35:12 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:55159: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-20 14:36:12 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (reely) [24.98.45.238]:58520: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 14:36:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<SN4FgV5GUsE+PIMp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 14:38:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<mqcTiV5GVJE+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-20 14:42:47 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (camphom) [73.171.230.200]:48655: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-12-20 14:43:08 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:57469: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-12-20 14:43:24 dovecot_login authenticator failed for (c-50-187-155-130.unallocated.comcastbusiness.net) [50.187.155.130]:44549: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 14:43:43 host2 sshd[1136105]: Disconnected from invalid user  2.57.121.25 port 46666 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.17
country_id: 798549
description:
Dec 20 14:47:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.17, lip=66.85.158.91, TLS: Connection closed, session=<EsWlqV5G+uRV2YwR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 20 14:52:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<wgezul5GrLg+PIdr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 14:53:28 host2 sshd[1144595]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-20 14:55:50 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (acharible) [73.195.211.98]:36182: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 14:56:03 host2 pure-ftpd[1146957]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-20 14:57:10 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (pizemus) [73.13.220.220]:44518: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-20 14:57:20 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:55147: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-20 14:57:47 dovecot_login authenticator failed for (cm-84.213.188.130.get.no) [84.213.188.130]:43875: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2025-12-20 14:58:17 dovecot_login authenticator failed for ([149.54.62.62]) [149.54.62.62]:60422: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-20 14:59:10 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-12-20 14:58:46 dovecot_login authenticator failed for ([46.210.94.61]) [46.210.94.61]:46152: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-20 15:00:18 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:34312: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.18
country_id: 798549
description:
Dec 20 14:59:37 host2 pure-ftpd[1148862]: (?@85.217.149.18) [INFO] New connection from 85.217.149.18


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.18
country_id: 798549
description:
Dec 20 14:59:46 host2 pure-ftpd[1148952]: (?@85.217.149.18) [INFO] New connection from 85.217.149.18


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 14:59:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<xMjW1V5G+uE+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.28.18
country_id: 1168579
description:
2025-12-20 15:01:05 dovecot_login authenticator failed for ([210.56.28.18]) [210.56.28.18]:38071: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2025-12-20 15:01:11 dovecot_login authenticator failed for ([122.160.137.230]) [122.160.137.230]:37110: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2025-12-20 15:01:26 dovecot_login authenticator failed for ([182.95.181.166]) [182.95.181.166]:40412: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 15:02:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<zVL94F5GDME+PIMh>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.60.171.8
country_id: 1694008
description:
[2025-12-20 15:03:40 +0530] info [cpaneld] 103.60.171.8 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 20 15:05:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=</YPv6V5GqqIDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 20 15:07:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<A4G38l5GTsk+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 20 15:08:02 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<AVRC815GQuIDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 15:08:26 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (fellca) [87.103.126.54]:28220: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.146.184.19
country_id: 6252001
description:
2025-12-20 15:09:20 dovecot_plain authenticator failed for (ingir) [23.146.184.19]:55102: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 20 15:10:00 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<quBO+l5GkOsDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 20 15:12:19 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<O6aPAl9Ggt8DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 20 15:13:40 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<qv5sB19GApoDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-20 15:13:46 dovecot_plain authenticator failed for (ansacke) [65.20.184.80]:35614: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 15:13:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<qv4mCF9GwqI+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-12-20 15:19:31 dovecot_plain authenticator failed for c-73-0-191-33.hsd1.fl.comcast.net (momoch) [73.0.191.33]:45972: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-12-20 15:21:34 dovecot_plain authenticator failed for host-95-229-5-248.business.telecomitalia.it (othly) [95.229.5.248]:56906: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 15:28:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=</1KdPF9GANE+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 20 15:28:56 host2 sshd[1170223]: Disconnected from invalid user dmdba 102.176.81.29 port 48846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 20 15:30:18 host2 sshd[1171837]: Disconnected from invalid user ubuntu 102.176.81.29 port 40164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 20 15:31:01 host2 sshd[1172530]: Disconnected from invalid user admin 102.176.81.29 port 53960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.19.63
country_id: 2510769
description:
Dec 20 15:32:09 host2 sshd[1173915]: Disconnected from invalid user newuser 79.112.19.63 port 39224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-20 15:32:39 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:45472: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-12-20 15:33:50 dovecot_plain authenticator failed for c-73-0-191-33.hsd1.fl.comcast.net (resmopale) [73.0.191.33]:59320: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 20 15:34:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<3aUYUF9Gjo8+PIdc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 20 15:34:19 host2 sshd[1176043]: Disconnected from invalid user pc 102.176.81.29 port 38374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-20 15:33:23 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:41637: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-20 15:33:48 dovecot_plain authenticator failed for (nophom) [65.20.149.93]:38542: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 15:36:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<ISkmWV9Gwsw+PIdp>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 61.1.105.105
country_id: 1269750
description:
[2025-12-20 15:39:51 +0530] info [webmaild] 61.1.105.105 - info@casa18villa.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 15:40:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<aMDLZl9GdqI+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 20 15:41:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<sr/9a19GfKs+PIdn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 15:45:06 host2 sshd[1187638]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 20 15:46:32 host2 sshd[1189384]: Disconnected from invalid user coco 43.155.21.198 port 48242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 20 15:47:11 host2 sshd[1190058]: Disconnected from invalid user magento 43.155.21.198 port 42304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 20 15:50:13 host2 sshd[1193259]: Disconnected from invalid user mapadmin 43.155.21.198 port 50042 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 15:51:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<UaDfjV9Giq8+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 20 15:52:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<jbQikl9GrP7CpRCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 15:53:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<lhqwll9Gupg+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 15:55:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<d1gzm19GcN4+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.175.118.185
country_id: 2510769
description:
Dec 20 15:55:04 host2 sshd[1197736]: Disconnected from invalid user jack 34.175.118.185 port 37962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 20 15:54:44 host2 sshd[1197362]: Disconnected from invalid user marvin 45.61.187.30 port 45664 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 20 15:55:37 host2 sshd[1198163]: Disconnected from invalid user aaron 45.61.187.30 port 57790 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 15:56:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<xOHZnl9GQJE+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 20 15:56:29 host2 sshd[1198915]: Disconnected from invalid user pos 45.61.187.30 port 41684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.175.118.185
country_id: 2510769
description:
Dec 20 15:56:56 host2 sshd[1199260]: Disconnected from invalid user hyperic 34.175.118.185 port 34882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.175.118.185
country_id: 2510769
description:
Dec 20 15:57:34 host2 sshd[1199745]: Disconnected from invalid user jacques 34.175.118.185 port 46952 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 15:58:09 host2 pure-ftpd[1200159]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.175.118.185
country_id: 2510769
description:
Dec 20 15:58:11 host2 sshd[1200167]: Disconnected from invalid user sign 34.175.118.185 port 58908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-12-20 15:58:27 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:42748: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-20 15:58:59 dovecot_login authenticator failed for ([125.19.196.207]) [27.123.104.142]:42786: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 20 16:01:41 host2 sshd[1202808]: Disconnected from invalid user zach 152.32.172.161 port 38566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-20 16:02:18 dovecot_plain authenticator failed for (swofoice) [176.113.155.132]:50088: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-20 16:02:30 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:46880: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-20 16:02:41 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:59078: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 16:02:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<pcuNtl9GNM0+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-20 16:02:58 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:37263: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 16:03:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<+0biuV9GQt8+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 16:06:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<DxwIxV9GgOA+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-20 16:08:07 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (pressous) [81.225.30.107]:47920: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.177
country_id: 1733045
description:
2025-12-20 16:09:02 dovecot_login authenticator failed for ([49.124.155.177]) [49.124.155.177]:60890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-20 16:09:05 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:38920: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-20 16:09:06 dovecot_plain authenticator failed for (difily) [65.20.184.80]:46734: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-20 16:09:52 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:56174: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 16:10:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<jPSd0V9GhsY+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 16:10:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<+FbB019Gho8+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-20 16:10:59 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:57260: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-20 16:10:35 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:49284: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 16:11:42 host2 sshd[1212362]: Disconnected from invalid user  2.57.121.25 port 47147 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 16:13:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<qN8Z3V9G9L0+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-20 16:14:48 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (triad) [73.197.194.98]:41192: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 16:15:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Rwvr4l9G1qQ+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.114
country_id: 1269750
description:
2025-12-20 16:16:55 dovecot_login authenticator failed for ([182.78.120.220]) [182.95.49.114]:48202: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-20 16:16:59 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (isandae) [50.74.136.134]:33802: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-20 16:16:37 dovecot_plain authenticator failed for (uniummathy) [103.51.26.198]:60527: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-20 16:17:25 dovecot_login authenticator failed for ([128.185.101.201]) [122.185.146.18]:36296: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-20 16:19:00 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (arilicceal) [174.166.153.20]:46152: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-20 16:20:05 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:37135: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-20 16:20:17 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:60795: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-20 16:21:35 dovecot_login authenticator failed for ([182.95.58.62]) [182.95.58.62]:47662: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.217.74
country_id: 3996063
description:
2025-12-20 16:22:29 dovecot_login authenticator failed for (201.173.217.74-clientes-izzi.mx) [201.173.217.74]:46292: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-20 16:27:15 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (sufromy) [73.145.107.251]:41048: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-20 16:35:02 dovecot_plain authenticator failed for (peysehed) [176.113.155.132]:48005: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 16:38:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<JWKSNWBGIrM+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-12-20 16:38:13 dovecot_login authenticator failed for ([118.26.153.84]) [118.26.153.84]:23242: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 16:38:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<+8qtNWBGiKw+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:37:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5u6eM2BGlqQDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-20 16:37:46 dovecot_plain authenticator failed for (ephise) [91.73.195.150]:58539: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-12-20 16:38:41 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:39510: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:39:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<LOzGOmBG9LIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:41:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mWvuQGBGFu4DhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 16:42:13 host2 sshd[1238523]: Disconnected from invalid user ubnt 2.57.121.25 port 9189 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:41:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<SQSPQWBG1LsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:43:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5FEKR2BG8OcDhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 16:43:46 host2 sshd[1239362]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:43:35 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<2n4CSWBGbNoDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-20 16:44:07 dovecot_login authenticator failed for (177-215-153-215.user.vivozap.com.br) [189.56.0.19]:48450: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-20 16:44:22 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:55708: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:45:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VFJpUWBG/IIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:46:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zD1cVGBGHoADhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:48:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<YPjlWGBGwskDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 16:48:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<inuRWmBGApU+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.30
country_id: 3017382
description:
Dec 20 16:48:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.30, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MnrHWmBGhZhb51ke>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.219
country_id: 3017382
description:
Dec 20 16:48:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.219, lip=66.85.158.91, TLS: Connection closed, session=<WxRlW2BGrZtb51nb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.216
country_id: 3017382
description:
Dec 20 16:48:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.216, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ws/iW2BG+epb51nY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.26
country_id: 3017382
description:
Dec 20 16:48:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.26, lip=66.85.158.91, TLS: Connection closed, session=<AdsSXGBGi+db51ka>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 16:53:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<L4rea2BGXtQ+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.171.155.54
country_id: 6252001
description:
Dec 20 16:58:08 host2 sshd[1249623]: Disconnected from invalid user vector 34.171.155.54 port 53008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.211
country_id: 226074
description:
Dec 20 16:59:52 host2 sshd[1250437]: Disconnected from invalid user nokia 196.0.120.211 port 57618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 17:00:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<ZRllhGBGVqQ+PIdf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 17:00:22 host2 pure-ftpd[1250957]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.150
country_id: 6252001
description:
Dec 20 17:01:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.150, lip=66.85.158.92, TLS: Connection closed, session=<dE83imBGLOnHLZqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 17:03:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<PErjjmBGqI4+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-20 17:03:59 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:35712: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-20 17:04:35 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:51826: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.171.155.54
country_id: 6252001
description:
Dec 20 17:04:52 host2 sshd[1253502]: Disconnected from invalid user app 34.171.155.54 port 57792 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 20 17:06:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<+btgmWBGHuXBHmEh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.171.155.54
country_id: 6252001
description:
Dec 20 17:06:43 host2 sshd[1255173]: Disconnected from invalid user systems 34.171.155.54 port 40296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.171.155.54
country_id: 6252001
description:
Dec 20 17:07:29 host2 sshd[1255762]: Disconnected from invalid user maha 34.171.155.54 port 51582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 17:08:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<6RxWomBGENE+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 17:10:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (colingles) [87.103.126.54]:11868: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-20 17:11:06 dovecot_plain authenticator failed for (blecrati) [65.20.153.146]:60881: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.161.42
country_id: 1210997
description:
2025-12-20 17:10:48 dovecot_login authenticator failed for (103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:49768: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 17:12:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<ipcdsGBGQJc+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-20 17:15:07 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:57930: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-20 17:15:29 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:47946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2025-12-20 17:15:45 dovecot_login authenticator failed for ([84.210.219.80]) [84.210.219.80]:41079: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 17:18:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<KNMYxGBGKIs+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-12-20 17:18:10 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:54323: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-12-20 17:18:00 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:58390: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 17:20:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<xCPYy2BGMtM+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 17:21:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<GRo30mBGeKQ+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-20 17:22:15 dovecot_plain authenticator failed for (antion) [65.20.129.28]:58666: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 17:23:55 host2 sshd[1267560]: Disconnected from invalid user  2.57.121.25 port 18480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 17:25:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<CYBj4GBGiKI+PIcl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.224.106.229
country_id: 1694008
description:
[2025-12-20 17:26:29 +0530] info [whostmgrd] 64.224.106.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 17:27:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Ikhs5mBGSqQ+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-12-20 17:28:30 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:56948: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-20 17:28:44 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:56421: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 17:30:47 host2 sshd[1272748]: Disconnected from invalid user  2.57.121.25 port 36597 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Dec 20 17:31:17 host2 sshd[1273102]: Disconnected from invalid user francois 45.78.223.11 port 42184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 20 17:32:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<5+hT92BGGrc+PIdn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.115.13.62
country_id: 6252001
description:
Dec 20 17:31:35 host2 sshd[1273286]: Disconnected from invalid user debian 136.115.13.62 port 44112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.11
country_id: 1880251
description:
Dec 20 17:32:37 host2 sshd[1273999]: Disconnected from invalid user pp 45.78.223.11 port 51854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 20 17:32:47 host2 sshd[1274103]: Disconnected from invalid user update 189.50.142.82 port 39623 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 20 17:34:23 host2 sshd[1275151]: Disconnected from invalid user noc 189.50.142.82 port 45721 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-20 17:34:24 dovecot_plain authenticator failed for (sclaeau) [65.20.149.93]:54980: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.115.13.62
country_id: 6252001
description:
Dec 20 17:35:15 host2 sshd[1275831]: Disconnected from invalid user lia 136.115.13.62 port 60948 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 17:35:32 host2 sshd[1276064]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 20 17:35:57 host2 sshd[1276332]: Disconnected from invalid user dana 189.50.142.82 port 53866 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 17:36:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<vGb+BGFG0No+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-20 17:37:04 dovecot_plain authenticator failed for (matchore) [65.20.174.63]:41964: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.226.247.21
country_id: 1861060
description:
Dec 20 17:36:55 host2 sshd[1277131]: Disconnected from invalid user rabbit 74.226.247.21 port 1024 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 17:38:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<vjPLC2FGsts+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.226.247.21
country_id: 1861060
description:
Dec 20 17:38:13 host2 sshd[1278182]: Disconnected from invalid user cmsuser 74.226.247.21 port 1024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 20 17:38:44 host2 sshd[1278488]: Disconnected from invalid user abel 192.210.233.234 port 38082 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.226.247.21
country_id: 1861060
description:
Dec 20 17:38:51 host2 sshd[1278566]: Disconnected from invalid user abel 74.226.247.21 port 1025 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.226.247.21
country_id: 1861060
description:
Dec 20 17:39:29 host2 sshd[1278936]: Disconnected from invalid user alexis 74.226.247.21 port 1026 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-20 17:41:02 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:37720: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.68.114
country_id: 6252001
description:
2025-12-20 17:40:46 dovecot_plain authenticator failed for c-98-227-68-114.hsd1.il.comcast.net ([31.57.166.48]) [98.227.68.114]:59418: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-20 17:41:14 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:36528: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.188.109.206
country_id: 2378080
description:
2025-12-20 17:40:26 dovecot_plain authenticator failed for ([31.57.166.48]) [41.188.109.206]:30505: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.8.164.76
country_id: 3625428
description:
2025-12-20 17:40:37 dovecot_plain authenticator failed for ([31.57.166.48]) [190.8.164.76]:58354: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 20 17:40:37 host2 sshd[1279854]: Disconnected from invalid user design 200.91.236.125 port 49920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-20 17:42:10 dovecot_plain authenticator failed for (faysopaits) [102.53.15.18]:60118: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 20 17:41:46 host2 sshd[1280569]: Disconnected from invalid user martyn 200.91.236.125 port 35835 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.164
country_id: 1643084
description:
Dec 20 17:42:40 host2 sshd[1281097]: Disconnected from invalid user tmp 103.13.207.164 port 55980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 20 17:42:59 host2 sshd[1281265]: Disconnected from invalid user sgeadmin 192.210.233.234 port 34632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 20 17:43:32 host2 sshd[1281565]: Disconnected from invalid user system 192.210.233.234 port 49214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 17:44:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<ieDaImFGvIs+PIcs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.207.164
country_id: 1643084
description:
Dec 20 17:44:40 host2 sshd[1282381]: Disconnected from invalid user ldap 103.13.207.164 port 60120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-20 17:45:53 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (shared) [73.224.171.101]:57128: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-20 17:47:34 dovecot_plain authenticator failed for (shiceasa) [75.97.190.237]:58226: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-20 17:47:44 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (spolinize) [73.196.144.25]:60742: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 17:47:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<HjXYLmFGKNI+PIdl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.233.183.40
country_id: 6252001
description:
Dec 20 17:49:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.233.183.40, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hmhLNGFGAI6s6bco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 17:49:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ICq+NWFGCsQ+PIcm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.233.183.40
country_id: 6252001
description:
Dec 20 17:49:29 host2 pure-ftpd[1286680]: (?@172.233.183.40) [INFO] New connection from 172.233.183.40


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.233.183.40
country_id: 6252001
description:
Dec 20 17:49:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.233.183.40, lip=66.85.158.91, session=<5VMYNWFG5sqs6bco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.176.29.108
country_id: 1694008
description:
2025-12-20 17:50:33 dovecot_plain authenticator failed for ([31.57.166.48]) [175.176.29.108]:15506: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.162.247
country_id: 6252001
description:
2025-12-20 17:50:43 dovecot_plain authenticator failed for ([31.57.166.48]) [172.59.162.247]:14614: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.180.206
country_id: 1168579
description:
2025-12-20 17:51:00 dovecot_plain authenticator failed for ([31.57.166.48]) [103.47.180.206]:26516: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.197
country_id: 1643084
description:
Dec 20 17:52:11 host2 sshd[1288546]: Disconnected from invalid user tomcat 103.186.1.197 port 35914 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 17:53:09 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (aphyper) [87.103.126.54]:16543: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-20 17:55:50 dovecot_login authenticator failed for (nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:51286: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-20 17:56:17 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:52929: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.12
country_id: 798549
description:
Dec 20 17:57:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.12, lip=66.85.158.92, TLS: Connection closed, session=<snD6UWFGJtzUSZQM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.1.197
country_id: 1643084
description:
Dec 20 17:58:14 host2 sshd[1292547]: Disconnected from invalid user wangtao 103.186.1.197 port 60308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.17
country_id: 798549
description:
Dec 20 17:58:27 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=212.73.148.17, lip=66.85.158.92, TLS, session=<xua6VGFGwJPUSZQR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 17:58:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<w7WfVGFGRr4+PIdj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.94.133.80
country_id: 1643084
description:
Dec 20 17:58:46 host2 pure-ftpd[1292764]: (?@103.94.133.80) [INFO] New connection from 103.94.133.80


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.94.133.80
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.94.133.80 - info@idesignvector.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.94.133.80
country_id: 1643084
description:
Dec 20 17:58:48 host2 sshd[1292765]: Invalid user info@idesignvector.com from 103.94.133.80 port 57305


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 20 18:00:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<ZxAsW2FG6ow+PIdh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.56.139.228
country_id: 1522867
description:
2025-12-20 18:00:25 dovecot_plain authenticator failed for 95.56.139.228.dynamic.telecom.kz ([31.57.166.48]) [95.56.139.228]:34826: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.234.227
country_id: 6252001
description:
2025-12-20 18:00:36 dovecot_plain authenticator failed for ([31.57.166.48]) [98.122.234.227]:53072: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.210.63
country_id: 192950
description:
2025-12-20 18:00:49 dovecot_plain authenticator failed for ([31.57.166.48]) [196.250.210.63]:31680: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.56.139.228
country_id: 1522867
description:
2025-12-20 18:00:32 dovecot_login authenticator failed for 95.56.139.228.dynamic.telecom.kz ([31.57.166.48]) [95.56.139.228]:34826: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 18:01:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<+L9oX2FGJq0+PIcd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 18:02:42 host2 pure-ftpd[1296023]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 18:03:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<GD7QZWFGBo0+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-20 18:09:21 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (parrefore) [98.193.112.85]:48696: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.19.154
country_id: 4566966
description:
2025-12-20 18:10:24 dovecot_plain authenticator failed for ([31.57.166.48]) [172.59.19.154]:4424: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.9
country_id: 798549
description:
Dec 20 18:10:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.149.9, lip=66.85.158.91, TLS: Connection closed, session=<mxNBfmFGlMhV2ZUJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-12-20 18:11:04 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:59740: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.19.154
country_id: 4566966
description:
2025-12-20 18:10:30 dovecot_login authenticator failed for ([31.57.166.48]) [172.59.19.154]:4424: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-12-20 18:10:34 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:35473: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.187.103.24
country_id: 3469034
description:
2025-12-20 18:10:36 dovecot_plain authenticator failed for ([31.57.166.48]) [191.187.103.24]:52698: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.131.60.102
country_id: 453733
description:
2025-12-20 18:10:47 dovecot_plain authenticator failed for 82-131-60-102.ip.elisa.ee ([31.57.166.48]) [82.131.60.102]:51716: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2025-12-20 18:15:06 dovecot_login authenticator failed for ([182.95.85.103]) [182.95.112.146]:53722: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 18:15:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<R7vTkGFGpK8+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 20 18:16:42 host2 sshd[1307335]: Disconnected from invalid user web 181.46.131.55 port 37134 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 18:19:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<m3jPoGFGnug+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-20 18:20:32 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (vatis) [76.16.7.82]:58600: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.245.234.92
country_id: 3996063
description:
2025-12-20 18:20:34 dovecot_plain authenticator failed for ([31.57.166.48]) [177.245.234.92]:6901: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.199
country_id: 6252001
description:
Dec 20 18:20:42 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.126.199, lip=66.85.158.92, session=<0BdHpGFGLpmH7X7H>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 20 18:21:29 host2 sshd[1310268]: Disconnected from invalid user rolando 181.46.131.55 port 36854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 18:23:29 host2 sshd[1311411]: Disconnected from invalid user admin 2.57.121.112 port 15381 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 18:24:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<rHy+sWFGdLk+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 18:25:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<BQPwtGFGKuI+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.12.63
country_id: 6252001
description:
Dec 20 18:28:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.168.12.63, lip=66.85.158.91, session=<NCFNv2FGwtIUqAw/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 20 18:27:38 host2 sshd[1313934]: Disconnected from invalid user tes 181.46.131.55 port 44882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 20 18:28:35 host2 sshd[1314508]: Disconnected from invalid user alba 181.46.131.55 port 40172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.92.174.85
country_id: 1643084
description:
2025-12-20 18:29:43 dovecot_login authenticator failed for ([36.92.174.85]) [36.92.174.85]:61237: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.170
country_id: 6251999
description:
2025-12-20 18:29:59 dovecot_login authenticator failed for ([207.134.139.173]) [207.134.139.170]:35727: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.73.24.6
country_id: 3469034
description:
2025-12-20 18:30:22 dovecot_plain authenticator failed for ([31.57.166.48]) [187.73.24.6]:33183: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.73.24.6
country_id: 3469034
description:
2025-12-20 18:30:28 dovecot_login authenticator failed for ([31.57.166.48]) [187.73.24.6]:33183: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.100.56.185
country_id: 3469034
description:
2025-12-20 18:30:39 dovecot_plain authenticator failed for 131-100-56-185.starconect.com.br ([31.57.166.48]) [131.100.56.185]:55603: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 18:34:12 host2 sshd[1318131]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 18:39:03 host2 sshd[1321431]: Disconnected from invalid user jazmyne 62.60.131.157 port 52703 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-20 18:40:30 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:60543: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.90
country_id: 1733045
description:
2025-12-20 18:41:43 dovecot_login authenticator failed for ([49.125.201.90]) [49.125.201.90]:34992: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2025-12-20 18:42:50 dovecot_plain authenticator failed for (dostitism) [50.202.197.108]:37668: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 18:46:52 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<lIO7AWJG3sA+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-20 18:47:11 dovecot_plain authenticator failed for (driarat) [12.150.243.22]:4866: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-20 18:54:11 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (ovalcon) [73.196.144.25]:43398: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-20 18:57:28 dovecot_login authenticator failed for ([27.123.113.10]) [27.123.113.10]:41756: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-20 18:57:44 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:54125: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-20 18:58:40 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (saurn) [24.1.200.187]:45994: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-20 19:00:09 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (glocallees) [73.224.171.101]:39008: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-20 19:00:48 dovecot_login authenticator failed for ([46.212.111.48]) [46.212.111.48]:33090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-20 19:02:11 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (porks) [73.196.144.25]:49028: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.5.114
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.5.114: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 19:05:06 host2 pure-ftpd[1339465]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-20 19:07:04 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (retrians) [196.47.172.253]:35960: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-20 19:07:10 dovecot_plain authenticator failed for (boscroax) [192.81.229.179]:43470: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-12-20 19:09:10 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:37504: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-12-20 19:09:32 dovecot_login authenticator failed for ([154.118.162.194]) [154.118.162.194]:32491: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.123.164.6
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 84.123.164.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2025-12-20 19:13:55 dovecot_plain authenticator failed for (graldion) [109.226.27.227]:40080: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2025-12-20 19:14:00 dovecot_plain authenticator failed for (fregous) [50.202.197.108]:33370: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 19:24:21 host2 sshd[1350145]: Disconnected from invalid user  2.57.121.25 port 53342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 19:24:28 host2 sshd[1350179]: Disconnected from invalid user admin 2.57.121.112 port 46695 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 19:25:49 host2 sshd[1351199]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 20 19:26:18 host2 sshd[1351395]: Disconnected from invalid user demo 132.248.55.4 port 41760 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 19:28:02 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<zjgBlWJG7ts+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 20 19:30:12 host2 sshd[1353597]: Disconnected from invalid user labor 132.248.55.4 port 5009 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 20 19:30:49 host2 sshd[1353982]: Disconnected from invalid user cod4server 132.248.55.4 port 21600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 20 19:31:30 host2 sshd[1354496]: Disconnected from invalid user work 132.248.55.4 port 48775 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-20 19:32:31 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (cakee) [73.208.81.125]:39818: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-20 19:32:44 dovecot_plain authenticator failed for (popre) [24.105.248.218]:39396: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 19:33:45 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (paverks) [87.103.126.54]:32164: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 19:38:38 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<mYzcumJG4KA+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Dec 20 19:49:53 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pLxB42JGXoHY2s5C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Dec 20 19:50:29 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS: Connection closed, session=<Y/lj5WJGwh3Y2s5C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 20 19:52:27 host2 sshd[1368680]: Disconnected from invalid user admin 201.249.192.30 port 41742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 20 19:54:02 host2 sshd[1369549]: Disconnected from invalid user services 201.249.192.30 port 54521 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 20 19:53:24 host2 sshd[1369203]: Disconnected from invalid user minecraft 201.249.192.30 port 37698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Dec 20 19:56:19 host2 sshd[1371508]: Disconnected from invalid user mcs 196.189.237.92 port 60744 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.137
country_id: 6252001
description:
Dec 20 19:56:33 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.137, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RZsR+2JGH9aTuYWJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Dec 20 19:57:06 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<soDf/GJGGpvE+2YV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Dec 20 19:57:06 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<Lm/u/GJGtKXE+2YK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Dec 20 19:57:07 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<nMH8/GJGtJ/E+2YY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Dec 20 19:57:07 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<Sd/2/GJGQN3E+2YU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Dec 20 19:57:29 host2 sshd[1372304]: Disconnected from invalid user admin 196.189.237.92 port 45278 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Dec 20 19:58:32 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<rOIJAmNGjprE+2YT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 20 19:59:36 host2 sshd[1373540]: Disconnected from invalid user postgres 160.174.129.232 port 55781 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 20 20:01:14 host2 sshd[1374799]: Disconnected from invalid user movies 160.174.129.232 port 39653 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.237.92
country_id: 337996
description:
Dec 20 20:00:31 host2 sshd[1374363]: Disconnected from invalid user sysadmin 196.189.237.92 port 33584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-20 20:01:04 dovecot_plain authenticator failed for (peduort) [64.72.74.162]:38575: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.137
country_id: 6252001
description:
Dec 20 20:01:35 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.137, lip=66.85.158.92, TLS, session=<uC0UDWNGmvuTuYWJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 20 20:02:34 host2 sshd[1375572]: Disconnected from invalid user test1 160.174.129.232 port 52367 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.25.51
country_id: 1605651
description:
Dec 20 20:04:44 host2 sshd[1377001]: Disconnected from invalid user es 49.228.25.51 port 45690 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.25.51
country_id: 1605651
description:
Dec 20 20:06:05 host2 sshd[1378219]: Disconnected from invalid user server 49.228.25.51 port 42184 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 20:07:42 host2 pure-ftpd[1379208]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.40.213
country_id: 1880251
description:
[2025-12-20 20:11:10 +0530] info [cpaneld] 159.223.40.213 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-20 20:11:51 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (elygly) [73.13.220.220]:53662: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 20:14:45 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 20:15:39 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-12-20 20:19:02 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:58664: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-12-20 20:19:58 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:52378: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-20 20:20:58 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:48804: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.252.220.90
country_id: 6252001
description:
[2025-12-20 20:23:24 +0530] info [webmaild] 192.252.220.90 - info@nsteeleng.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 20:26:50 host2 sshd[1392552]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 20:26:43 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.49.216.16
country_id: 2017370
description:
[2025-12-20 20:27:52 +0530] info [cpaneld] 130.49.216.16 - nccphealthgov "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.193.159
country_id: 6252001
description:
Dec 20 20:32:34 host2 pure-ftpd[1397479]: (?@20.65.193.159) [INFO] New connection from 20.65.193.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-20 20:35:17 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (miete) [174.161.27.82]:34973: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 20:35:59 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-20 20:36:35 dovecot_plain authenticator failed for (nomaing) [94.206.93.90]:45240: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-20 20:37:06 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (corivism) [98.193.112.85]:52808: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 20:37:32 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.98.128.249
country_id: 6252001
description:
Dec 20 20:40:45 host2 pure-ftpd[1403540]: (?@20.98.128.249) [INFO] New connection from 20.98.128.249


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.172.221
country_id: 1861060
description:
Dec 20 20:41:06 host2 sshd[1403807]: Disconnected from invalid user bot 160.251.172.221 port 47706 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.172.221
country_id: 1861060
description:
Dec 20 20:41:48 host2 sshd[1404334]: Disconnected from invalid user debian 160.251.172.221 port 37862 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 20:43:17 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (nastraty) [87.103.126.54]:21758: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 20:44:41 host2 sshd[1406768]: Disconnected from invalid user  2.57.121.25 port 48045 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-20 20:46:51 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:38104: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-12-20 20:47:07 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:56034: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 20 20:48:12 host2 sshd[1409870]: Disconnected from invalid user vyos 78.100.64.148 port 51881 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-12-20 20:48:42 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:56892: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-20 20:49:13 dovecot_login authenticator failed for ([128.185.253.122]) [128.185.253.122]:39278: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 20 20:52:30 host2 sshd[1412921]: Disconnected from invalid user db2inst1 78.100.64.148 port 19823 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.100.64.148
country_id: 289688
description:
Dec 20 20:53:10 host2 sshd[1413410]: Disconnected from invalid user deploy 78.100.64.148 port 60366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 20 20:53:50 host2 sshd[1413836]: Disconnected from invalid user usuario 78.100.64.148 port 13843 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 20 20:54:31 host2 sshd[1414980]: Disconnected from invalid user hacluster 78.100.64.148 port 55564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec 20 20:56:18 host2 sshd[1416435]: Disconnected from invalid user guest 198.12.114.232 port 57256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.114.232
country_id: 6252001
description:
Dec 20 20:56:55 host2 sshd[1416756]: Disconnected from invalid user emo 198.12.114.232 port 60136 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 20:57:52 host2 sshd[1417284]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 20 20:58:28 host2 sshd[1417620]: Disconnected from invalid user test 68.183.224.170 port 59786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 20 21:00:00 host2 sshd[1418461]: Disconnected from invalid user yash 68.183.224.170 port 58152 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 20 21:00:42 host2 sshd[1419274]: Disconnected from invalid user vbox 68.183.224.170 port 40990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-20 21:01:12 dovecot_plain authenticator failed for (clistionic) [24.187.213.29]:34796: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-20 21:01:16 dovecot_plain authenticator failed for (unigelec) [92.62.243.174]:37977: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2025-12-20 21:01:46 dovecot_plain authenticator failed for (murking) [185.120.142.233]:38238: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-20 21:02:34 dovecot_plain authenticator failed for (balic) [5.11.221.119]:41644: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 21:07:13 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (yakinul) [87.103.126.54]:30508: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 20 21:07:19 host2 sshd[1423952]: Disconnected from invalid user guest 5.182.83.231 port 39152 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Dec 20 21:06:38 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Q2e69WNG4CtAPsW2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-20 21:07:49 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:48388: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-20 21:08:27 dovecot_login authenticator failed for (187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:42190: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 20 21:08:29 host2 sshd[1424627]: Disconnected from invalid user yaraque 5.182.83.231 port 42484 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 21:10:11 host2 pure-ftpd[1425932]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.123
country_id: 6252001
description:
Dec 20 21:12:21 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.123, lip=66.85.158.91, TLS: Connection closed, session=<6+EvCmRG0O/HLZp7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.123
country_id: 6252001
description:
Dec 20 21:12:27 host2 dovecot[1321837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=199.45.154.123, lip=66.85.158.91, session=<yfiHCmRG8O/HLZp7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 21:18:38 host2 sshd[1430644]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-12-20 21:23:44 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:61061: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.4
country_id: 6252001
description:
Dec 20 21:23:53 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.4, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<3IhkM2RG2d6TuYUE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-12-20 21:24:11 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:51757: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.4
country_id: 6252001
description:
Dec 20 21:24:49 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.4, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<c6O6NmRGaPWTuYUE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.4
country_id: 6252001
description:
Dec 20 21:32:04 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.4, lip=66.85.158.91, TLS, session=<74OxUGRGqPaTuYUE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 20 21:33:14 host2 sshd[1439587]: Disconnected from invalid user webadm 79.168.139.28 port 46312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Dec 20 21:39:13 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<y5YbamRGJtfE+2YX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Dec 20 21:39:13 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<cQolamRGOKTE+2YW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.185.64
country_id: 1605651
description:
Dec 20 21:39:34 host2 sshd[1444584]: Disconnected from invalid user larry 27.254.185.64 port 19276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 20 21:39:36 host2 sshd[1444597]: Disconnected from invalid user yann 79.168.139.28 port 57556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.185.64
country_id: 1605651
description:
Dec 20 21:40:56 host2 sshd[1445553]: Disconnected from invalid user luser 27.254.185.64 port 15733 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 20 21:40:46 host2 sshd[1445481]: Disconnected from invalid user alberto 79.168.139.28 port 49874 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.154.138
country_id: 6252001
description:
Dec 20 21:42:10 host2 pure-ftpd[1446567]: (?@199.45.154.138) [INFO] New connection from 199.45.154.138


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.185.64
country_id: 1605651
description:
Dec 20 21:42:15 host2 sshd[1446605]: Disconnected from invalid user hdfs 27.254.185.64 port 41306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-20 21:42:52 dovecot_plain authenticator failed for H=(leanucly) [91.73.188.251]:33503: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 21:48:37 host2 sshd[1450407]: Disconnected from invalid user admin 2.57.121.112 port 52940 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-20 21:51:10 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:34699: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-12-20 21:52:38 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:45072: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-12-20 21:52:57 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:52098: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 21:59:58 host2 sshd[1472346]: Disconnected from invalid user admin 2.57.121.112 port 16684 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-20 22:02:20 dovecot_plain authenticator failed for H=c-75-74-211-27.hsd1.fl.comcast.net (rader) [75.74.211.27]:44242: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2025-12-20 22:03:13 dovecot_plain authenticator failed for H=c-73-55-194-114.hsd1.tx.comcast.net (dings) [73.55.194.114]:39722: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 22:04:31 host2 sshd[1476101]: Disconnected from invalid user  2.57.121.25 port 17099 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-12-20 22:06:57 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:51378: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-20 22:07:26 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:41857: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.196.212.207
country_id: 6252001
description:
Dec 20 22:07:28 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed: read(size=994) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.196.212.207, lip=66.85.158.91, session=<uQtGz2RG1NMjxNTP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.174.116.14
country_id: 6252001
description:
Dec 20 22:08:08 host2 pure-ftpd[1478789]: (?@172.174.116.14) [INFO] New connection from 172.174.116.14


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 22:08:48 host2 sshd[1479151]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 20 22:10:27 host2 sshd[1480964]: Disconnected from invalid user qa 117.250.96.66 port 57778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.113.12
country_id: 1819730
description:
Dec 20 22:13:38 host2 sshd[1485320]: Disconnected from invalid user ftpuser 154.82.113.12 port 55314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.125.218.183
country_id: 2017370
description:
Dec 20 22:13:51 host2 sshd[1485552]: Disconnected from invalid user ravi 185.125.218.183 port 44950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 20 22:13:53 host2 sshd[1485578]: Disconnected from invalid user web 117.250.96.66 port 56114 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.82.113.12
country_id: 1819730
description:
Dec 20 22:15:36 host2 sshd[1488080]: Disconnected from invalid user sysuser 154.82.113.12 port 60250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 20 22:15:37 host2 sshd[1488083]: Disconnected from invalid user backoffice 117.250.96.66 port 55280 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 22:17:08 host2 sshd[1489817]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-20 22:16:47 dovecot_plain authenticator failed for H=(immandal) [65.20.143.159]:41728: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 20 22:17:03 host2 sshd[1489715]: Disconnected from invalid user proxyuser 58.98.199.45 port 45882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-20 22:16:43 dovecot_plain authenticator failed for H=81-225-30-107-no2380.tbcn.telia.com (atrinic) [81.225.30.107]:47670: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-12-20 22:18:20 dovecot_login authenticator failed for H=(ws99-36-153-203.rcil.gov.in) [182.72.143.2]:38948: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.113.12
country_id: 1819730
description:
Dec 20 22:17:36 host2 sshd[1490460]: Disconnected from invalid user aso 154.82.113.12 port 41282 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.208
country_id: 6252001
description:
Dec 20 22:19:13 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.208, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KexO+WRGG/VBMQHQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 20 22:18:33 host2 sshd[1491275]: Disconnected from invalid user qa 58.98.199.45 port 43765 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.46.17
country_id: 6251999
description:
2025-12-20 22:18:40 dovecot_login authenticator failed for H=dhcp-b8-94-70-ce-5f-c4.cpe.i-zoom.net [24.137.46.17]:56996: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-12-20 22:18:54 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:40354: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Dec 20 22:19:30 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.202, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7I5U+mRGgFZBMQHK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.127
country_id: 1819730
description:
Dec 20 22:19:29 host2 sshd[1492287]: Disconnected from invalid user eren 123.58.213.127 port 40842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2025-12-20 22:20:52 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:60202: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 20 22:21:24 host2 sshd[1494344]: Disconnected from invalid user lee 58.98.199.45 port 37426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-20 22:21:29 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:53205: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.224.26.102
country_id: 6252001
description:
Dec 20 22:22:21 host2 pure-ftpd[1495086]: (?@34.224.26.102) [INFO] New connection from 34.224.26.102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-12-20 22:32:17 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:46300: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 20 22:32:31 host2 sshd[1502834]: Disconnected from invalid user ravi 58.98.199.45 port 41640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-20 22:32:57 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:36306: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 20 22:39:32 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<avvRQWVGWM/BHmEh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 20 22:39:40 host2 sshd[1507030]: Disconnected from invalid user backoffice 58.98.199.45 port 34469 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-20 22:41:38 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:43204: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-20 22:42:00 dovecot_login authenticator failed for H=([182.95.63.10]) [182.95.63.10]:42378: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.121.0.25
country_id: 1220409
description:
Dec 20 22:42:41 host2 sshd[1509097]: Disconnected from invalid user rita 185.121.0.25 port 55742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 22:44:05 host2 sshd[1509758]: Disconnected from invalid user  2.57.121.25 port 45753 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-20 22:43:53 dovecot_login authenticator failed for H=([121.73.163.186]) [121.73.163.186]:51246: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.191.212.112
country_id: 337996
description:
Dec 20 22:45:05 host2 sshd[1510831]: Disconnected from invalid user runner 196.191.212.112 port 49766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-20 22:44:26 dovecot_login authenticator failed for H=(nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:57136: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.25
country_id: 1220409
description:
Dec 20 22:44:38 host2 sshd[1509979]: Disconnected from invalid user postgres 185.121.0.25 port 50410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-20 22:46:02 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (rallfid) [71.224.169.28]:53956: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.210.213
country_id: 3686110
description:
Dec 20 22:46:47 host2 sshd[1511841]: Disconnected from invalid user sftp 179.33.210.213 port 49762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 20 22:47:36 host2 sshd[1512524]: Disconnected from invalid user minecraft 66.116.199.234 port 41254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.19.79.32
country_id: 285570
description:
2025-12-20 22:47:39 dovecot_plain authenticator failed for H=(billy) [185.19.79.32]:57936: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-20 22:47:45 dovecot_plain authenticator failed for H=(sylationon) [94.206.93.90]:52291: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 20 22:48:24 host2 sshd[1512988]: Disconnected from invalid user bot01 66.116.199.234 port 48454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Dec 20 22:49:42 host2 sshd[1513631]: Disconnected from invalid user sshuser 102.211.152.138 port 52224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.191.212.112
country_id: 337996
description:
Dec 20 22:49:50 host2 sshd[1513693]: Disconnected from invalid user tester 196.191.212.112 port 17550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 20 22:50:05 host2 sshd[1513776]: Disconnected from invalid user design 66.116.199.234 port 34648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Dec 20 22:50:23 host2 sshd[1514244]: Disconnected from invalid user test 102.211.152.138 port 49030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.191.212.112
country_id: 337996
description:
Dec 20 22:50:28 host2 sshd[1514302]: Disconnected from invalid user admin 196.191.212.112 port 1315 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.152.138
country_id: 3469034
description:
Dec 20 22:50:59 host2 sshd[1514578]: Disconnected from invalid user gitserver 102.211.152.138 port 45454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 22:51:55 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (bologic) [87.103.126.54]:10185: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 23:00:05 host2 sshd[1520581]: Disconnected from invalid user admin 2.57.121.112 port 28814 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 23:04:45 host2 sshd[1523712]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.254.5
country_id: 3996063
description:
2025-12-20 23:05:50 dovecot_login authenticator failed for H=([189.219.254.5]) [189.219.254.5]:46543: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-20 23:06:31 dovecot_login authenticator failed for H=(201.173.250.36-clientes-izzi.mx) [201.173.250.36]:47331: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Dec 20 23:07:35 host2 pure-ftpd[1525573]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.138
country_id: 2264397
description:
Dec 20 23:07:51 host2 pure-ftpd[1525801]: (?@45.156.129.138) [INFO] New connection from 45.156.129.138


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 23:08:36 host2 sshd[1526305]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.36
country_id: 6252001
description:
Dec 20 23:09:08 host2 pure-ftpd[1526618]: (?@205.210.31.36) [INFO] New connection from 205.210.31.36


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.126
country_id: 6252001
description:
Dec 20 23:10:41 host2 pure-ftpd[1527946]: (?@198.235.24.126) [INFO] New connection from 198.235.24.126


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 23:11:54 host2 pure-ftpd[1528867]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-20 23:16:31 dovecot_login authenticator failed for H=(cm-178.232.147.85.get.no) [178.232.147.85]:56594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Dec 20 23:16:41 host2 sshd[1532955]: Disconnected from invalid user user 38.47.92.86 port 44912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-20 23:16:49 dovecot_login authenticator failed for H=(nsg-corporate-127.152.185.122.airtel.in) [122.185.146.18]:35384: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Dec 20 23:19:11 host2 sshd[1534874]: Disconnected from invalid user amir 38.47.92.86 port 33402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 20 23:19:14 host2 sshd[1534930]: Disconnected from invalid user test 209.141.33.240 port 47406 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 20 23:19:59 host2 sshd[1535627]: Disconnected from invalid user linux 118.193.38.207 port 60588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.47.92.86
country_id: 1643084
description:
Dec 20 23:19:48 host2 sshd[1535389]: Disconnected from invalid user informix 38.47.92.86 port 44128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Dec 20 23:21:08 host2 sshd[1536875]: Disconnected from invalid user rodrigo 38.47.92.86 port 42062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 20 23:21:10 host2 sshd[1536912]: Disconnected from invalid user cs 103.172.204.220 port 52562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 20 23:20:48 host2 sshd[1536572]: Disconnected from invalid user ccorrea 209.141.33.240 port 35514 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.33.240
country_id: 6252001
description:
Dec 20 23:21:47 host2 sshd[1537496]: Disconnected from invalid user deploy 209.141.33.240 port 47054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.10
country_id: 6252001
description:
2025-12-20 23:23:17 dovecot_login authenticator failed for H=(uAYbBoG) [165.154.235.10]:50197: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 20 23:22:33 host2 sshd[1538263]: Disconnected from invalid user jack 118.193.38.207 port 39292 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Dec 20 23:22:55 host2 sshd[1538573]: Disconnected from invalid user steam 38.47.92.86 port 42308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 23:23:14 host2 sshd[1538901]: Disconnected from invalid user admin 2.57.121.25 port 14765 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.10
country_id: 6252001
description:
2025-12-20 23:23:33 dovecot_login authenticator failed for H=(RMlLmm0) [165.154.235.10]:52959: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 165.154.235.10
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[165.154.235.10] [Authentication Database]=[mail] [Username]=[ajith@simple-engineering.lk] (5/5 failures) (blocked until [Sat Dec 20 18:09:05 2025 UTC/Sat Dec 20 23:39:05 2025 LOCAL])


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Dec 20 23:25:32 host2 sshd[1541807]: Disconnected from invalid user cs 118.193.38.207 port 50642 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 20 23:27:01 host2 sshd[1543287]: Disconnected from invalid user vpn 103.172.204.220 port 34452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.46
country_id: 1733045
description:
2025-12-20 23:27:03 dovecot_login authenticator failed for H=([49.124.153.46]) [49.124.153.46]:49548: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.10
country_id: 6252001
description:
2025-12-20 23:27:07 dovecot_login authenticator failed for H=(It7S9h8V7f) [165.154.235.10]:51121: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-20 23:28:03 dovecot_login authenticator failed for H=32.104.29.34.bc.googleusercontent.com [34.29.104.32]:43106: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.247.169.77
country_id: 2510769
description:
Dec 20 23:29:22 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=188.247.169.77, lip=66.85.158.91, TLS, session=<3/Qp82VGHKy896lN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.233
country_id: 3175395
description:
Dec 20 23:29:40 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact>, method=PLAIN, rip=185.15.170.233, lip=66.85.158.91, TLS, session=<YodF9GVGn+25D6rp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.168
country_id: 3175395
description:
Dec 20 23:29:50 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=185.197.8.168, lip=66.85.158.91, TLS, session=<2g/T9GVG8JG5xQio>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.68
country_id: 6252001
description:
Dec 20 23:29:59 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.68, lip=66.85.158.91, session=<Oz1n9mVGSAu4aYtE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 20 23:30:17 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, session=<+Fh392VG4HxKUi8F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.209.138
country_id: 798544
description:
Dec 20 23:29:31 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=91.246.209.138, lip=66.85.158.91, TLS, session=<KEjD82VGlrZb9tGK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.68
country_id: 6252001
description:
Dec 20 23:30:29 host2 dovecot[1321837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=184.105.139.68, lip=66.85.158.91, session=</AUt+GVG9mG4aYtE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Dec 20 23:30:34 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.91, TLS: Connection closed, session=<BqZy+GVGeH9KUi8F>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 23:31:32 host2 sshd[1546728]: Disconnected from invalid user jameson 62.60.131.157 port 5162 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 20 23:40:20 host2 sshd[1554591]: Disconnected from invalid user admin 12.189.234.28 port 34167 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.28
country_id: 6252001
description:
Dec 20 23:41:55 host2 sshd[1555685]: Disconnected from invalid user admin 12.189.234.28 port 52484 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Dec 20 23:42:32 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<SRxDI2ZGnixAPpzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-12-20 23:45:23 dovecot_login authenticator failed for H=(abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:52004: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-12-20 23:45:57 dovecot_login authenticator failed for H=(cm-46.212.39.201.get.no) [46.212.39.201]:38270: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-20 23:47:30 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (proitcric) [73.183.74.177]:47924: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-12-20 23:49:07 dovecot_login authenticator failed for H=(node103203210119.kkdbroadband.co.in) [103.203.210.119]:55872: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-20 23:53:53 dovecot_login authenticator failed for H=(187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:47140: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2025-12-20 23:53:59 dovecot_login authenticator failed for H=([127.0.0.1]) [27.110.176.222]:33732: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-20 23:53:28 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:56005: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.130
country_id: 1269750
description:
2025-12-20 23:53:49 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.184.130]:46470: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.187
country_id: 6252001
description:
Dec 20 23:55:53 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.187, lip=66.85.158.92, session=<xukFU2ZG1aVAPsW7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Dec 20 23:56:07 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.182, lip=66.85.158.92, TLS: Connection closed, session=<1o/XU2ZG8s9APsW2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-20 23:57:32 dovecot_plain authenticator failed for H=c-75-74-211-27.hsd1.fl.comcast.net (aptic) [75.74.211.27]:58463: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-20 23:57:35 dovecot_plain authenticator failed for H=c-71-230-228-16.hsd1.de.comcast.net (multal) [71.230.228.16]:56894: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.234
country_id: 6252001
description:
Dec 20 23:57:49 host2 sshd[1569012]: Disconnected from invalid user eric 216.133.148.234 port 54108 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.74.20
country_id: 6252001
description:
Dec 20 23:57:54 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.74.20, lip=66.85.158.91, TLS, session=<RZM/WmZGMJUUo0oU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.234
country_id: 6252001
description:
Dec 20 23:59:03 host2 sshd[1569815]: Disconnected from invalid user install 216.133.148.234 port 41074 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.90.49.98
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.90.49.98: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.133.148.234
country_id: 6252001
description:
Dec 20 23:59:37 host2 sshd[1570298]: Disconnected from invalid user venta 216.133.148.234 port 39540 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.7
country_id: 2750405
description:
Dec 21 00:00:15 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=31.14.32.7, lip=66.85.158.92, session=<ubqjYmZGWqsfDiAH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.234
country_id: 6252001
description:
Dec 21 00:00:40 host2 sshd[1571320]: Disconnected from invalid user cloud 216.133.148.234 port 45084 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.133.148.234
country_id: 6252001
description:
Dec 21 00:01:44 host2 sshd[1572055]: Disconnected from invalid user django 216.133.148.234 port 37844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.234
country_id: 6252001
description:
Dec 21 00:02:51 host2 sshd[1572719]: Disconnected from invalid user larry 216.133.148.234 port 47772 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.133.148.234
country_id: 6252001
description:
Dec 21 00:03:23 host2 sshd[1573141]: Disconnected from invalid user indra 216.133.148.234 port 52852 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 00:06:42 host2 sshd[1575615]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2025-12-21 00:09:32 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:59740: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.120.148.19
country_id: 1733045
description:
2025-12-21 00:10:00 dovecot_login authenticator failed for H=([121.120.148.19]) [121.120.148.19]:47298: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 00:14:19 host2 pure-ftpd[1581095]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.46.226.34
country_id: 6252001
description:
Dec 21 00:15:24 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.46.226.34, lip=66.85.158.92, TLS, session=<zdjLmGZGMO4ULuIi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-12-21 00:22:38 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:54960: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 00:21:52 host2 sshd[1586315]: Disconnected from invalid user admin 2.57.121.112 port 30516 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.211.157
country_id: 357994
description:
2025-12-21 00:23:21 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.211.157]:41630: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2025-12-21 00:24:16 dovecot_login authenticator failed for H=([127.0.0.1]) [84.210.215.132]:39898: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.76
country_id: 2186224
description:
2025-12-21 00:24:38 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.168.76]:43810: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-21 00:32:33 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (ranicte) [73.197.194.98]:52946: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.90.49.98
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.90.49.98: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.167
country_id: 6252001
description:
Dec 21 00:40:35 host2 pure-ftpd[1598051]: (?@64.62.197.167) [INFO] New connection from 64.62.197.167


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 00:47:04 host2 sshd[1600861]: Disconnected from invalid user  2.57.121.25 port 23757 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.170
country_id: 6252001
description:
Dec 21 00:49:59 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.170, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MZKBFGdGjLgUQcGq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.123.85.122
country_id: 1269750
description:
[2025-12-21 00:51:18 +0530] info [webmaild] 27.123.85.122 - info@ajsstarlog.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.175.151.48
country_id: 130758
description:
Dec 21 00:54:20 host2 sshd[1605644]: Disconnected from invalid user u1 79.175.151.48 port 41004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.175.151.48
country_id: 130758
description:
Dec 21 00:53:45 host2 sshd[1604962]: Disconnected from invalid user hadoop 79.175.151.48 port 33438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.63.103
country_id: 3144096
description:
2025-12-21 00:56:06 dovecot_login authenticator failed for H=([127.0.0.1]) [84.215.63.103]:46924: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.30.206
country_id: 1269750
description:
2025-12-21 00:56:14 dovecot_login authenticator failed for H=([127.0.0.1]) [103.165.30.206]:12855: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.205.37
country_id: 1168579
description:
2025-12-21 00:57:03 dovecot_login authenticator failed for H=([113.203.205.37]) [113.203.205.37]:53573: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-21 00:57:38 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:37432: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 00:57:49 host2 sshd[1608555]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2025-12-21 01:00:22 dovecot_login authenticator failed for H=([101.168.17.20]) [101.168.17.20]:43612: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-21 01:00:36 dovecot_login authenticator failed for H=([61.12.86.92]) [61.12.86.90]:55514: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-21 01:01:30 dovecot_plain authenticator failed for H=37.150.8.174.dynamic.telecom.kz (chiricon) [37.150.8.174]:39708: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.137.48
country_id: 2921044
description:
Dec 21 01:01:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.227.137.48, lip=66.85.158.91, session=<rF3yPWdGG7Sl44kw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Dec 21 01:01:35 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.107, lip=66.85.158.92, session=<W3P4PWdG7J9APsVr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.82.30
country_id: 2921044
description:
Dec 21 01:01:36 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.82.30, lip=66.85.158.91, TLS, session=<qNYDPmdGACmGelIe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.171.132
country_id: 2921044
description:
Dec 21 01:01:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.171.132, lip=66.85.158.91, session=<amT/PWdGXkWkXKuE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.82.30
country_id: 2921044
description:
Dec 21 01:01:37 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=134.122.82.30, lip=66.85.158.91, session=<AEcYPmdGCimGelIe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Dec 21 01:01:49 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.197.107, lip=66.85.158.92, TLS: Connection closed, session=<YvvGPmdGhjZAPsVr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 01:16:39 host2 pure-ftpd[1620392]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.137.193.222
country_id: 6252001
description:
[2025-12-21 01:19:18 +0530] info [cpaneld] 3.137.193.222 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 21 01:18:56 host2 sshd[1622004]: Disconnected from invalid user user 167.71.204.253 port 57218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 21 01:20:17 host2 sshd[1623164]: Disconnected from invalid user hduser 167.71.204.253 port 50582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 21 01:21:00 host2 sshd[1623588]: Disconnected from invalid user alex 167.71.204.253 port 52548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 21 01:22:14 host2 sshd[1624356]: Disconnected from invalid user linuxuser 167.71.204.253 port 56272 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-21 01:24:07 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:42704: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 01:25:51 host2 sshd[1626728]: Disconnected from invalid user  2.57.121.25 port 31176 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 21 01:27:27 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<4zZammdGnL0+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-21 01:29:34 dovecot_plain authenticator failed for H=c-76-16-7-82.hsd1.il.comcast.net (pleanviad) [76.16.7.82]:49590: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.51
country_id: 6252001
description:
Dec 21 01:30:29 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.169.105.51, lip=66.85.158.91, TLS handshaking: Connection closed, session=</XJNpWdGissUqWkz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.231
country_id: 6252001
description:
Dec 21 01:36:15 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.231, lip=66.85.158.91, TLS, session=<nlL2uWdGRvmTuYTn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.2
country_id: 6252001
description:
Dec 21 01:37:53 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=198.235.24.2, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<HELEv2dGGN3G6xgC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-21 01:44:17 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:49654: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2025-12-21 01:44:40 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:52887: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-21 01:45:07 dovecot_plain authenticator failed for H=(orine) [24.187.213.29]:46882: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Dec 21 01:47:13 host2 sshd[1640852]: Disconnected from invalid user ec2-user 181.123.136.11 port 35706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Dec 21 01:50:41 host2 sshd[1643225]: Disconnected from invalid user umar 201.217.12.57 port 53112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.46.61
country_id: 1269750
description:
Dec 21 01:51:17 host2 sshd[1643592]: Disconnected from invalid user ali 122.160.46.61 port 58384 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.217.12.57
country_id: 3437598
description:
Dec 21 01:51:31 host2 sshd[1643716]: Disconnected from invalid user steam 201.217.12.57 port 52680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.82.208.178
country_id: 2245662
description:
Dec 21 01:52:14 host2 sshd[1644105]: Disconnected from invalid user pivpn 41.82.208.178 port 56780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Dec 21 01:52:45 host2 sshd[1644393]: Disconnected from invalid user vyos 51.83.46.40 port 58680 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.82
country_id: 6252001
description:
Dec 21 01:52:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.82, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iUMY9WdGVNnG6xhS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.82.208.178
country_id: 2245662
description:
Dec 21 01:53:05 host2 sshd[1644619]: Disconnected from invalid user guest 41.82.208.178 port 6709 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.46.40
country_id: 3017382
description:
Dec 21 01:53:44 host2 sshd[1645064]: Disconnected from invalid user ton 51.83.46.40 port 41098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 21 01:53:57 host2 sshd[1645185]: Disconnected from invalid user testuser 162.240.156.34 port 54242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Dec 21 01:54:38 host2 sshd[1646062]: Disconnected from invalid user bobo 51.83.46.40 port 49644 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 21 01:55:06 host2 sshd[1646542]: Disconnected from invalid user linuxadmin 162.240.156.34 port 53998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.46.61
country_id: 1269750
description:
Dec 21 01:55:19 host2 sshd[1646718]: Disconnected from invalid user ton 122.160.46.61 port 51046 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 01:55:41 host2 sshd[1647061]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 21 01:55:52 host2 sshd[1647144]: Disconnected from invalid user emmalee 62.60.131.157 port 39158 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.27.16
country_id: 6252001
description:
Dec 21 01:56:09 host2 sshd[1647326]: Disconnected from invalid user developer 142.93.27.16 port 34116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.27.16
country_id: 6252001
description:
Dec 21 01:55:39 host2 sshd[1647030]: Disconnected from invalid user centos 142.93.27.16 port 39530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 01:57:59 host2 sshd[1648314]: Disconnected from invalid user admin 2.57.121.25 port 11229 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Dec 21 02:00:10 host2 sshd[1650129]: Disconnected from invalid user code 201.217.12.57 port 37652 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-21 02:02:22 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:59206: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2025-12-21 02:02:35 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:49792: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Dec 21 02:02:43 host2 sshd[1652168]: Disconnected from invalid user test 181.123.136.11 port 54912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-21 02:04:24 dovecot_login authenticator failed for H=bl14-230-132.dsl.telepac.pt [85.247.230.132]:44062: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.173
country_id: 1643084
description:
Dec 21 02:07:12 host2 sshd[1656169]: Disconnected from invalid user usman 182.253.156.173 port 45652 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 182.253.156.173
country_id: 1643084
description:
Dec 21 02:07:43 host2 sshd[1656502]: Received disconnect from 182.253.156.173 port 46534:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-21 02:07:55 dovecot_login authenticator failed for H=([128.185.231.6]) [128.185.231.6]:37972: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-21 02:08:18 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:37207: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.19
country_id: 1880251
description:
Dec 21 02:17:56 host2 sshd[1665534]: Disconnected from invalid user victor 45.78.224.19 port 39020 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 02:18:55 host2 pure-ftpd[1666695]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-12-21 02:26:25 dovecot_login authenticator failed for H=([85.159.165.216]) [85.159.165.216]:45073: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.219
country_id: 1733045
description:
2025-12-21 02:26:02 dovecot_login authenticator failed for H=([49.124.152.219]) [49.124.152.219]:46148: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 21 02:44:21 host2 sshd[1686439]: Disconnected from invalid user reza 192.3.105.24 port 49424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 21 02:44:56 host2 sshd[1686862]: Disconnected from invalid user deleteme 192.3.105.24 port 49488 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 02:46:30 host2 sshd[1688418]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 21 02:46:00 host2 sshd[1688091]: Disconnected from invalid user aa 192.3.105.24 port 49616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 21 02:46:18 host2 sshd[1688296]: Disconnected from invalid user username 172.200.228.35 port 52022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Dec 21 02:46:49 host2 sshd[1688563]: Disconnected from invalid user pp 45.202.211.6 port 49338 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.202.211.6
country_id: 1819730
description:
Dec 21 02:48:23 host2 sshd[1689417]: Disconnected from invalid user ankit 45.202.211.6 port 44774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 21 02:48:26 host2 sshd[1689484]: Disconnected from invalid user ubuntu 172.200.228.35 port 39452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.59.156.47
country_id: 6252001
description:
Dec 21 02:48:01 host2 sshd[1689255]: Disconnected from invalid user reza 34.59.156.47 port 42502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.59.156.47
country_id: 6252001
description:
Dec 21 02:49:24 host2 sshd[1690183]: Disconnected from invalid user sysadmin 34.59.156.47 port 34708 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 21 02:51:50 host2 sshd[1692056]: Disconnected from invalid user casa 172.200.228.35 port 43694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Dec 21 02:51:51 host2 sshd[1692050]: Disconnected from invalid user ubuntu 45.202.211.6 port 46978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.59.156.47
country_id: 6252001
description:
Dec 21 02:52:12 host2 sshd[1692269]: Disconnected from invalid user testuser 34.59.156.47 port 49030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.59.156.47
country_id: 6252001
description:
Dec 21 02:54:09 host2 sshd[1693680]: Disconnected from invalid user elk 34.59.156.47 port 34854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec 21 02:55:47 host2 sshd[1694966]: Disconnected from invalid user mike 59.98.148.5 port 40330 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-21 02:58:07 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (rases) [174.161.27.82]:59387: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-21 03:00:19 dovecot_login authenticator failed for H=([180.94.75.102]) [180.94.75.102]:41205: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-12-21 03:00:36 dovecot_login authenticator failed for H=([190.67.106.221]) [190.67.106.221]:44720: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.230
country_id: 6252001
description:
Dec 21 03:01:08 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.230, lip=66.85.158.91, TLS, session=<RVSA6WhGWrtHBobm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-21 03:11:04 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (chenon) [67.173.58.47]:40062: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.181.61.83
country_id: 1269750
description:
Dec 21 03:13:36 host2 sshd[1706262]: Disconnected from invalid user esuser 223.181.61.83 port 30763 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-21 03:14:37 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (obiablitus) [71.224.169.28]:33696: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 21 03:15:23 host2 sshd[1707485]: Disconnected from invalid user drcomadmin 158.178.141.16 port 39706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-21 03:17:23 dovecot_login authenticator failed for H=([182.78.240.94]) [182.78.240.94]:43038: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.202.82.102
country_id: 1861060
description:
2025-12-21 03:17:42 dovecot_login authenticator failed for H=fp5cca5266.gifg408.ap.nuro.jp [92.202.82.102]:34982: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.181.61.83
country_id: 1269750
description:
Dec 21 03:18:39 host2 sshd[1709752]: Disconnected from invalid user admin 223.181.61.83 port 25598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 21 03:18:44 host2 sshd[1709814]: Disconnected from invalid user ubuntu 158.178.141.16 port 11696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 21 03:18:57 host2 sshd[1709938]: Disconnected from invalid user respaldo 213.142.151.19 port 34972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 21 03:19:28 host2 sshd[1710230]: Disconnected from invalid user tomcat 158.178.141.16 port 28976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.181.61.83
country_id: 1269750
description:
Dec 21 03:19:35 host2 sshd[1710291]: Disconnected from invalid user ftptest 223.181.61.83 port 23531 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.121.43
country_id: 3144096
description:
2025-12-21 03:19:44 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.121.43]:38895: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.121.43
country_id: 3144096
description:
2025-12-21 03:19:54 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.121.43]:38972: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2025-12-21 03:20:05 dovecot_login authenticator failed for H=([127.0.0.1]) [49.0.36.82]:53476: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 03:20:34 host2 sshd[1711105]: Disconnected from invalid user admin 2.57.121.25 port 55089 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.195.144
country_id: 1269750
description:
Dec 21 03:20:44 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.213.195.144, lip=66.85.158.91, TLS, session=<SalXLmlGloNn1cOQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 21 03:20:06 host2 sshd[1710745]: Disconnected from invalid user upload 158.178.141.16 port 16142 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.229
country_id: 6252001
description:
Dec 21 03:20:22 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.229, lip=66.85.158.92, session=<MhlPLmlGVv+s7OTl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.181.61.83
country_id: 1269750
description:
Dec 21 03:20:25 host2 sshd[1711028]: Disconnected from invalid user test01 223.181.61.83 port 31884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.253
country_id: 3469034
description:
Dec 21 03:21:04 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.53.128.253, lip=66.85.158.91, TLS, session=<p6i2L2lG/ty/NYD9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 03:21:11 host2 pure-ftpd[1711632]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-21 03:21:32 dovecot_login authenticator failed for H=(201.173.86.13-clientes-izzi.mx) [201.173.86.13]:42186: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-21 03:20:54 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:51739: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.80.243
country_id: 6252001
description:
Dec 21 03:21:59 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.33.80.243, lip=66.85.158.92, session=<l54PNGlGbPItIVDz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-21 03:25:04 dovecot_login authenticator failed for H=([84.211.12.107]) [84.211.12.107]:55663: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-21 03:25:20 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:57332: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.104
country_id: 3996063
description:
2025-12-21 03:25:41 dovecot_login authenticator failed for H=(201.173.216.104-clientes-izzi.mx) [201.173.216.104]:44183: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2025-12-21 03:27:55 dovecot_login authenticator failed for H=(fGR0Yt9ai) [45.92.33.82]:53514: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 45.92.33.82
country_id: 390903
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[45.92.33.82] [Authentication Database]=[mail] [Username]=[info@ceylondigest.com] (5/5 failures) (blocked until [Sat Dec 20 22:13:36 2025 UTC/Sun Dec 21 03:43:36 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-21 03:30:11 dovecot_login authenticator failed for H=([128.185.223.36]) [182.95.178.122]:42770: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-21 03:30:31 dovecot_login authenticator failed for H=(cm-84.213.189.159.get.no) [84.213.189.159]:58895: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.104
country_id: 3865483
description:
Dec 21 03:40:10 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=45.238.107.104, lip=66.85.158.91, TLS, session=<VZ3Zc2lGaLct7mto>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.126
country_id: 226074
description:
Dec 21 03:40:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 35 secs): user=<gihan>, method=PLAIN, rip=196.0.10.126, lip=66.85.158.91, TLS, session=<vN+MdWlGfLPEAAp+>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.199
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.199: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 03:43:55 host2 sshd[1726253]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-21 03:47:17 dovecot_login authenticator failed for H=([125.20.231.225]) [128.185.231.6]:49766: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-12-21 03:48:22 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:51167: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 03:58:25 host2 sshd[1739318]: Disconnected from invalid user admin 2.57.121.25 port 46071 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-21 04:01:33 dovecot_login authenticator failed for H=(cm-178.232.138.184.get.no) [178.232.138.184]:47365: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.55.55
country_id: 6252001
description:
[2025-12-21 04:01:41 +0530] info [cpaneld] 157.230.55.55 - info@cloudtourssrilanka.com "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.55.55
country_id: 6252001
description:
[2025-12-21 04:01:52 +0530] info [webmaild] 157.230.55.55 - info@cloudtourssrilanka.com "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-21 04:01:55 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:46682: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-12-21 04:01:58 dovecot_plain authenticator failed for H=([178.16.55.198]) [178.16.55.198]:49291: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 21 04:10:38 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=176.32.195.85, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sccS4mlGdeqwIMNV>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 149.102.232.115
country_id: 3057568
description:
Dec 21 04:15:59 host2 pure-ftpd[1756496]: (?@149.102.232.115) [INFO] New connection from 149.102.232.115


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec 21 04:17:31 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS: Connection closed, session=<ccqr+mlGHtxChJl6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.28.108.165
country_id: 953987
description:
Dec 21 04:22:17 host2 sshd[1763704]: Disconnected from invalid user www 105.28.108.165 port 57674 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 04:23:29 host2 pure-ftpd[1764780]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.28.108.165
country_id: 953987
description:
Dec 21 04:24:45 host2 sshd[1765580]: Disconnected from invalid user postgres 105.28.108.165 port 39016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 21 04:25:28 host2 sshd[1766266]: Disconnected from invalid user ftp1 118.194.231.208 port 33806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.28.108.165
country_id: 953987
description:
Dec 21 04:25:33 host2 sshd[1766328]: Disconnected from invalid user simone 105.28.108.165 port 52882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 21 04:27:21 host2 sshd[1767619]: Disconnected from invalid user backupuser 118.194.231.208 port 33888 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 21 04:28:02 host2 sshd[1768011]: Disconnected from invalid user devops 118.194.231.208 port 33954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 21 04:28:37 host2 sshd[1768459]: Disconnected from invalid user www 118.194.231.208 port 34014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-21 04:30:12 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:40850: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-21 04:30:32 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:41702: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 04:30:38 host2 sshd[1770556]: Disconnected from invalid user  2.57.121.25 port 10358 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2025-12-21 04:30:57 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:48224: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2025-12-21 04:32:03 dovecot_login authenticator failed for H=([188.126.240.80]) [188.126.240.80]:35574: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-12-21 04:32:15 dovecot_login authenticator failed for H=(126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:46262: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 04:34:38 host2 sshd[1773058]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.213
country_id: 6252001
description:
Dec 21 04:34:27 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.213, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1GdAN2pGn8yTuYTV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 04:37:09 host2 sshd[1774831]: Disconnected from invalid user admin 2.57.121.25 port 21924 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.114.64
country_id: 2921044
description:
Dec 21 04:39:04 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.65.114.64, lip=66.85.158.91, session=<cdnCR2pGkyGfQXJA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.252.2
country_id: 2921044
description:
Dec 21 04:39:05 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.252.2, lip=66.85.158.91, session=<JgrNR2pG6BWkXPwC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.143.93
country_id: 6252001
description:
[2025-12-21 04:40:55 +0530] info [webmaild] 192.111.143.93 - info@neotechlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-12-21 04:42:22 dovecot_login authenticator failed for H=202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:53217: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-12-21 04:43:16 dovecot_login authenticator failed for H=([128.185.223.219]) [27.123.111.114]:35946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.27.184
country_id: 6252001
description:
Dec 21 04:43:33 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.83.27.184, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7f3EV2pGHKYUUxu4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.148.87
country_id: 1605651
description:
2025-12-21 04:46:10 dovecot_login authenticator failed for H=([110.77.148.87]) [110.77.148.87]:60996: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-21 04:46:26 dovecot_login authenticator failed for H=(cm-178.232.185.189.get.no) [178.232.185.189]:50314: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.6.111
country_id: 690791
description:
Dec 21 04:48:06 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=176.103.6.111, lip=66.85.158.91, TLS, session=<OEDuZmpGrO2wZwZv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.163
country_id: 3175395
description:
Dec 21 04:48:26 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=185.15.171.163, lip=66.85.158.91, TLS, session=<P2VGaGpGvZi5D6uj>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.245
country_id: 2635167
description:
Dec 21 04:48:49 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 9 secs): user=<>, rip=185.247.137.245, lip=66.85.158.91, TLS, session=<S5OkampGS9e594n1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-21 04:53:15 dovecot_login authenticator failed for H=(cm-178.232.30.170.get.no) [178.232.30.170]:59820: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2025-12-21 04:54:02 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:37593: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.185.81
country_id: 6252001
description:
Dec 21 05:01:39 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.83.185.81, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<hsuAmGpGdMIUU7lR>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.138.132
country_id: 3608932
description:
[2025-12-21 05:02:22 +0530] info [cpaneld] 45.4.138.132 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.253.19.17
country_id: 3686110
description:
[2025-12-21 05:02:24 +0530] info [cpaneld] 190.253.19.17 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.66.122.221
country_id: 6252001
description:
[2025-12-21 05:02:25 +0530] info [cpaneld] 75.66.122.221 - host2 "GET /login/?login_only=1&user=host2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.8.209.239
country_id: 6252001
description:
[2025-12-21 05:02:32 +0530] info [cpaneld] 172.8.209.239 - host "GET /login/?login_only=1&user=host&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.69.163.191
country_id: 290291
description:
[2025-12-21 05:02:30 +0530] info [cpaneld] 77.69.163.191 - host2phenomhostcom "GET /login/?login_only=1&user=host2phenomhostcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host2phenomhostcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.77.198.212
country_id: 3617476
description:
[2025-12-21 05:02:36 +0530] info [cpaneld] 186.77.198.212 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.8.224.226
country_id: 3895114
description:
[2025-12-21 05:02:35 +0530] info [cpaneld] 179.8.224.226 - hos "GET /login/?login_only=1&user=hos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.2.213
country_id: 1168579
description:
[2025-12-21 05:02:28 +0530] info [whostmgrd] 103.134.2.213 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.19.183.202
country_id: 1269750
description:
[2025-12-21 05:05:03 +0530] info [webmaild] 125.19.183.202 - info@ayuzonelanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-21 05:07:10 dovecot_plain authenticator failed for H=(hyshic) [96.85.104.2]:56652: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 21 05:06:55 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: Connection closed, session=<bBBZq2pG1ilChJly>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 05:08:27 host2 sshd[1794668]: Disconnected from invalid user  2.57.121.25 port 43929 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-21 05:12:23 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:53306: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 21 05:11:46 host2 sshd[1797254]: Disconnected from invalid user nami 187.210.77.100 port 56310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.207.18.113
country_id: 1861060
description:
Dec 21 05:12:14 host2 sshd[1797521]: Disconnected from invalid user alex 172.207.18.113 port 59454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.2
country_id: 1149361
description:
2025-12-21 05:12:45 dovecot_login authenticator failed for H=([149.54.62.2]) [149.54.62.2]:50355: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.207.18.113
country_id: 1861060
description:
Dec 21 05:12:52 host2 sshd[1797925]: Disconnected from invalid user nami 172.207.18.113 port 32920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Dec 21 05:12:54 host2 sshd[1797947]: Disconnected from invalid user user 185.158.22.150 port 11568 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-12-21 05:12:56 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:46843: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.79.92
country_id: 2921044
description:
Dec 21 05:13:14 host2 sshd[1798237]: Disconnected from invalid user alicia 68.183.79.92 port 49192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.154.90.114
country_id: 3686110
description:
Dec 21 05:13:15 host2 sshd[1798242]: Disconnected from invalid user rahul 186.154.90.114 port 58094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Dec 21 05:14:17 host2 sshd[1798881]: Disconnected from invalid user s 35.199.95.142 port 56160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 1819730
description:
Dec 21 05:14:25 host2 sshd[1798974]: Disconnected from invalid user no-reply 156.245.239.180 port 52466 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-21 05:13:40 dovecot_login authenticator failed for H=([189.57.81.137]) [186.201.54.90]:35092: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-21 05:13:59 dovecot_login authenticator failed for H=32.104.29.34.bc.googleusercontent.com [34.29.104.32]:48970: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-21 05:14:41 dovecot_login authenticator failed for H=(cm-84.211.12.159.get.no) [84.211.12.159]:36949: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.154.90.114
country_id: 3686110
description:
Dec 21 05:14:52 host2 sshd[1799485]: Disconnected from invalid user user 186.154.90.114 port 51320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Dec 21 05:14:38 host2 sshd[1799126]: Disconnected from invalid user admin 117.216.143.31 port 37550 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.10.185.103
country_id: 6252001
description:
Dec 21 05:14:45 host2 sshd[1799337]: Disconnected from invalid user myappuser 67.10.185.103 port 52930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.255.75.252
country_id: 1269750
description:
Dec 21 05:15:21 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.255.75.252, lip=66.85.158.91, TLS, session=<AsRpyGpGcI1n/0v8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.245
country_id: 3469034
description:
Dec 21 05:15:42 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.53.128.245, lip=66.85.158.91, TLS, session=<j2CjyWpGQN+/NYD1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.79.92
country_id: 2921044
description:
Dec 21 05:15:52 host2 sshd[1800496]: Disconnected from invalid user tester 68.183.79.92 port 48306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 21 05:16:00 host2 sshd[1800579]: Disconnected from invalid user informix 36.37.122.175 port 53230 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-21 05:16:25 dovecot_login authenticator failed for H=([152.52.92.105]) [152.52.192.74]:44618: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Dec 21 05:15:33 host2 sshd[1800342]: Disconnected from invalid user peter 35.199.95.142 port 51782 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.118
country_id: 1733045
description:
2025-12-21 05:16:51 dovecot_login authenticator failed for H=([49.124.147.118]) [49.124.147.118]:40106: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 21 05:17:23 host2 sshd[1801399]: Disconnected from invalid user alex 36.37.122.175 port 58208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 21 05:16:43 host2 sshd[1801013]: Disconnected from invalid user kube 36.37.122.175 port 60056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.154.90.114
country_id: 3686110
description:
Dec 21 05:16:49 host2 sshd[1801088]: Disconnected from invalid user admin 186.154.90.114 port 47546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-21 05:17:09 dovecot_login authenticator failed for H=(cm-178.232.199.223.get.no) [178.232.199.223]:51439: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 21 05:17:23 host2 pure-ftpd[1801408]: (?@176.32.195.85) [INFO] New connection from 176.32.195.85


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 1819730
description:
Dec 21 05:17:52 host2 sshd[1801684]: Disconnected from invalid user mamad 156.245.239.180 port 56498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 21 05:18:04 host2 sshd[1801819]: Disconnected from invalid user rocky 36.37.122.175 port 45230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Dec 21 05:18:11 host2 sshd[1801874]: Disconnected from invalid user kube 117.216.143.31 port 48184 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.127
country_id: 6252001
description:
Dec 21 05:17:49 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.127, lip=66.85.158.91, TLS: Connection closed, session=<pGFO0mpGtL3HLZp/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 21 05:18:14 host2 pure-ftpd[1801922]: (?@176.32.195.85) [INFO] New connection from 176.32.195.85


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.154.90.114
country_id: 3686110
description:
Dec 21 05:18:46 host2 sshd[1802194]: Disconnected from invalid user resource 186.154.90.114 port 43768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.62.124
country_id: 6252001
description:
Dec 21 05:19:16 host2 sshd[1802468]: Disconnected from invalid user administrator 209.141.62.124 port 49264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 21 05:18:27 host2 sshd[1802011]: Disconnected from invalid user kube 103.186.1.120 port 60512 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.22.150
country_id: 99237
description:
Dec 21 05:18:41 host2 sshd[1802154]: Disconnected from invalid user alexa 185.158.22.150 port 2086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 21 05:19:08 host2 sshd[1802403]: Disconnected from invalid user ftp_user 187.210.77.100 port 58796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Dec 21 05:19:47 host2 sshd[1802743]: Disconnected from invalid user immc 185.158.22.150 port 24988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.62.124
country_id: 6252001
description:
Dec 21 05:20:11 host2 sshd[1803228]: Disconnected from invalid user deployment 209.141.62.124 port 33092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.154.90.114
country_id: 3686110
description:
Dec 21 05:20:38 host2 sshd[1803712]: Disconnected from invalid user admin1 186.154.90.114 port 39980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 1819730
description:
Dec 21 05:20:40 host2 sshd[1803735]: Disconnected from invalid user william 156.245.239.180 port 54782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 21 05:20:27 host2 sshd[1803464]: Disconnected from invalid user prince 103.186.1.120 port 54728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-21 05:21:38 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:49408: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-21 05:21:52 dovecot_login authenticator failed for H=([182.95.178.158]) [182.95.178.158]:57756: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 21 05:23:07 host2 sshd[1805828]: Disconnected from invalid user rocky 187.210.77.100 port 50726 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 21 05:23:29 host2 sshd[1806002]: Disconnected from invalid user odoo 45.78.223.75 port 45724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 21 05:24:39 host2 sshd[1806852]: Disconnected from invalid user pentest 45.78.223.75 port 42374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 21 05:25:12 host2 sshd[1807359]: Disconnected from invalid user nami 103.186.1.120 port 38122 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.134
country_id: 3469034
description:
Dec 21 05:25:37 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=177.44.71.134, lip=66.85.158.91, TLS, session=<lTEL7WpGSKixLEeG>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 05:25:42 host2 pure-ftpd[1807945]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 21 05:25:52 host2 sshd[1808028]: Disconnected from invalid user rocky 103.186.1.120 port 44516 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.123.186
country_id: 690791
description:
Dec 21 05:25:58 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=91.228.123.186, lip=66.85.158.91, TLS, session=<e8Rc7mpGLYJb5Hu6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Dec 21 05:26:54 host2 sshd[1808607]: Disconnected from invalid user ionguest 117.216.143.31 port 60976 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 05:32:02 host2 sshd[1812242]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Dec 21 05:35:38 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=167.94.146.63, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<o+UFEmtGtFenXpI/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 05:36:27 host2 sshd[1816272]: Disconnected from invalid user admin 2.57.121.112 port 58912 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.112.128.12
country_id: 2017370
description:
[2025-12-21 05:37:53 +0530] info [webmaild] 37.112.128.12 - info@tradeceylon.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.183
country_id: 6252001
description:
Dec 21 05:40:22 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.183, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<nur+ImtGTszG6xi3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-21 05:43:35 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:59997: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-21 05:43:53 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:45434: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 05:45:56 host2 sshd[1824853]: Disconnected from invalid user  2.57.121.25 port 14568 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-21 05:46:33 dovecot_login authenticator failed for H=115.150.48.116.static.netvigator.com [116.48.150.115]:59189: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.47
country_id: 2186224
description:
2025-12-21 05:48:59 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.163.47]:34424: 535 Incorrect authentication data (set_id=inf@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.102.42.179
country_id: 390903
description:
2025-12-21 05:49:06 dovecot_login authenticator failed for H=([127.0.0.1]) [147.102.42.179]:40510: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-21 05:52:15 dovecot_login authenticator failed for H=217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:52139: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-21 05:52:28 dovecot_login authenticator failed for H=(29.92.zcomnetworks.com.pk) [103.148.92.29]:39718: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.252.18
country_id: 1269750
description:
2025-12-21 05:56:05 dovecot_login authenticator failed for H=([61.95.203.89]) [125.20.252.18]:51292: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-21 05:56:26 dovecot_login authenticator failed for H=([178.232.80.9]) [178.232.80.9]:56526: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-21 06:00:50 dovecot_login authenticator failed for H=([182.78.240.94]) [182.78.240.94]:39282: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.103.80.92
country_id: 1210997
description:
[2025-12-21 06:06:14 +0530] info [cpaneld] 117.103.80.92 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 06:16:53 host2 sshd[1849127]: Disconnected from invalid user admin 2.57.121.112 port 41044 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.36.34.200
country_id: 6252001
description:
[2025-12-21 06:20:47 +0530] info [whostmgrd] 73.36.34.200 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 06:22:38 host2 sshd[1853562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 06:23:19 host2 sshd[1854019]: Disconnected from invalid user admin 2.57.121.25 port 33659 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2025-12-21 06:23:52 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.23.68]:44181: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.51.185
country_id: 3144096
description:
2025-12-21 06:23:35 dovecot_login authenticator failed for H=([127.0.0.1]) [84.215.51.185]:47763: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 06:27:52 host2 pure-ftpd[1857461]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-12-21 06:28:36 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:7319: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.98.103.162
country_id: 6290252
description:
[2025-12-21 06:29:10 +0530] info [webmaild] 141.98.103.162 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.61.4.185
country_id: 1269750
description:
2025-12-21 06:30:19 dovecot_login authenticator failed for H=([127.0.0.1]) [171.61.4.185]:46794: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-12-21 06:29:27 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:38058: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 21 06:29:25 host2 sshd[1858864]: Disconnected from invalid user maxim 103.139.59.214 port 35378 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 21 06:32:26 host2 sshd[1861158]: Disconnected from invalid user chris 103.139.59.214 port 47214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.132.245.209
country_id: 953987
description:
Dec 21 06:31:30 host2 sshd[1860439]: Disconnected from invalid user fan 102.132.245.209 port 43608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 21 06:31:50 host2 sshd[1860679]: Disconnected from invalid user appadmin 103.139.59.214 port 36312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.98
country_id: 1643084
description:
Dec 21 06:33:51 host2 sshd[1862374]: Disconnected from invalid user chris 202.51.214.98 port 34212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.132.245.209
country_id: 953987
description:
Dec 21 06:33:30 host2 sshd[1862036]: Disconnected from invalid user install 102.132.245.209 port 53366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 21 06:33:37 host2 sshd[1862135]: Disconnected from invalid user kim 103.139.59.214 port 40856 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.98
country_id: 1643084
description:
Dec 21 06:34:33 host2 sshd[1863191]: Disconnected from invalid user flora 202.51.214.98 port 47972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 21 06:35:33 host2 sshd[1864368]: Disconnected from invalid user appadmin 34.66.72.251 port 33608 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 21 06:36:10 host2 sshd[1864952]: Disconnected from invalid user marcus 34.66.72.251 port 47384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 21 06:36:35 host2 sshd[1865305]: Disconnected from invalid user jean 34.66.72.251 port 53450 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.69.9.148
country_id: 1269750
description:
Dec 21 06:38:27 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.69.9.148, lip=66.85.158.91, TLS, session=<iTyU8WtGDMdnRQmU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.126
country_id: 3865483
description:
Dec 21 06:38:53 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=179.0.250.126, lip=66.85.158.91, TLS, session=<8Fvf8mtG4rKzAPp+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-21 06:39:07 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (fideminke) [73.129.57.71]:56608: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.212
country_id: 3144096
description:
2025-12-21 06:41:04 dovecot_login authenticator failed for H=([127.0.0.1]) [84.210.214.212]:57390: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.218.47
country_id: 3144096
description:
2025-12-21 06:40:58 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.218.47]:51270: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-21 06:54:25 dovecot_plain authenticator failed for H=(magmeisted) [75.97.190.237]:52075: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.63.103
country_id: 3144096
description:
2025-12-21 06:59:52 dovecot_login authenticator failed for H=([127.0.0.1]) [84.215.63.103]:42416: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.127.153
country_id: 3144096
description:
2025-12-21 07:00:12 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.127.153]:38256: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-12-21 07:01:51 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (sentrily) [73.0.191.33]:51364: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.57
country_id: 6252001
description:
Dec 21 07:07:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.57, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wiHoW2xGFNvN0h85>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-21 07:14:26 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:60161: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-12-21 07:15:21 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:45106: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-21 07:17:48 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:39500: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 2.136.115.209
country_id: 2510769
description:
Dec 21 07:21:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=2.136.115.209, lip=66.85.158.91, TLS, session=<5BDliWxGCL4CiHPR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.244.175.50
country_id: 6252001
description:
Dec 21 07:20:42 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=143.244.175.50, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<8sLFiWxG2t6P9K8y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.192.205.23
country_id: 798544
description:
Dec 21 07:20:42 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.192.205.23, lip=66.85.158.91, TLS, session=</GHPiGxGBahbwM0X>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.109.235.18
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.109.235.18: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Dec 21 07:22:10 host2 sshd[1904560]: Disconnected from invalid user gustavo 89.116.31.97 port 60584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Dec 21 07:26:25 host2 sshd[1907690]: Disconnected from invalid user server 89.116.31.97 port 46726 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-12-21 07:28:58 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.86]:41158: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.116.31.97
country_id: 3017382
description:
Dec 21 07:28:20 host2 sshd[1909057]: Disconnected from invalid user comercial 89.116.31.97 port 40628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-21 07:28:28 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:37160: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.28
country_id: 3996063
description:
2025-12-21 07:30:02 dovecot_login authenticator failed for H=(189.219.138.28-clientes-izzi.mx) [189.219.138.28]:41662: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-21 07:29:43 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:40867: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 07:30:15 host2 pure-ftpd[1910636]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Dec 21 07:32:15 host2 sshd[1912031]: Disconnected from invalid user novinhost 89.116.31.97 port 44962 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.67
country_id: 6252001
description:
Dec 21 07:38:50 host2 pure-ftpd[1916855]: (?@205.210.31.67) [INFO] New connection from 205.210.31.67


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Dec 21 07:39:07 host2 sshd[1917163]: Disconnected from invalid user ts3server 212.154.234.9 port 63141 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.154.234.9
country_id: 1522867
description:
Dec 21 07:39:45 host2 sshd[1917730]: Disconnected from invalid user yann 212.154.234.9 port 38737 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Dec 21 07:40:21 host2 sshd[1918434]: Disconnected from invalid user sentry 212.154.234.9 port 20419 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2025-12-21 07:41:36 dovecot_login authenticator failed for H=([184.151.88.27]) [184.151.88.27]:42621: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-12-21 07:41:15 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:46701: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-21 07:42:14 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:37904: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.31
country_id: 1522867
description:
2025-12-21 07:42:58 dovecot_login authenticator failed for H=([212.116.247.31]) [212.116.247.31]:39756: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-21 07:44:54 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (rebenouned) [68.46.148.180]:43298: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-12-21 07:50:42 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:36902: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-21 07:51:03 dovecot_login authenticator failed for H=(57.92.zcomnetworks.com.pk) [103.148.92.57]:41834: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-21 07:58:29 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:39994: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.177
country_id: 1733045
description:
2025-12-21 07:59:01 dovecot_login authenticator failed for H=([49.124.155.177]) [49.124.155.177]:36052: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 21 07:59:22 host2 sshd[1932205]: Disconnected from invalid user ftpuser 103.117.57.134 port 53012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.221.74.234
country_id: 226074
description:
Dec 21 08:02:23 host2 sshd[1934416]: Disconnected from invalid user ubnt 45.221.74.234 port 56260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 21 08:04:17 host2 sshd[1935821]: Disconnected from invalid user hadoop 103.117.57.134 port 51618 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 21 08:04:57 host2 sshd[1936150]: Disconnected from invalid user linuxtest 103.117.57.134 port 33122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.221.74.234
country_id: 226074
description:
Dec 21 08:05:20 host2 sshd[1936661]: Disconnected from invalid user ubuntu 45.221.74.234 port 36988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 21 08:05:36 host2 sshd[1936821]: Disconnected from invalid user esearch 103.117.57.134 port 46134 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.221.74.234
country_id: 226074
description:
Dec 21 08:06:47 host2 sshd[1937439]: Disconnected from invalid user brijesh 45.221.74.234 port 33880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 21 08:06:15 host2 sshd[1937163]: Disconnected from invalid user dev 103.117.57.134 port 57438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-21 08:06:34 dovecot_login authenticator failed for H=(syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:52704: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.153.135.104
country_id: 6252001
description:
[2025-12-21 08:09:01 +0530] info [whostmgrd] 76.153.135.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-21 08:12:37 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:50584: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.211.157
country_id: 357994
description:
2025-12-21 08:12:52 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.211.157]:34910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.102.232.115
country_id: 3057568
description:
Dec 21 08:26:23 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=149.102.232.115, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mnK4dG1G6q+VZuhz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.171
country_id: 2510769
description:
Dec 21 08:26:23 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.134.213.171, lip=66.85.158.91, TLS, session=<hEi4dG1G9q8thtWr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.112.19.69
country_id: 660013
description:
Dec 21 08:26:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=212.112.19.69, lip=66.85.158.91, TLS handshaking: Connection closed, session=<fxm5dG1GQsHUcBNF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.11
country_id: 1605651
description:
Dec 21 08:26:23 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.239.201.11, lip=66.85.158.91, session=<fHC5dG1Ggr6t78kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.238.173
country_id: 6252001
description:
Dec 21 08:26:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.238.173, lip=66.85.158.91, session=<Gly3dG1GGuZfte6t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.16
country_id: 2542007
description:
Dec 21 08:26:23 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=95.181.232.16, lip=66.85.158.91, session=<6Cm1dG1GJOZftegQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.98
country_id: 2782113
description:
Dec 21 08:26:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=37.19.223.98, lip=66.85.158.91, TLS, session=<Mf24dG1GSsElE99i>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.84.102.23
country_id: 3439705
description:
Dec 21 08:26:24 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.84.102.23, lip=66.85.158.91, session=<5C+9dG1GfL4tVGYX>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 77.81.142.147
country_id: 3996063
description:
Dec 21 08:26:20 host2 pure-ftpd[1955817]: (?@77.81.142.147) [INFO] New connection from 77.81.142.147


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.102
country_id: 6252001
description:
Dec 21 08:28:33 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.102, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JtJxfG1GltbN0h9m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 21 08:28:43 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS: Connection closed, session=<qDEGfW1G2qBChJmL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.39.11.5
country_id: 690791
description:
Dec 21 08:30:05 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=176.39.11.5, lip=66.85.158.91, TLS, session=<7Y7rgG1Gk7mwJwsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.87.105.191
country_id: 1269750
description:
Dec 21 08:30:26 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.87.105.191, lip=66.85.158.91, TLS, session=<jR8Ygm1GjMZnV2m/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2025-12-21 08:31:57 dovecot_login authenticator failed for H=(bb151-192-57-118.singnet.com.sg) [151.192.57.118]:52779: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-21 08:32:18 dovecot_login authenticator failed for H=([65.20.153.146]) [65.20.153.146]:33955: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 08:32:34 host2 pure-ftpd[1960428]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.97
country_id: 3175395
description:
Dec 21 08:34:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.171.97, lip=66.85.158.91, TLS, session=<6tnskW1G+d25D6th>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-21 08:34:53 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (yarborcts) [174.169.224.27]:38382: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.122
country_id: 2963597
description:
Dec 21 08:35:09 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=37.203.49.122, lip=66.85.158.91, TLS, session=<6h8Uk21GSK4lyzF6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.223.240.239
country_id: 49518
description:
2025-12-21 08:36:55 dovecot_login authenticator failed for H=([196.223.240.239]) [196.223.240.239]:60964: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.51
country_id: 6252001
description:
Dec 21 08:47:37 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.149.51, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RR+pwG1Gksyi2JUz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.51
country_id: 6252001
description:
Dec 21 08:48:38 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.51, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<z2ZBxG1GROii2JUz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 21 08:50:06 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<1sWHyW1Ghs6LonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.51
country_id: 6252001
description:
Dec 21 08:55:18 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.51, lip=66.85.158.92, TLS, session=<Hegd3G1GcvKi2JUz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-21 08:56:35 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:46946: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.116
country_id: 294640
description:
2025-12-21 08:56:42 dovecot_login authenticator failed for H=([195.133.156.116]) [195.133.156.116]:39400: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.85
country_id: 2635167
description:
Dec 21 09:01:11 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.85, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<mVsg8W1Gl6BX7LBV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.84
country_id: 6252001
description:
Dec 21 09:00:59 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.84, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Z7Zq8G1GycnN0h9U>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.44
country_id: 2635167
description:
Dec 21 09:01:05 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.44, lip=66.85.158.91, TLS, session=<hdLI8G1GebdX7LAs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.93
country_id: 2635167
description:
Dec 21 09:01:44 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.93, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pXAf821G4e2594ld>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 21 09:01:50 host2 pure-ftpd[1981624]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 21 09:02:16 host2 pure-ftpd[1982023]: (?@176.32.195.85) [INFO] New connection from 176.32.195.85


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.106
country_id: 2635167
description:
Dec 21 09:02:18 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.106, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<Wasf9W1GQ8BX7LBq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.94
country_id: 2635167
description:
Dec 21 09:02:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.94, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Zd8w921GYaa594le>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.94.56
country_id: 3865483
description:
Dec 21 09:04:06 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=190.181.94.56, lip=66.85.158.91, TLS, session=<QVZ8+m1GhLG+tV44>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.80
country_id: 2635167
description:
Dec 21 09:03:27 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sHM8+W1GIetX7LBQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2025-12-21 09:03:59 dovecot_login authenticator failed for H=(18980204017.user.veloxzone.com.br) [189.80.146.46]:50589: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.99
country_id: 2635167
description:
Dec 21 09:04:00 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.99, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8x84+21Gz49X7LBj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-21 09:04:12 dovecot_login authenticator failed for H=(cm-178.232.185.189.get.no) [178.232.185.189]:60164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.111
country_id: 3469034
description:
Dec 21 09:04:28 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=187.120.72.111, lip=66.85.158.91, TLS, session=<19K1+21GJpG7eEhv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.85
country_id: 2635167
description:
Dec 21 09:04:34 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.85, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<x8Y7/W1GzbpX7LBV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Dec 21 09:05:10 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<U31q/21Gq7lX7LBO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.98
country_id: 2635167
description:
Dec 21 09:05:44 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.98, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<prllAW5GHaG594li>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.103
country_id: 2635167
description:
Dec 21 09:06:17 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.103, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<v5JlA25GBdFX7LBn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 09:11:29 host2 sshd[1988542]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-21 09:15:09 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:26866: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.109.194
country_id: 1269750
description:
2025-12-21 09:15:32 dovecot_login authenticator failed for H=([103.111.109.194]) [103.111.109.194]:55770: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:17:58 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wzwyLW5GZL8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:18:18 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<AU9dLm5GzOoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-21 09:20:50 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:33552: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:21:05 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6NpKOG5G5pwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:21:25 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<aNWGOW5GJtMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:22:57 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<qE75Pm5GsO0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:23:58 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sqGcQm5GiIIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:25:33 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<c19LSG5GzrcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:26:17 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<05foSm5G6uQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:27:28 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<YpQnT25GTpMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:29:03 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<vs/TVG5GoLUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:29:46 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<z01eV25GzpcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:30:38 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<sAp2Wm5GHKkDhBfJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 09:34:52 host2 pure-ftpd[2007112]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.78
country_id: 6252001
description:
Dec 21 09:36:31 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.78, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5yCFb25G2tzG6xhO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 21 09:37:08 host2 sshd[2008752]: Disconnected from invalid user den 51.38.224.114 port 48910 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 21 09:38:14 host2 sshd[2009638]: Received disconnect from 51.38.224.114 port 36538:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.40
country_id: 2186224
description:
2025-12-21 09:41:29 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.163.40]:49704: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.74.112.161
country_id: 2963597
description:
2025-12-21 09:41:36 dovecot_login authenticator failed for H=([127.0.0.1]) [13.74.112.161]:53000: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 21 09:43:33 host2 sshd[2014027]: Received disconnect from 51.38.224.114 port 34640:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 21 09:43:33 host2 sshd[2014027]: Disconnected from invalid user khan 51.38.224.114 port 34640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 21 09:44:40 host2 sshd[2015098]: Disconnected from invalid user user 51.38.224.114 port 40818 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.126
country_id: 690791
description:
Dec 21 09:45:19 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.17.124.126, lip=66.85.158.91, TLS, session=<iwyIjW5GeL+5EXx+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.25.120
country_id: 933860
description:
Dec 21 09:45:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan>, method=PLAIN, rip=83.143.25.120, lip=66.85.158.91, TLS, session=<BwbEj25G6NlTjxl4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 21 09:47:30 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<nZWulm5GENbBHmEh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.94
country_id: 2635167
description:
Dec 21 09:49:42 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.94, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<etCwnm5GH4VX7LBe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.160.35.76
country_id: 2300660
description:
2025-12-21 09:49:44 dovecot_login authenticator failed for H=([154.160.35.76]) [154.160.35.76]:33826: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.230
country_id: 2635167
description:
Dec 21 09:49:40 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.230, lip=66.85.158.92, TLS, session=<gvmQnm5GP5JX7LDm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 09:50:46 host2 sshd[2020795]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.109
country_id: 2635167
description:
Dec 21 09:50:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.109, lip=66.85.158.92, TLS handshaking: Connection closed, session=<JHDSom5G2YNX7LBt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Dec 21 09:50:17 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.76, lip=66.85.158.92, TLS handshaking: Connection closed, session=<M8vBoG5GX4a594lM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.82
country_id: 2635167
description:
Dec 21 09:51:25 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.82, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<UQvRpG5Gh4O594lS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.93
country_id: 2635167
description:
Dec 21 09:51:59 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.93, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<ebLQpm5G15K594ld>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.76
country_id: 2635167
description:
Dec 21 09:52:32 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.76, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<20rMqG5GN8xX7LBM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.104
country_id: 2635167
description:
Dec 21 09:53:06 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.104, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<GvrPqm5Gq+VX7LBo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.99
country_id: 2635167
description:
Dec 21 09:53:41 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.99, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HK3urG5GXdhX7LBj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.81
country_id: 2635167
description:
Dec 21 09:54:16 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.81, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<Jdr5rm5GX9W594lR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.92
country_id: 2635167
description:
Dec 21 09:54:49 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.92, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<+Fb5sG5Gu46594lc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2025-12-21 09:56:54 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:46647: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-21 09:57:14 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:53873: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2025-12-21 09:59:02 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:54510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-21 10:01:31 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (repsital) [98.193.112.85]:39180: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 10:01:51 host2 sshd[2029294]: Disconnected from invalid user admin 2.57.121.112 port 12599 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.124
country_id: 6252001
description:
Dec 21 10:09:58 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.149.124, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<PLAc525Ga8Si2JV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.124
country_id: 6252001
description:
Dec 21 10:11:09 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=162.216.149.124, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<ACZa625G+OSi2JV8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Dec 21 10:10:52 host2 sshd[2036395]: Disconnected from invalid user admin 152.32.250.188 port 58850 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.124
country_id: 6252001
description:
Dec 21 10:11:13 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.149.124, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<ss6Y625Gqu2i2JV8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.250.188
country_id: 1562822
description:
Dec 21 10:12:13 host2 sshd[2037533]: Disconnected from invalid user user 152.32.250.188 port 41908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 21 10:12:47 host2 sshd[2038011]: Disconnected from invalid user ftpUser 152.32.215.203 port 52966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 21 10:13:22 host2 sshd[2038484]: Disconnected from invalid user user 152.32.215.203 port 52342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Dec 21 10:13:34 host2 sshd[2038595]: Disconnected from invalid user admin 152.32.250.188 port 53226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 21 10:14:01 host2 sshd[2038914]: Disconnected from invalid user user 152.32.215.203 port 33274 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.20
country_id: 2635167
description:
Dec 21 10:14:02 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.20, lip=66.85.158.92, TLS, session=<ndC19W5G64y594kU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.70
country_id: 2635167
description:
Dec 21 10:14:04 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.70, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<olfQ9W5Gp4+594lG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.58
country_id: 2635167
description:
Dec 21 10:14:38 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.58, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<0gnV925GnZlX7LA6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.39
country_id: 6252001
description:
Dec 21 10:14:31 host2 pure-ftpd[2039461]: (?@147.185.132.39) [INFO] New connection from 147.185.132.39


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-21 10:15:23 dovecot_login authenticator failed for H=(nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:37742: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-21 10:15:42 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:55056: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.58
country_id: 2635167
description:
Dec 21 10:15:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.58, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<e6fu+25GRcNX7LA6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.64
country_id: 2635167
description:
Dec 21 10:15:13 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.64, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<l+Tj+W5G5edX7LBA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 10:16:25 host2 sshd[2041136]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.72
country_id: 2635167
description:
Dec 21 10:16:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.72, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0zfu/W5GD52594lI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.46
country_id: 2635167
description:
Dec 21 10:16:54 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.46, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<otDp/25GS+BX7LAu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.69
country_id: 2635167
description:
Dec 21 10:17:28 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5gf9AW9GOaJX7LBF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-21 10:17:48 dovecot_login authenticator failed for H=(cm-84.214.63.110.get.no) [84.214.63.110]:56180: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.124
country_id: 6252001
description:
Dec 21 10:17:59 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.124, lip=66.85.158.91, TLS, session=<oxTRA29GoOKi2JV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.60
country_id: 2635167
description:
Dec 21 10:18:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.60, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<lrb8A29G3Yy594k8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.96
country_id: 2542007
description:
2025-12-21 10:18:22 dovecot_login authenticator failed for H=([105.73.203.96]) [105.73.203.96]:60504: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.73
country_id: 2635167
description:
Dec 21 10:18:36 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 1 secs): user=<>, rip=87.236.176.73, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<kAgDBm9GEclX7LBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.44
country_id: 2635167
description:
Dec 21 10:19:09 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.44, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<9IICCG9GK7+594ks>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 21 10:26:01 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<UIuQIG9GRrWLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.250
country_id: 3865483
description:
Dec 21 10:25:21 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.249.250, lip=66.85.158.91, TLS, session=<YiDrHG9Gs+CzAPn6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.159.85.31
country_id: 3469034
description:
Dec 21 10:25:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=201.159.85.31, lip=66.85.158.91, TLS, session=<jGw/Hm9GVpnJn1Uf>


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - admin@venee.lk [12/21/2025:04:57:49 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: admin@venee.lk


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-21 10:28:25 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:32267: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-21 10:28:51 dovecot_login authenticator failed for H=([177.27.76.210]) [177.27.76.210]:41027: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-21 10:30:06 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (curan) [69.142.126.37]:32860: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-21 10:34:32 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:57928: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.28
country_id: 3996063
description:
2025-12-21 10:35:06 dovecot_login authenticator failed for H=(201.173.56.28-clientes-izzi.mx) [201.173.56.28]:38607: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 10:35:56 host2 sshd[2057622]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.95.46.186
country_id: 1269750
description:
[2025-12-21 10:35:45 +0530] info [webmaild] 182.95.46.186 - info@stanthonys.biz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.173.35
country_id: 6252001
description:
Dec 21 10:37:58 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.173.35, lip=66.85.158.91, session=<AtNBS29G7MSlmq0j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.173.35
country_id: 6252001
description:
Dec 21 10:37:58 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=165.154.173.35, lip=66.85.158.91, TLS, session=<vM9DS29GCMalmq0j>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 10:37:10 host2 pure-ftpd[2058623]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec 21 10:40:35 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.80, lip=66.85.158.91, session=<sGqnVG9GXKZAPpxQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.124
country_id: 3017382
description:
Dec 21 10:45:43 host2 pure-ftpd[2067397]: (?@91.196.152.124) [INFO] New connection from 91.196.152.124


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.133.68.171
country_id: 1733045
description:
Dec 21 10:45:52 host2 sshd[2067480]: Disconnected from invalid user vnc 115.133.68.171 port 37013 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.126
country_id: 3017382
description:
Dec 21 10:45:43 host2 pure-ftpd[2067400]: (?@91.196.152.126) [INFO] New connection from 91.196.152.126


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.133.68.171
country_id: 1733045
description:
Dec 21 10:46:32 host2 sshd[2067928]: Disconnected from invalid user user 115.133.68.171 port 43227 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-12-21 10:47:09 dovecot_login authenticator failed for H=ool-45701cb5.dyn.optonline.net [69.112.28.181]:49739: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.133.68.171
country_id: 1733045
description:
Dec 21 10:47:10 host2 sshd[2068374]: Disconnected from invalid user ubuntu 115.133.68.171 port 49439 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-12-21 10:50:49 dovecot_login authenticator failed for H=([128.185.208.42]) [128.185.208.42]:48506: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2025-12-21 10:51:05 dovecot_login authenticator failed for H=([89.218.247.234]) [89.218.247.234]:43552: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2025-12-21 10:50:33 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:57840: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec 21 10:52:53 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.112, lip=66.85.158.91, TLS: Connection closed, session=<EqGggG9GQDhChJlw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.234.202.64
country_id: 953987
description:
Dec 21 10:55:01 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=197.234.202.64, lip=66.85.158.91, TLS, session=<2zQJh29GJNnF6spA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.221.254.177
country_id: 798544
description:
Dec 21 10:55:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=85.221.254.177, lip=66.85.158.91, TLS, session=<Dso5h29GxLBV3f6x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.165.176
country_id: 3469034
description:
Dec 21 10:55:21 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact>, method=PLAIN, rip=177.93.165.176, lip=66.85.158.91, TLS, session=<MLliiG9G8ruxXaWw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.115
country_id: 3469034
description:
Dec 21 10:55:39 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 30 secs): user=<contact>, method=PLAIN, rip=187.120.72.115, lip=66.85.158.91, TLS, session=<WPbAiG9GBaa7eEhz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 21 10:59:43 host2 sshd[2078228]: Disconnected from invalid user belen 62.60.131.157 port 56351 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 11:00:14 host2 sshd[2078806]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.198
country_id: 3175395
description:
Dec 21 11:02:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.15.171.198, lip=66.85.158.91, TLS, session=<ytIioG9G1I25D6vG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.90.20
country_id: 3865483
description:
Dec 21 11:02:22 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.181.90.20, lip=66.85.158.91, TLS, session=<P1tuoW9GnIK+tVoU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Dec 21 11:03:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS: Connection closed, session=<dXGypm9GHrVChJmG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-12-21 11:14:41 dovecot_login authenticator failed for H=(187.161.136.18-clientes-izzi.mx) [187.161.136.18]:40344: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-12-21 11:15:13 dovecot_login authenticator failed for H=([101.127.101.225]) [101.127.101.225]:51754: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.81
country_id: 6252001
description:
Dec 21 11:15:25 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.81, lip=66.85.158.91, session=<p5000W9Gbclb5qhR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.86
country_id: 6252001
description:
Dec 21 11:15:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.86, lip=66.85.158.91, session=<V57P0W9GB9Fb5qhW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.82
country_id: 6252001
description:
Dec 21 11:15:42 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.82, lip=66.85.158.91, session=<B9cx0m9GId9b5qhS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.181
country_id: 6252001
description:
Dec 21 11:15:45 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.181, lip=66.85.158.91, session=<2OBg0m9G555b5qi1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.243.171
country_id: 1562822
description:
2025-12-21 11:21:21 dovecot_login authenticator failed for H=(K0XWxvPQ) [103.77.243.171]:50008: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Dec 21 11:21:37 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.91, TLS: Connection closed, session=<Gndj529GuJkiemm2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.243.171
country_id: 1562822
description:
2025-12-21 11:22:38 dovecot_login authenticator failed for H=(EmP3JOp) [103.77.243.171]:64719: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.77.243.171
country_id: 1562822
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[103.77.243.171] [Authentication Database]=[mail] [Username]=[ajith@simple-engineering.lk] (5/5 failures) (blocked until [Sun Dec 21 06:09:01 2025 UTC/Sun Dec 21 11:39:01 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-21 11:24:08 dovecot_login authenticator failed for H=([45.118.49.18]) [45.118.49.18]:54862: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.243.171
country_id: 1562822
description:
2025-12-21 11:23:21 dovecot_login authenticator failed for H=(PD2aJuVn3m) [103.77.243.171]:55663: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-21 11:23:29 dovecot_login authenticator failed for H=([103.140.18.186]) [103.140.18.186]:43622: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.21.17.225
country_id: 6252001
description:
2025-12-21 11:24:26 dovecot_login authenticator failed for H=h225.17.21.98.static.ip.windstream.net [98.21.17.225]:56784: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.189
country_id: 2635167
description:
Dec 21 11:24:44 host2 pure-ftpd[2097410]: (?@87.236.176.189) [INFO] New connection from 87.236.176.189


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 21 11:32:37 host2 sshd[2103308]: Disconnected from invalid user jana 62.60.131.157 port 21241 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:32:22 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<kubLDXBGdqMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:34:25 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<400mFXBG8tsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:36:25 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<DtNJHHBGgN4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:37:47 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<k3grIXBGRNwDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:38:45 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<6tWqJHBGVtoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Dec 21 11:38:48 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.57, lip=66.85.158.92, TLS: Connection closed, session=<3E7TJHBGhlGnXpI5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 11:39:33 host2 sshd[2108195]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 21 11:39:31 host2 sshd[2108157]: Disconnecting authenticating user root 82.67.140.251 port 38514: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 21 11:39:47 host2 sshd[2108415]: Disconnecting invalid user admin 82.67.140.251 port 40429: Too many authentication failures [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 11:39:29 host2 pure-ftpd[2108152]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 21 11:39:31 host2 sshd[2108157]: error: maximum authentication attempts exceeded for root from 82.67.140.251 port 38514 ssh2 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:40:40 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<0RaJK3BGeO0DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:41:26 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<yP9ELnBGrJIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.62
country_id: 2264397
description:
Dec 21 11:43:59 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 1 secs): user=<>, rip=45.156.128.62, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<Q+JYN3BGa9ktnIA+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.62
country_id: 2264397
description:
Dec 21 11:43:58 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.62, lip=66.85.158.91, TLS, session=<iYRSN3BGgZctnIA+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.63
country_id: 2264397
description:
Dec 21 11:43:53 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.63, lip=66.85.158.91, session=<w4EHN3BGvastnIA/>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.64
country_id: 2264397
description:
Dec 21 11:43:54 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.128.64, lip=66.85.158.91, TLS, session=</PkSN3BGg4QtnIBA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.63
country_id: 2264397
description:
Dec 21 11:43:55 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=45.156.128.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fuocN3BGv+otnIA/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.61
country_id: 2264397
description:
Dec 21 11:43:57 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.156.128.61, lip=66.85.158.91, session=<mBg8N3BGfM8tnIA9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 11:51:00 host2 sshd[2117698]: Disconnected from invalid user admin 2.57.121.112 port 19376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-12-21 11:58:59 dovecot_login authenticator failed for H=([165.154.202.101]) [165.154.202.101]:26738: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.243
country_id: 3865483
description:
Dec 21 12:02:26 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=179.0.252.243, lip=66.85.158.91, TLS, session=<vAMieHBGOaCzAPzz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.66
country_id: 298795
description:
Dec 21 12:02:48 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=95.0.32.66, lip=66.85.158.91, TLS, session=<5ih7eXBG/pBfACBC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.101.33.246
country_id: 6252001
description:
[2025-12-21 12:04:55 +0530] info [cpaneld] 76.101.33.246 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.42.93
country_id: 6252001
description:
[2025-12-21 12:04:56 +0530] info [cpaneld] 76.32.42.93 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.198.92.20
country_id: 6252001
description:
[2025-12-21 12:05:01 +0530] info [cpaneld] 47.198.92.20 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.158.46.229
country_id: 6252001
description:
[2025-12-21 12:04:36 +0530] info [cpaneld] 73.158.46.229 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.167.170.61
country_id: 6252001
description:
[2025-12-21 12:04:53 +0530] info [cpaneld] 67.167.170.61 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.242.5.144
country_id: 6252001
description:
[2025-12-21 12:04:52 +0530] info [cpaneld] 23.242.5.144 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.210.84.161
country_id: 6252001
description:
[2025-12-21 12:05:02 +0530] info [cpaneld] 198.210.84.161 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.32.12.186
country_id: 6252001
description:
[2025-12-21 12:05:05 +0530] info [cpaneld] 66.32.12.186 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.99.51.9
country_id: 6252001
description:
[2025-12-21 12:04:48 +0530] info [whostmgrd] 184.99.51.9 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.175.229.232
country_id: 6252001
description:
[2025-12-21 12:04:59 +0530] info [cpaneld] 104.175.229.232 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.47.236.28
country_id: 6252001
description:
[2025-12-21 12:04:38 +0530] info [cpaneld] 24.47.236.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.33.172.134
country_id: 6252001
description:
[2025-12-21 12:04:45 +0530] info [cpaneld] 136.33.172.134 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.208.25.115
country_id: 6252001
description:
[2025-12-21 12:04:58 +0530] info [cpaneld] 108.208.25.115 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.3.191.141
country_id: 6252001
description:
[2025-12-21 12:05:19 +0530] info [cpaneld] 160.3.191.141 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.125.93.65
country_id: 6252001
description:
[2025-12-21 12:05:22 +0530] info [cpaneld] 24.125.93.65 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.127.231.72
country_id: 6252001
description:
[2025-12-21 12:05:20 +0530] info [cpaneld] 99.127.231.72 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.143.92.177
country_id: 2510769
description:
Dec 21 12:07:06 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.143.92.177, lip=66.85.158.91, TLS, session=<BS0NiXBGrNi5j1yx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.243.38.183
country_id: 3469034
description:
Dec 21 12:07:26 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=191.243.38.183, lip=66.85.158.91, TLS, session=<Jb4oinBGZr6/8ya3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.6
country_id: 798549
description:
Dec 21 12:08:54 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.6, lip=66.85.158.91, session=<Hqd/kHBGtoNV2YwG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-21 12:09:03 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:38626: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-21 12:08:42 dovecot_login authenticator failed for H=(aes-static-025.20.22.125.airtel.in) [128.185.192.166]:48176: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-12-21 12:12:52 dovecot_login authenticator failed for H=89-67-38-27.dynamic.play.pl [89.67.38.27]:48257: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-12-21 12:13:22 dovecot_login authenticator failed for H=([182.95.22.208]) [125.23.228.86]:46052: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-21 12:14:42 dovecot_login authenticator failed for H=(187.161.173.2-clientes-izzi.mx) [187.161.173.2]:39354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-12-21 12:14:57 dovecot_login authenticator failed for H=(14.204.bol-online.com) [122.144.14.204]:53833: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-21 12:16:14 dovecot_login authenticator failed for H=50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:63702: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-21 12:16:31 dovecot_login authenticator failed for H=([125.23.112.209]) [182.95.51.166]:45558: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.11
country_id: 2186224
description:
2025-12-21 12:30:13 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.168.11]:51724: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.217
country_id: 6252001
description:
Dec 21 12:29:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.217, lip=66.85.158.91, session=<eOBL2nBGtPjN0h/Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.128.180.14
country_id: 3437598
description:
2025-12-21 12:30:41 dovecot_login authenticator failed for H=([127.0.0.1]) [190.128.180.14]:39195: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.127.24.165
country_id: 6252001
description:
2025-12-21 12:35:47 dovecot_login authenticator failed for H=99-127-24-165.lightspeed.chrlnc.sbcglobal.net [99.127.24.165]:41594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-12-21 12:36:33 dovecot_login authenticator failed for H=([191.59.187.13]) [191.59.187.13]:38580: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.129
country_id: 6252001
description:
Dec 21 12:36:38 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.129, lip=66.85.158.92, TLS, session=<xI2w83BGiOiTuYSB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 21 12:38:01 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<WkV/+HBGMrs+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 21 12:38:05 host2 sshd[2155517]: Disconnected from invalid user saige 62.60.131.157 port 6976 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 12:41:57 host2 pure-ftpd[2158703]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 12:49:13 host2 sshd[2164919]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Dec 21 12:53:40 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<2AKTMHFG3qdHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Dec 21 12:53:42 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<Ty20MHFGzqtHBpKC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Dec 21 12:54:25 host2 sshd[2169390]: Disconnected from invalid user brandon 89.126.208.241 port 43048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.170.105
country_id: 3996063
description:
Dec 21 12:55:11 host2 sshd[2170175]: Disconnected from invalid user victor 132.248.170.105 port 60905 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 21 12:55:27 host2 sshd[2170417]: Disconnected from invalid user solar 81.30.162.18 port 60703 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2025-12-21 12:56:10 dovecot_login authenticator failed for H=([50.123.92.130]) [50.123.92.130]:57071: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.199
country_id: 1512440
description:
Dec 21 12:56:24 host2 sshd[2171402]: Disconnected from invalid user m 194.107.115.199 port 53078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-21 12:56:25 dovecot_login authenticator failed for H=(187.161.198.68-clientes-izzi.mx) [187.161.198.68]:33940: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 21 12:58:15 host2 sshd[2173586]: Disconnected from invalid user vinay 81.30.162.18 port 37739 [preauth]


