# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.170.249.69
country_id: 6252001
description:
[2025-12-19 23:17:05 +0530] info [webmaild] 184.170.249.69 - info@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.249.61.124
country_id: 298795
description:
Dec 19 23:19:38 host2 sshd[386510]: Disconnected from invalid user web1 92.249.61.124 port 49846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 19 23:19:49 host2 sshd[386594]: Disconnected from invalid user web1 162.240.212.247 port 42070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 19 23:19:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<7fVAtFFGKtk+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
country_id: 798544
description:
2025-12-19 23:20:15 dovecot_login authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:40183: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-19 23:20:30 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:53878: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 19 23:20:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<gcmjtlFGnuE+PIdo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 19 23:21:43 host2 sshd[387934]: Disconnected from invalid user user1 162.240.212.247 port 55150 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 23:22:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<MU97vlFG1q4+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.249.61.124
country_id: 298795
description:
Dec 19 23:24:22 host2 sshd[389537]: Disconnected from invalid user default 92.249.61.124 port 51422 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.249.61.124
country_id: 298795
description:
Dec 19 23:25:03 host2 sshd[389925]: Disconnected from invalid user admin 92.249.61.124 port 36924 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 19 23:25:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<kNYox1FGBIA+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 19 23:25:27 host2 sshd[390453]: Disconnected from invalid user admin 2.57.121.112 port 37947 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 19 23:25:31 host2 pure-ftpd[390539]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 19 23:26:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<fPkZy1FGLsQ+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 19 23:26:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<TKCEzVFGQKE+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.249.61.124
country_id: 298795
description:
Dec 19 23:26:23 host2 sshd[391109]: Disconnected from invalid user deploy 92.249.61.124 port 59372 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-19 23:28:24 dovecot_plain authenticator failed for (putate) [65.20.160.107]:40996: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.174
country_id: 732800
description:
Dec 19 23:31:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<smtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=185.255.212.174, lip=66.85.158.91, TLS, session=<MUpX3FFGZ9W5/9Su>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.43
country_id: 1269750
description:
Dec 19 23:31:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<smtp.zoho.com587hr>, method=PLAIN, rip=103.18.166.43, lip=66.85.158.91, TLS, session=<uV533VFGKL9nEqYr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 19 23:31:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<neka31FGuqI+PIdm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.18.34.186
country_id: 1643084
description:
[2025-12-19 23:34:09 +0530] info [cpaneld] 103.18.34.186 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.89.22.113
country_id: 3469034
description:
2025-12-19 23:33:37 dovecot_login authenticator failed for (177-89-22-113.cable.cabotelecom.com.br) [177.89.22.113]:58729: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-19 23:33:50 dovecot_login authenticator failed for ([182.95.178.122]) [182.95.178.122]:53470: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-12-19 23:34:34 dovecot_plain authenticator failed for ([178.16.55.198]) [178.16.55.198]:58840: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 23:40:26 host2 sshd[400424]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 23:42:11 host2 sshd[401670]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 19 23:41:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<X3MKAVJGOuo+PIcc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 19 23:44:14 host2 sshd[402878]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.207.77.66
country_id: 1861060
description:
Dec 19 23:46:19 host2 sshd[404567]: Disconnected from invalid user mina 172.207.77.66 port 1024 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 23:46:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ozHZEVJGAp0+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.54
country_id: 1269750
description:
2025-12-19 23:47:06 dovecot_login authenticator failed for (nsg-corporate-54.202.186.122.airtel.in) [122.186.202.54]:55330: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-19 23:48:03 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (parbaviss) [68.46.148.180]:37220: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.32
country_id: 6252001
description:
Dec 19 23:47:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.32, lip=66.85.158.92, session=<Xz7nF1JGcUtAPpwg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.24
country_id: 6252001
description:
Dec 19 23:47:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.24, lip=66.85.158.92, TLS: Connection closed, session=<2lWhGFJG7oZAPpwY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 19 23:49:35 host2 sshd[406398]: Disconnected from invalid user vip 209.141.43.77 port 34436 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 19 23:49:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<MFaoH1JGusk+PIcr>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 19 23:50:25 host2 sshd[407171]: Disconnected from invalid user sentry 209.141.43.77 port 46814 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-19 23:51:25 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (byrallas) [73.197.194.98]:48714: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Dec 19 23:51:34 host2 sshd[408183]: Disconnected from invalid user ubuntu 155.4.244.107 port 24340 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.207.77.66
country_id: 1861060
description:
Dec 19 23:52:18 host2 sshd[408634]: Disconnected from invalid user dev 172.207.77.66 port 1029 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.17.230
country_id: 1733045
description:
Dec 19 23:52:34 host2 sshd[408782]: Disconnected from invalid user gituser 202.165.17.230 port 44029 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Dec 19 23:52:39 host2 sshd[408823]: Disconnected from invalid user deploy 209.141.43.77 port 55724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.107
country_id: 2661886
description:
Dec 19 23:53:46 host2 sshd[409410]: Disconnected from invalid user bodega 155.4.244.107 port 20046 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 19 23:54:47 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<6hg0MVJGWsjPWvQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.17.230
country_id: 1733045
description:
Dec 19 23:54:29 host2 sshd[410125]: Disconnected from invalid user bodega 202.165.17.230 port 50643 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 19 23:54:47 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<FnNAMVJGcsjPWvQc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.6.61.189
country_id: 6252001
description:
2025-12-19 23:55:45 dovecot_plain authenticator failed for 99-6-61-189.lightspeed.livnmi.sbcglobal.net (riank) [99.6.61.189]:49768: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 19 23:55:52 host2 sshd[411321]: Disconnected from invalid user developer 45.78.223.101 port 54478 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 19 23:56:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ecXBNlJGPpQ+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 19 23:56:58 host2 sshd[412112]: Disconnected from invalid user ts3 45.78.223.101 port 32928 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 19 23:58:06 host2 sshd[413180]: Disconnected from invalid user amits 45.78.223.101 port 39196 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.106
country_id: 6252001
description:
Dec 20 00:00:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.106, lip=66.85.158.91, TLS, session=<zupfRFJG7P7N0h9q>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 00:00:28 host2 sshd[414884]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 00:00:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<T22WRlJGlLo+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 00:02:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<w5rIS1JGopo+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-20 00:03:17 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (indraw) [24.127.53.61]:52638: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 20 00:03:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<lbz4UVJGqLk+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 00:04:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<DYk9VVJGPqU+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 00:04:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Uri2VFJG/NU+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-20 00:06:09 dovecot_plain authenticator failed for (rethurlosm) [5.11.141.74]:49114: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.157.206.169
country_id: 3469034
description:
Dec 20 00:06:26 host2 sshd[419207]: Disconnected from invalid user socks 177.157.206.169 port 41388 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.157.206.169
country_id: 3469034
description:
Dec 20 00:07:11 host2 sshd[419734]: Disconnected from invalid user svn 177.157.206.169 port 53774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-20 00:08:11 dovecot_login authenticator failed for (144.121.245.65.lightower.net) [64.72.74.162]:59800: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-20 00:07:34 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (coutintic) [73.183.74.177]:36908: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Dec 20 00:07:44 host2 sshd[420275]: Disconnected from invalid user sysuser 101.36.116.29 port 35718 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 00:08:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ZjTaYFJG9Lw+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.247.119
country_id: 1819730
description:
Dec 20 00:08:27 host2 sshd[420804]: Disconnected from invalid user user01 34.92.247.119 port 38630 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-20 00:08:34 dovecot_login authenticator failed for 217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:59468: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 20 00:08:55 host2 sshd[421102]: Disconnected from invalid user zhenshan 68.183.236.1 port 50730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.157.206.169
country_id: 3469034
description:
Dec 20 00:09:11 host2 sshd[421281]: Disconnected from invalid user ftpuser 177.157.206.169 port 34502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-20 00:08:26 dovecot_plain authenticator failed for (skiess) [102.53.15.56]:33276: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.84.134
country_id: 1819730
description:
Dec 20 00:09:43 host2 sshd[421650]: Disconnected from invalid user adi 154.82.84.134 port 33390 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 00:10:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<oVG4aVJG2rk+PIce>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.247.119
country_id: 1819730
description:
Dec 20 00:10:58 host2 sshd[422656]: Disconnected from invalid user foundry 34.92.247.119 port 50530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.84.134
country_id: 1819730
description:
Dec 20 00:11:05 host2 sshd[422768]: Disconnected from invalid user soporte 154.82.84.134 port 60512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.92.247.119
country_id: 1819730
description:
Dec 20 00:11:37 host2 sshd[423141]: Disconnected from invalid user ubuntu 34.92.247.119 port 35896 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 00:12:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<R57Yb1JGTqQ+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.236.1
country_id: 1880251
description:
Dec 20 00:13:12 host2 sshd[424443]: Disconnected from invalid user ubuntu 68.183.236.1 port 37352 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.82.84.134
country_id: 1819730
description:
Dec 20 00:13:57 host2 sshd[424847]: Disconnected from invalid user ubuntu 154.82.84.134 port 58806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.101
country_id: 1880251
description:
Dec 20 00:13:55 host2 sshd[424811]: Disconnected from invalid user iot 45.78.223.101 port 55686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Dec 20 00:15:09 host2 sshd[425756]: Disconnected from invalid user odoo 101.36.116.29 port 35660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-20 00:15:21 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:34354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.65
country_id: 1880251
description:
Dec 20 00:15:34 host2 sshd[426048]: Disconnected from invalid user x 45.78.226.65 port 59838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-12-20 00:15:45 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:57286: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.116.29
country_id: 1819730
description:
Dec 20 00:16:12 host2 sshd[426530]: Disconnected from invalid user temp 101.36.116.29 port 53566 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 00:16:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<V3KQflJGrrg+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Dec 20 00:16:43 host2 sshd[426833]: Disconnected from invalid user administrador 101.36.116.29 port 52668 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 00:17:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<lCEKhFJG2so+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 20 00:18:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<v9jehVJG+tKLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-20 00:21:36 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (hypent) [73.197.194.98]:57868: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.65
country_id: 1880251
description:
Dec 20 00:21:48 host2 sshd[431535]: Disconnected from invalid user marvin 45.78.226.65 port 47570 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.226.65
country_id: 1880251
description:
Dec 20 00:24:15 host2 sshd[433790]: Disconnected from invalid user eco 45.78.226.65 port 39748 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 00:32:18 host2 sshd[436954]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.151.158
country_id: 3144096
description:
2025-12-20 00:31:18 dovecot_login authenticator failed for (cm-84.210.151.158.get.no) [84.210.151.158]:50938: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 00:31:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 36 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<tVjHs1JGxtQ+PIdm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 61.206.193.237
country_id: 1861060
description:
[2025-12-20 00:33:36 +0530] info [webmaild] 61.206.193.237 - info@kamechotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 00:37:03 host2 sshd[440663]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 20 00:36:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<la9Ux1JGdq0+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-20 00:37:17 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:34595: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-20 00:37:35 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:60794: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 00:40:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<6LLm01JG/qU+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 00:47:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<Z7c071JGjJs+PIdj>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.80
country_id: 2635167
description:
Dec 20 00:51:04 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.80, lip=66.85.158.92, TLS, session=<kfyG+lJGxeK594lQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.238
country_id: 6252001
description:
Dec 20 00:53:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.238, lip=66.85.158.91, session=<BYqZAVNGrX5BMQHu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Dec 20 00:53:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, TLS: Connection closed, session=<8GhpAlNGfrhBMQHo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.123.84.67
country_id: 248816
description:
2025-12-20 00:53:17 dovecot_plain authenticator failed for (5D07V5) [37.123.84.67]:2142: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.123.84.67
country_id: 248816
description:
2025-12-20 00:53:24 dovecot_login authenticator failed for (5D07V5) [37.123.84.67]:2142: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.232
country_id: 6252001
description:
Dec 20 00:53:29 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.232, lip=66.85.158.91, session=<BoQrA1NG2IlBMQHo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 00:53:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<v48eA1NG9IM+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 00:53:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<UFJGBFNGPKA+PIdf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 00:55:28 host2 sshd[455190]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 6252001
description:
Dec 20 00:56:19 host2 sshd[456099]: Disconnected from invalid user omni 154.219.125.194 port 37420 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.200
country_id: 1880251
description:
Dec 20 00:58:27 host2 sshd[458039]: Disconnected from invalid user debian 101.47.143.200 port 47552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 6252001
description:
Dec 20 00:59:11 host2 sshd[458802]: Disconnected from invalid user rahul 154.219.125.194 port 45824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-12-20 00:59:16 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:53114: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 00:59:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<XGppGVNGIL4+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.176.58
country_id: 192950
description:
2025-12-20 01:00:04 dovecot_login authenticator failed for ([196.207.176.58]) [196.207.176.58]:40048: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.222.16
country_id: 3996063
description:
2025-12-20 00:59:27 dovecot_login authenticator failed for (201.166.222.16-clientes-izzi.mx) [201.166.222.16]:46218: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.200
country_id: 1880251
description:
Dec 20 00:59:27 host2 sshd[458946]: Disconnected from invalid user carlos 101.47.143.200 port 33340 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-12-20 01:00:19 dovecot_login authenticator failed for (186.235.248.73.girardi-rs.com.br) [186.235.248.73]:59788: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.200
country_id: 1880251
description:
Dec 20 01:00:37 host2 sshd[459850]: Disconnected from invalid user ttest 101.47.143.200 port 33608 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.219.125.194
country_id: 6252001
description:
Dec 20 01:01:17 host2 sshd[460284]: Disconnected from invalid user deploy 154.219.125.194 port 57398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Dec 20 01:01:23 host2 sshd[460348]: Disconnected from invalid user rahul 20.203.42.204 port 49312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.216.92.113
country_id: 6290252
description:
Dec 20 01:01:46 host2 sshd[460515]: Disconnected from invalid user gitlab-runner 89.216.92.113 port 35314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.125.194
country_id: 6252001
description:
Dec 20 01:02:49 host2 sshd[461210]: Disconnected from invalid user yang 154.219.125.194 port 59870 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.203.42.204
country_id: 290557
description:
Dec 20 01:03:13 host2 sshd[461554]: Disconnected from invalid user aluno 20.203.42.204 port 52118 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.181
country_id: 6252001
description:
Dec 20 01:04:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.79.207.181, lip=66.85.158.91, session=<zP3GKVNGqNItT8+1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 01:03:20 host2 sshd[461689]: Disconnected from invalid user nexus 2.57.121.25 port 55371 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 89.216.92.113
country_id: 6290252
description:
Dec 20 01:04:14 host2 sshd[462457]: Received disconnect from 89.216.92.113 port 53216:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.216.92.113
country_id: 6290252
description:
Dec 20 01:04:43 host2 sshd[462671]: Disconnected from invalid user simone 89.216.92.113 port 40360 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2025-12-20 01:08:18 dovecot_plain authenticator failed for c-68-38-201-238.hsd1.in.comcast.net (oscol) [68.38.201.238]:49786: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 01:09:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<aXs/PVNGzOo+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-20 01:13:43 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:57511: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-20 01:14:16 dovecot_plain authenticator failed for (ports) [41.248.243.181]:50828: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.146.25.12
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 194.146.25.12 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-20 01:19:02 dovecot_plain authenticator failed for (emillater) [80.227.102.242]:51893: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-20 01:19:04 dovecot_plain authenticator failed for (arter) [65.20.160.107]:37023: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 01:20:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Ql8YYlNGPLM+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-20 01:22:02 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:41631: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-12-20 01:22:51 dovecot_login authenticator failed for ([113.193.187.154]) [113.193.187.154]:40462: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-12-20 01:23:08 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:54893: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.238.221.65
country_id: 3996063
description:
2025-12-20 01:23:45 dovecot_login authenticator failed for ([177.238.221.65]) [177.238.221.65]:41524: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.196.209.55
country_id: 6252001
description:
2025-12-20 01:23:49 dovecot_plain authenticator failed for c-98-196-209-55.hsd1.tx.comcast.net (indraw) [98.196.209.55]:44616: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-20 01:24:04 dovecot_login authenticator failed for (cm-84.213.189.154.get.no) [84.213.189.154]:60171: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 20 01:26:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<gqSJeVNGktk+PIds>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 01:27:24 host2 sshd[477764]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.231
country_id: 6252001
description:
Dec 20 01:28:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.231, lip=66.85.158.92, session=<t4GWgVNGspxHBobn>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 01:30:07 host2 pure-ftpd[479547]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.54
country_id: 1733045
description:
2025-12-20 01:31:20 dovecot_login authenticator failed for ([49.124.151.54]) [49.124.151.54]:53380: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 20 01:32:57 host2 sshd[481264]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 50387


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-20 01:35:46 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (nesial) [73.137.7.97]:58244: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-20 01:36:25 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (corzintast) [68.193.149.88]:52372: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 01:39:14 host2 sshd[485911]: Disconnected from invalid user brionna 62.60.131.157 port 15572 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 01:38:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<5IHGo1NGeN0+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 01:40:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<F9SerFNGYrk+PIcf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-12-20 01:43:07 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 20 01:43:06 host2 sshd[488956]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 60342


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 01:43:36 host2 sshd[489295]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-12-20 01:43:39 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:33681: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-20 01:43:53 dovecot_login authenticator failed for ([177.239.164.55]) [177.239.164.55]:41761: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Dec 20 01:45:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, session=<OngHvFNGsP8t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-20 01:46:04 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:40656: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 01:46:48 host2 sshd[492368]: Disconnected from invalid user frappe 2.57.121.25 port 26939 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.109
country_id: 2215636
description:
2025-12-20 01:46:56 dovecot_login authenticator failed for ([102.38.3.109]) [102.38.3.109]:36785: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 01:47:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<zcDNw1NGPoY+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 01:49:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<Z2tNzFNGCpE+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-20 01:51:04 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (difted) [76.145.10.140]:34146: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-12-20 01:50:40 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:65374: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2025-12-20 01:50:55 dovecot_login authenticator failed for ([65.20.250.93]) [65.20.250.93]:56301: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 01:51:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<UgTe0FNGCrw+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 01:52:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<uInc1VNGmrY+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-20 01:56:22 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (undory) [73.129.57.71]:38014: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.15.124
country_id: 6252001
description:
Dec 20 01:58:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.15.124, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<vPGc7FNGbpAUow98>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.106.163.189
country_id: 6252001
description:
2025-12-20 02:00:15 dovecot_plain authenticator failed for c-76-106-163-189.hsd1.fl.comcast.net (polineus) [76.106.163.189]:35964: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.165
country_id: 6252001
description:
Dec 20 01:59:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.165, lip=66.85.158.91, TLS, session=<XCZh71NG9P7G6xil>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 02:00:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<jWFD8lNG+uY+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 02:00:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<gkZH81NG3ok+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-20 02:01:27 dovecot_plain authenticator failed for (ollizes) [96.85.104.2]:56852: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 02:01:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<TV0D91NGnKs+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.54
country_id: 6252001
description:
Dec 20 02:03:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.54, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<B8vP/FNGPIcUQcE2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.197.135
country_id: 3144096
description:
2025-12-20 02:09:16 dovecot_login authenticator failed for (cm-178.232.197.135.get.no) [178.232.197.135]:51156: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-12-20 02:09:33 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:55236: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-12-20 02:09:58 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:37360: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-12-20 02:10:16 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:57090: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-20 02:14:04 dovecot_plain authenticator failed for (culsiess) [176.113.155.132]:35262: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.132.180.251
country_id: 690791
description:
[2025-12-20 02:14:54 +0530] info [cpaneld] 45.132.180.251 - epid "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.166.167.59
country_id: 6252001
description:
[2025-12-20 02:17:15 +0530] info [webmaild] 70.166.167.59 - info@v-deploy.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 02:19:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<urjaNFRGyrY+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Dec 20 02:19:12 host2 sshd[518400]: Disconnected from invalid user test3 186.38.26.5 port 59808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.106
country_id: 1269750
description:
2025-12-20 02:19:22 dovecot_login authenticator failed for (nsg-corporate-121.229.185.122.airtel.in) [122.186.202.106]:37544: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 02:21:53 host2 sshd[520600]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 20 02:21:28 host2 sshd[520275]: Disconnected from invalid user user2 103.164.81.65 port 21162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Dec 20 02:22:15 host2 sshd[521127]: Disconnected from invalid user noc 186.38.26.5 port 44288 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 20 02:22:48 host2 sshd[521506]: Disconnected from invalid user ali 103.164.81.65 port 45820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Dec 20 02:23:40 host2 sshd[522113]: Disconnected from invalid user ubuntu 186.38.26.5 port 39770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.76.204.237
country_id: 1269750
description:
Dec 20 02:23:42 host2 sshd[522137]: Disconnected from invalid user parham 182.76.204.237 port 34950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-12-20 02:25:04 dovecot_login authenticator failed for ([182.78.122.253]) [125.19.253.154]:44166: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.227.152.155
country_id: 2635167
description:
Dec 20 02:25:05 host2 sshd[523291]: Disconnected from invalid user dev 185.227.152.155 port 54256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Dec 20 02:24:18 host2 sshd[522587]: Disconnected from invalid user dev02 186.38.26.5 port 51774 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.49.89.39
country_id: 1694008
description:
Dec 20 02:24:51 host2 sshd[522990]: Disconnected from invalid user toor 161.49.89.39 port 44734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-12-20 02:24:55 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:39300: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.227.152.155
country_id: 2635167
description:
Dec 20 02:25:45 host2 sshd[523887]: Disconnected from invalid user matt 185.227.152.155 port 40366 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.172
country_id: 3144096
description:
2025-12-20 02:25:25 dovecot_login authenticator failed for (172-161-97-62.cust.smartcall.no) [62.97.161.172]:41035: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 20 02:25:26 host2 sshd[523679]: Disconnected from invalid user steamcmd 103.164.81.65 port 40138 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
country_id: 1819730
description:
2025-12-20 02:25:30 dovecot_login authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:56432: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.176.250
country_id: 3923057
description:
Dec 20 02:26:43 host2 sshd[524634]: Disconnected from invalid user dev 181.188.176.250 port 54010 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.14.195.218
country_id: 2510769
description:
2025-12-20 02:26:55 dovecot_login authenticator failed for 218.red-88-14-195.dynamicip.rima-tde.net [88.14.195.218]:51329: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-20 02:26:37 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:47875: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.163.72
country_id: 3144096
description:
2025-12-20 02:26:44 dovecot_login authenticator failed for (72-163-97-62.cust.smartcall.no) [62.97.163.72]:45418: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.93.86
country_id: 290557
description:
2025-12-20 02:27:22 dovecot_login authenticator failed for ([87.200.93.86]) [87.200.93.86]:47544: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-12-20 02:27:41 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:65325: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.250
country_id: 3923057
description:
Dec 20 02:28:09 host2 sshd[525853]: Disconnected from invalid user noc 181.188.176.250 port 48758 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.128.201.26
country_id: 3437598
description:
Dec 20 02:28:38 host2 sshd[526265]: Disconnected from invalid user deploy 190.128.201.26 port 41942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.176.250
country_id: 3923057
description:
Dec 20 02:29:33 host2 sshd[526806]: Disconnected from invalid user user1 181.188.176.250 port 35702 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 02:31:59 host2 pure-ftpd[528781]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-20 02:31:32 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (saundia) [98.193.112.85]:47034: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-20 02:32:48 dovecot_plain authenticator failed for (quinkhan) [38.248.111.238]:36874: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.173
country_id: 6252001
description:
Dec 20 02:32:54 host2 pure-ftpd[529451]: (?@91.230.168.173) [INFO] New connection from 91.230.168.173


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 02:36:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<MR8hclRGppY+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-20 02:36:39 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (refulurgip) [24.23.125.83]:40682: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.135.19
country_id: 6252001
description:
[2025-12-20 02:37:04 +0530] info [webmaild] 192.111.135.19 - info@ksoft.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 02:37:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<VvtFd1RGiJ0+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-20 02:41:04 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (parymbies) [71.62.34.216]:42142: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.166.49.42
country_id: 1269750
description:
Dec 20 02:43:00 host2 sshd[536977]: Disconnected from invalid user oracle 122.166.49.42 port 51922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.87.26.219
country_id: 3077311
description:
Dec 20 02:45:47 host2 sshd[539431]: Disconnected from invalid user guest 194.87.26.219 port 46956 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 20 02:46:45 host2 sshd[539980]: Disconnected from invalid user zabbix 193.187.148.79 port 41868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 20 02:46:49 host2 sshd[539996]: Disconnected from invalid user sysadmin 52.187.9.8 port 48008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.131.131.43
country_id: 1269750
description:
Dec 20 02:46:56 host2 sshd[540074]: Disconnected from invalid user desktop 34.131.131.43 port 47260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.125.94
country_id: 2921044
description:
Dec 20 02:47:05 host2 sshd[540204]: Disconnected from invalid user guest 165.232.125.94 port 41730 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.36.180
country_id: 2921044
description:
Dec 20 02:47:12 host2 sshd[540389]: Disconnected from invalid user postgres 167.71.36.180 port 61848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.82
country_id: 1149361
description:
2025-12-20 02:47:33 dovecot_login authenticator failed for ([180.94.74.82]) [180.94.74.82]:48122: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.131.131.43
country_id: 1269750
description:
Dec 20 02:47:38 host2 sshd[540663]: Disconnected from invalid user test 34.131.131.43 port 32832 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-12-20 02:47:44 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:50761: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.131.131.43
country_id: 1269750
description:
Dec 20 02:48:20 host2 sshd[541136]: Disconnected from invalid user user2 34.131.131.43 port 46624 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 02:50:46 host2 sshd[542805]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.87.26.219
country_id: 3077311
description:
Dec 20 02:51:08 host2 sshd[543219]: Disconnected from invalid user user 194.87.26.219 port 36310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 20 02:50:27 host2 sshd[542583]: Disconnected from invalid user admin01 193.187.148.79 port 35208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 20 02:50:51 host2 sshd[542856]: Disconnected from invalid user admin 110.164.228.242 port 49904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.125.94
country_id: 2921044
description:
Dec 20 02:50:54 host2 sshd[542900]: Disconnected from invalid user ubuntu 165.232.125.94 port 42494 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.187.148.79
country_id: 2921044
description:
Dec 20 02:51:29 host2 sshd[543503]: Disconnected from invalid user sfserver 193.187.148.79 port 37972 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2025-12-20 02:52:04 dovecot_login authenticator failed for ([51.162.194.94]) [51.162.194.94]:41812: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 02:51:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<FQHAqFRGzIE+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 110.164.228.242
country_id: 1605651
description:
Dec 20 02:51:39 host2 sshd[543602]: Disconnected from invalid user user 110.164.228.242 port 50712 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 02:52:21 host2 sshd[544447]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.244
country_id: 1269750
description:
2025-12-20 02:52:36 dovecot_login authenticator failed for ([118.91.176.244]) [118.91.176.244]:43731: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.154
country_id: 1269750
description:
2025-12-20 02:53:00 dovecot_login authenticator failed for ([128.185.223.87]) [182.95.178.154]:51476: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.232.125.94
country_id: 2921044
description:
Dec 20 02:52:32 host2 sshd[544552]: Disconnected from invalid user vboxuser 165.232.125.94 port 50982 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-12-20 02:52:35 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:56456: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 20 02:52:49 host2 sshd[544733]: Disconnected from invalid user lubuntu 52.187.9.8 port 59204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-12-20 02:53:54 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:49744: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 20 02:53:26 host2 sshd[545350]: Disconnected from invalid user ubuntu 52.187.9.8 port 33040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-12-20 02:54:25 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:36364: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-20 02:57:04 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:35011: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-12-20 02:57:22 dovecot_login authenticator failed for (host253.181-93-60.telecom.net.ar) [181.93.60.253]:53327: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 02:58:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<boc5wlRGoqA+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-20 03:00:53 dovecot_login authenticator failed for ([182.74.12.86]) [182.74.12.86]:56814: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-20 03:01:35 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (unded) [76.16.7.82]:44258: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.219
country_id: 1733045
description:
2025-12-20 03:01:34 dovecot_login authenticator failed for ([49.124.149.219]) [49.124.149.219]:54764: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-12-20 03:02:07 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:36202: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-20 03:02:27 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:35267: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 03:03:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<ISuC01RGpMU+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 03:03:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<oK+Z01RGApo+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 03:04:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<c37k11RGWsw+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 03:06:50 host2 sshd[557007]: Disconnected from invalid user  2.57.121.25 port 14653 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2025-12-20 03:07:56 dovecot_login authenticator failed for ([125.23.243.66]) [125.23.41.122]:36118: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.223
country_id: 6252001
description:
Dec 20 03:08:17 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.223, lip=66.85.158.91, session=<BMM45VRG6tstT7Xf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-12-20 03:07:26 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:55624: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.223
country_id: 6252001
description:
Dec 20 03:08:17 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.223, lip=66.85.158.91, session=<ERdE5VRG+NstT7Xf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 03:11:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<iy5N71RGkO0+PIcf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.170.57.251
country_id: 6252001
description:
[2025-12-20 03:11:13 +0530] info [webmaild] 98.170.57.251 - info@agronatureholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 03:12:02 host2 sshd[560893]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 20 03:11:26 host2 sshd[560538]: Disconnected from invalid user ems 186.87.166.141 port 36564 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.87.166.141
country_id: 3686110
description:
Dec 20 03:13:33 host2 sshd[562309]: Disconnected from invalid user deploy 186.87.166.141 port 39326 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 03:17:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<qq6QBVVGSow+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 20 03:18:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<FB7OCVVG/Ns+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 03:18:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<389YC1VGqOs+PIcs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 03:19:51 host2 sshd[567060]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 03:20:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=</Oa4EVVG5LU+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-12-20 03:22:11 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (dectohers) [5.185.233.251]:40812: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-20 03:22:30 dovecot_login authenticator failed for (nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:37310: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.117.114
country_id: 3865483
description:
2025-12-20 03:22:43 dovecot_login authenticator failed for (red.170.233.117.114.ssservicios.com.ar) [170.233.117.114]:44907: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.16
country_id: 3175395
description:
Dec 20 03:23:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.208.106.16, lip=66.85.158.91, TLS, session=<x58uHFVGAM+50GoQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.162
country_id: 3469034
description:
Dec 20 03:24:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=191.53.129.162, lip=66.85.158.91, TLS, session=<cVtGHFVGuOa/NYGi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.165
country_id: 3865483
description:
Dec 20 03:24:02 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.252.165, lip=66.85.158.91, TLS, session=<Jf1IHFVGf8KzAPyl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.35.117
country_id: 3175395
description:
Dec 20 03:23:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=178.239.35.117, lip=66.85.158.91, TLS, session=<eEAvHFVGsOuy7yN1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 03:23:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<IYgOHVVGhJ4+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.59.224.103
country_id: 798544
description:
Dec 20 03:24:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=212.59.224.103, lip=66.85.158.91, TLS, session=<NxxsHVVGbczUO+Bn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.63
country_id: 3469034
description:
Dec 20 03:24:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers>, method=PLAIN, rip=177.44.71.63, lip=66.85.158.91, TLS, session=<7gZbHVVGeuWxLEc/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.235.7.161
country_id: 3077311
description:
Dec 20 03:24:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=109.235.7.161, lip=66.85.158.91, TLS, session=<FMmKHVVGEs1t6weh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.56.130
country_id: 1269750
description:
Dec 20 03:24:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<careers>, method=PLAIN, rip=103.237.56.130, lip=66.85.158.91, TLS, session=<vim5HVVGIrNn7TiC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-20 03:25:32 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:49937: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.26
country_id: 1149361
description:
2025-12-20 03:25:57 dovecot_login authenticator failed for ([149.54.62.26]) [149.54.62.26]:48736: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-20 03:28:56 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (wargately) [73.183.74.177]:42142: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 03:30:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<GFflNFVGvp8+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Dec 20 03:30:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=34.122.105.182, lip=66.85.158.91, TLS: Connection closed, session=<H5D0M1VGkpoiemm2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.189.21
country_id: 1819730
description:
Dec 20 03:31:31 host2 sshd[576902]: Disconnected from invalid user hik 152.32.189.21 port 49366 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 03:33:54 host2 pure-ftpd[578786]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.189.21
country_id: 1819730
description:
Dec 20 03:35:33 host2 sshd[580266]: Disconnected from invalid user devops 152.32.189.21 port 35136 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 03:36:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<MDaQS1VGpL8+PIde>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.200.201
country_id: 1880251
description:
Dec 20 03:37:32 host2 sshd[581648]: Disconnected from invalid user arash 45.78.200.201 port 40408 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 03:38:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<hAA6UFVG/tY+PIcg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 74.249.178.154
country_id: 6252001
description:
Dec 20 03:39:31 host2 pure-ftpd[583254]: (?@74.249.178.154) [INFO] New connection from 74.249.178.154


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-20 03:41:01 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:37166: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-20 03:41:55 dovecot_login authenticator failed for ([128.185.13.33]) [122.184.123.118]:39672: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-12-20 03:43:05 dovecot_plain authenticator failed for (sexte) [65.20.205.197]:43307: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 20 03:43:29 host2 sshd[586983]: Disconnected from invalid user esmeralda 172.208.24.217 port 12144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.154.255
country_id: 1269750
description:
Dec 20 03:43:19 host2 sshd[586837]: Disconnected from invalid user support 103.172.154.255 port 48394 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Dec 20 03:44:37 host2 sshd[588193]: Disconnected from invalid user admin 172.208.24.217 port 9104 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.154.255
country_id: 1269750
description:
Dec 20 03:45:47 host2 sshd[589731]: Disconnected from invalid user admin 103.172.154.255 port 52744 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 20 03:46:13 host2 sshd[590284]: Disconnected from invalid user carol 27.112.78.245 port 48146 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-20 03:46:17 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (chobs) [73.145.107.251]:42942: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2025-12-20 03:46:23 dovecot_plain authenticator failed for (froses) [65.20.148.194]:38290: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-20 03:46:26 dovecot_plain authenticator failed for (orbithar) [154.144.243.93]:60430: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.123.84.67
country_id: 248816
description:
2025-12-20 03:47:47 dovecot_plain authenticator failed for (V4836VC8A) [37.123.84.67]:2463: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 20 03:50:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<uFV0elVGPL8+PIco>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.103.245.7
country_id: 1819730
description:
Dec 20 03:50:10 host2 sshd[594230]: Disconnected from invalid user photos 103.103.245.7 port 51898 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.172
country_id: 6252001
description:
Dec 20 03:51:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.172, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<P1FaflVGocnG6xis>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 20 03:51:38 host2 sshd[596155]: Disconnected from invalid user photos 27.112.78.245 port 47706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.7
country_id: 1819730
description:
Dec 20 03:51:20 host2 sshd[595757]: Disconnected from invalid user contact 103.103.245.7 port 36030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 20 03:52:34 host2 sshd[597021]: Disconnected from invalid user joshua 27.112.78.245 port 60916 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 178.128.25.67
country_id: 1880251
description:
Dec 20 03:52:53 host2 sshd[597331]: Disconnected from invalid user chef 178.128.25.67 port 37126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-20 03:53:57 dovecot_login authenticator failed for ([128.185.253.122]) [128.185.253.122]:45096: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-20 03:54:10 dovecot_login authenticator failed for ([125.19.156.2]) [125.19.156.2]:39524: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-20 03:53:20 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (undar) [68.40.189.43]:55552: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 20 03:53:25 host2 sshd[597841]: Disconnected from invalid user steam 27.112.78.245 port 35284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Dec 20 03:54:19 host2 sshd[599088]: Disconnected from invalid user contact 27.112.78.245 port 52976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 03:56:30 host2 sshd[601740]: Disconnected from invalid user service 2.57.121.25 port 16324 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 03:57:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<ouAklVVGvqc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 03:57:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<kWtKlFVGltA+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.252.18
country_id: 1269750
description:
2025-12-20 03:58:30 dovecot_login authenticator failed for (dsl-kk-static-089.203.95.61.airtelbroadband.in) [125.20.252.18]:41200: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-20 03:58:49 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:43846: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2025-12-20 04:01:03 dovecot_login authenticator failed for ([152.52.220.126]) [152.52.220.126]:34822: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-20 04:01:51 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:39116: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-20 04:01:36 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:36378: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-20 04:03:52 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:46448: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-20 04:03:17 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:36396: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 04:03:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<UpUXqlVGVuU+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 04:03:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<fPa7q1VGZMY+PIdm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 04:06:34 host2 sshd[613232]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 04:06:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<qerAtFVGorM+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 04:07:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<KowFuVVG9qY+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-12-20 04:08:05 dovecot_login authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:15406: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.252
country_id: 1733045
description:
2025-12-20 04:08:38 dovecot_login authenticator failed for ([49.124.150.252]) [49.124.150.252]:43918: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-20 04:10:20 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:39214: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-20 04:10:32 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:34712: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 04:10:59 host2 sshd[617394]: Disconnected from invalid user tristian 62.60.131.157 port 21977 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 20 04:13:08 host2 sshd[620013]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 49207


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 20 04:14:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<4GNc0VVGCLY+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-20 04:15:03 dovecot_login authenticator failed for ([24.105.248.218]) [24.105.248.218]:57442: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.223.240.239
country_id: 49518
description:
2025-12-20 04:15:18 dovecot_login authenticator failed for ([196.223.240.239]) [196.223.240.239]:60808: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 04:15:27 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (zarchrac) [87.103.126.54]:21461: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 04:16:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<fRf+2VVGVqg+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.244.23.211
country_id: 3865483
description:
Dec 20 04:21:22 host2 sshd[629746]: Disconnected from invalid user botuser 190.244.23.211 port 49864 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.244.23.211
country_id: 3865483
description:
Dec 20 04:22:50 host2 sshd[631583]: Disconnected from invalid user root123 190.244.23.211 port 42478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.244.23.211
country_id: 3865483
description:
Dec 20 04:24:30 host2 sshd[633360]: Disconnected from invalid user debian 190.244.23.211 port 33746 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-20 04:24:58 dovecot_login authenticator failed for ([182.95.63.10]) [182.95.63.10]:55388: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 04:24:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<pVBn91VGmps+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-12-20 04:25:42 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:35503: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-20 04:28:55 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:36902: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-12-20 04:28:26 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:47356: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.244.23.211
country_id: 3865483
description:
Dec 20 04:28:38 host2 sshd[638197]: Disconnected from invalid user ty 190.244.23.211 port 39180 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 04:29:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<iGalBlZG4OU+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.114.35
country_id: 1269750
description:
2025-12-20 04:30:34 dovecot_plain authenticator failed for (aucomisked) [103.69.114.35]:58456: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 20 04:32:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<tjvBElZGLJI+PIdn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-20 04:35:37 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:51968: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 04:35:54 host2 pure-ftpd[646536]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-12-20 04:35:59 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:51554: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.104
country_id: 3996063
description:
2025-12-20 04:36:13 dovecot_login authenticator failed for (201.173.216.104-clientes-izzi.mx) [201.173.216.104]:37477: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.252.210.237
country_id: 6252001
description:
[2025-12-20 04:37:29 +0530] info [webmaild] 192.252.210.237 - info@dataesite.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 04:39:07 host2 sshd[649319]: Disconnected from invalid user pritchard 2.57.121.25 port 32716 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.204
country_id: 6252001
description:
Dec 20 04:40:48 host2 pure-ftpd[652801]: (?@205.210.31.204) [INFO] New connection from 205.210.31.204


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-20 04:40:47 dovecot_login authenticator failed for (cm-178.232.185.189.get.no) [178.232.185.189]:58505: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-20 04:47:13 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (ancital) [76.16.7.82]:55503: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-12-20 04:47:28 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 20 04:47:26 host2 sshd[658352]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 60243


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 04:48:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<J4GMSlZGUug+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Dec 20 04:48:18 host2 sshd[659164]: Disconnected from invalid user user 103.172.20.218 port 35612 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.55
country_id: 6252001
description:
Dec 20 04:48:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=205.210.31.55, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wsqAS1ZGpN/N0h83>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.52.34.13
country_id: 3865483
description:
2025-12-20 04:49:08 dovecot_login authenticator failed for (host13.190-52-34.wirenet.com.ar) [190.52.34.13]:58702: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.31
country_id: 1522867
description:
2025-12-20 04:49:20 dovecot_login authenticator failed for ([212.116.247.31]) [212.116.247.31]:55132: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-20 04:50:08 dovecot_plain authenticator failed for (pinons) [103.51.26.198]:55010: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.120.45
country_id: 732800
description:
2025-12-20 04:50:53 dovecot_plain authenticator failed for (catills) [62.73.120.45]:58720: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 20 04:52:45 host2 sshd[662949]: Disconnected from invalid user debian 27.254.137.144 port 59880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Dec 20 04:53:22 host2 sshd[663672]: Disconnected from invalid user huang 27.254.137.144 port 56520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 20 04:54:48 host2 sshd[665130]: Disconnected from invalid user git 34.91.0.68 port 51540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Dec 20 04:55:42 host2 sshd[665909]: Disconnected from invalid user ria 103.172.20.218 port 50426 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 04:56:30 host2 sshd[666466]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.9.62.92
country_id: 6252001
description:
2025-12-20 04:56:32 dovecot_plain authenticator failed for c-24-9-62-92.hsd1.co.comcast.net (nooty) [24.9.62.92]:49692: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.91.0.68
country_id: 2750405
description:
Dec 20 04:57:07 host2 sshd[666941]: Disconnected from invalid user lol 34.91.0.68 port 44612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Dec 20 04:58:13 host2 sshd[667856]: Disconnected from invalid user ahmed 103.172.20.218 port 45302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.251.10
country_id: 6252001
description:
Dec 20 04:58:39 host2 sshd[668140]: Disconnected from invalid user mp 199.195.251.10 port 34280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 20 04:58:54 host2 sshd[668322]: Disconnected from invalid user lixiang 102.88.137.213 port 49492 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 04:58:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<XKDgcFZGzK4+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.75.216.74
country_id: 1269750
description:
Dec 20 05:00:14 host2 sshd[669532]: Disconnected from invalid user f 182.75.216.74 port 57715 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 20 05:01:58 host2 sshd[670796]: Disconnected from invalid user tunnel 193.70.86.193 port 38510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Dec 20 05:01:15 host2 sshd[670336]: Disconnected from invalid user username 117.216.211.19 port 44670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-20 05:01:52 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:48803: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-20 05:02:36 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:45610: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.211.19
country_id: 1269750
description:
Dec 20 05:02:42 host2 sshd[671252]: Disconnected from invalid user ftpuser1 117.216.211.19 port 42948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.247.91
country_id: 241170
description:
Dec 20 05:02:43 host2 sshd[671280]: Disconnected from invalid user lixiang 156.245.247.91 port 58408 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.197.248.209
country_id: 1819730
description:
Dec 20 05:02:55 host2 sshd[671393]: Disconnected from invalid user ftpuser1 223.197.248.209 port 40295 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.245.247.91
country_id: 241170
description:
Dec 20 05:04:34 host2 sshd[673065]: Disconnected from invalid user ociispth 156.245.247.91 port 40120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.234.213.249
country_id: 895949
description:
2025-12-20 05:05:42 dovecot_plain authenticator failed for (T8FWR3M6R) [216.234.213.249]:13791: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 20 05:05:58 host2 sshd[674393]: Disconnected from invalid user nexus 190.129.122.185 port 33714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 20 05:05:39 host2 sshd[674105]: Disconnected from invalid user ai 193.70.86.193 port 56224 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.70.86.193
country_id: 3017382
description:
Dec 20 05:06:36 host2 sshd[675069]: Disconnected from invalid user dev 193.70.86.193 port 37230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Dec 20 05:06:50 host2 sshd[675284]: Disconnected from invalid user mike 41.223.40.77 port 44684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.223.40.77
country_id: 3351879
description:
Dec 20 05:08:02 host2 sshd[676196]: Disconnected from invalid user sammy 41.223.40.77 port 49498 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.223.40.77
country_id: 3351879
description:
Dec 20 05:08:39 host2 sshd[676616]: Disconnected from invalid user test 41.223.40.77 port 41276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 20 05:09:38 host2 sshd[677466]: Disconnected from invalid user admin 102.88.137.213 port 49644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.129.122.185
country_id: 3923057
description:
Dec 20 05:09:58 host2 sshd[677702]: Disconnected from invalid user smart 190.129.122.185 port 60086 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.195.226.17
country_id: 290557
description:
Dec 20 05:10:06 host2 sshd[677947]: Disconnected from invalid user jenkins 5.195.226.17 port 34340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.57.124
country_id: 6252001
description:
Dec 20 05:09:29 host2 sshd[677371]: Disconnected from invalid user test 209.141.57.124 port 35834 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.70
country_id: 6252001
description:
Dec 20 05:10:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kfSGmlZGxdDG6xhG>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.147
country_id: 2635167
description:
Dec 20 05:11:02 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.147, lip=66.85.158.92, TLS, session=<qHkznFZGj6lX7LCT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.174.116.14
country_id: 6252001
description:
Dec 20 05:11:14 host2 pure-ftpd[678807]: (?@172.174.116.14) [INFO] New connection from 172.174.116.14


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 05:15:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<Q5ajrVZGNMs+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 05:18:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<CO2stVZGOoo+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-20 05:20:46 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (graffieci) [73.197.194.98]:53660: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.125.11.154
country_id: 2017370
description:
[2025-12-20 05:22:44 +0530] info [webmaild] 94.125.11.154 - info@jrdc.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.92.63.243
country_id: 6252001
description:
Dec 20 05:24:16 host2 sshd[689071]: Disconnected from invalid user eprints 96.92.63.243 port 41306 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.92.63.243
country_id: 6252001
description:
Dec 20 05:24:50 host2 sshd[689353]: Disconnected from invalid user acs 96.92.63.243 port 55190 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.116
country_id: 294640
description:
2025-12-20 05:25:13 dovecot_login authenticator failed for ([195.133.156.116]) [195.133.156.116]:51807: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 05:26:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<jxwA1FZGLtM+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 05:29:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<zYh13VZGDLk+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 05:31:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<tK9w5FZGtJQ+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 05:33:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Ux6d7VZGmqA+PIcd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 05:37:52 host2 pure-ftpd[698232]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 05:38:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<s63P/VZGSKk+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 05:39:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<MMxNAVdGIrM+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.231.189.36
country_id: 6252001
description:
Dec 20 05:39:22 host2 sshd[699156]: Disconnected from invalid user marcus 199.231.189.36 port 33124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.231.189.36
country_id: 6252001
description:
Dec 20 05:43:24 host2 sshd[701514]: Disconnected from invalid user ppp 199.231.189.36 port 38920 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.231.189.36
country_id: 6252001
description:
Dec 20 05:43:58 host2 sshd[701803]: Disconnected from invalid user test 199.231.189.36 port 35348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.231.189.36
country_id: 6252001
description:
Dec 20 05:45:45 host2 sshd[703316]: Disconnected from invalid user guest 199.231.189.36 port 45332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Dec 20 05:45:36 host2 sshd[703154]: Disconnected from invalid user test 151.49.129.67 port 59282 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.54.235.12
country_id: 6252001
description:
[2025-12-20 05:46:30 +0530] info [webmaild] 142.54.235.12 - info@gnetuniversals.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.49.129.67
country_id: 3175395
description:
Dec 20 05:47:05 host2 sshd[704813]: Disconnected from invalid user hjh 151.49.129.67 port 51280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-20 05:49:13 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:36634: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.49.129.67
country_id: 3175395
description:
Dec 20 05:48:34 host2 sshd[705695]: Disconnected from invalid user max 151.49.129.67 port 45018 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-20 05:49:32 dovecot_login authenticator failed for (cm-178.232.168.117.get.no) [178.232.168.117]:47885: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 20 05:49:43 host2 sshd[706345]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 65268


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 15.235.162.8
country_id: 1880251
description:
Dec 20 05:50:10 host2 sshd[706817]: Disconnected from invalid user hjh 15.235.162.8 port 34168 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 05:50:44 host2 sshd[707251]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2025-12-20 05:51:14 dovecot_login authenticator failed for ([182.95.85.181]) [182.95.123.46]:45286: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-20 05:52:08 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (forty) [71.62.34.216]:56316: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 05:51:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<wmXxLFdGpJE+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 05:53:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<EGffNFdG8u0+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 05:56:10 host2 sshd[711508]: Disconnected from invalid user squid 2.57.121.25 port 34589 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 20 05:57:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<wrQFQldG1OU+PIdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 05:58:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<iCyTRVdGFJw+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 20 05:59:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<lOX3SldGvNDBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.94.67.17
country_id: 1694008
description:
2025-12-20 06:00:48 dovecot_plain authenticator failed for (UJZECE2W) [119.94.67.17]:30177: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 06:02:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<JX6hUldG4Mw+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 06:03:09 host2 sshd[716558]: Disconnected from invalid user  2.57.121.25 port 32542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-20 06:02:54 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:46391: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-12-20 06:03:19 dovecot_login authenticator failed for ([125.17.48.129]) [152.52.210.118]:41536: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-20 06:03:35 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:25351: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 06:03:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<szoSWFdGEJw+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-12-20 06:03:59 dovecot_login authenticator failed for ([122.184.89.169]) [125.23.203.114]:49808: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 06:06:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<DaxDY1dGZIs+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 20 06:08:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<6yxLaFdGX/7CpRCm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-20 06:07:39 dovecot_plain authenticator failed for (sycetify) [178.250.191.189]:59168: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 06:09:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<r9jLbFdGFMk+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-12-20 06:12:48 dovecot_plain authenticator failed for c-73-0-191-33.hsd1.fl.comcast.net (inching) [73.0.191.33]:38394: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-20 06:13:36 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (turaneekko) [76.145.10.140]:39848: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-20 06:18:00 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:58894: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-20 06:18:30 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:55794: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-20 06:18:44 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (domak) [78.68.37.25]:56323: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2025-12-20 06:23:08 dovecot_plain authenticator failed for (unthfula) [50.202.197.108]:46655: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 20 06:26:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<HFGlq1dGaIs+PIdn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 06:28:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<jtW7r1dGaMI+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-20 06:28:39 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:33774: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-20 06:29:03 dovecot_login authenticator failed for ([125.16.246.121]) [182.95.63.50]:41210: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-20 06:34:16 dovecot_plain authenticator failed for (unwris) [24.104.225.201]:54709: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 20 06:34:48 host2 sshd[745040]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 64065


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-12-20 06:34:51 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 06:37:38 host2 sshd[747048]: Disconnected from invalid user support 2.57.121.25 port 23121 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-12-20 06:37:47 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:38412: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.51.52.30
country_id: 1605651
description:
2025-12-20 06:38:09 dovecot_login authenticator failed for (mx-ll-183.89.250-247.dynamic.3bb.in.th) [101.51.52.30]:47530: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-20 06:38:59 dovecot_plain authenticator failed for (unblucte) [65.20.164.137]:41594: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-12-20 06:38:52 dovecot_plain authenticator failed for syn-071-041-202-012.biz.spectrum.com (sabseyen) [71.41.202.12]:38678: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 06:38:55 host2 sshd[748180]: Disconnected from invalid user frankie 62.60.131.157 port 27320 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 06:39:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<Y4eA2FdGIrI+PIM0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 06:39:47 host2 pure-ftpd[748815]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-20 06:43:44 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (stizin) [73.144.27.228]:41076: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.168
country_id: 6252001
description:
Dec 20 06:45:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.168, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<6w2W7VdGKdCTuYSo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2025-12-20 06:45:45 dovecot_login authenticator failed for (nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:39226: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 06:46:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<5fGL8ldGRK4+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 06:50:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<79dh/1dGVOs+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.152.131
country_id: 1694008
description:
2025-12-20 06:50:41 dovecot_login authenticator failed for 131.152.62.103.in-addr.arpa.cable21.net (solitude.engreensolutions.com.) [103.62.152.131]:24081: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 06:52:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<aLY1BVhGQs4+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-20 06:52:51 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:54298: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-12-20 06:53:09 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:51234: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.14
country_id: 3996063
description:
2025-12-20 06:57:26 dovecot_login authenticator failed for (189.218.82.14-clientes-izzi.mx) [189.218.82.14]:38884: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-20 06:57:44 dovecot_login authenticator failed for ([128.185.101.201]) [122.185.146.18]:58612: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.188
country_id: 2635167
description:
Dec 20 06:58:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.188, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<y3zaHVhGt6NX7LC8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-20 06:58:41 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (nostersol) [73.168.136.150]:56284: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.17
country_id: 2635167
description:
Dec 20 06:58:50 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.17, lip=66.85.158.91, TLS, session=<//fHHVhG8+W594kR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.215
country_id: 2635167
description:
Dec 20 06:59:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.215, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<FGLRIVhG77FX7LDX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.76
country_id: 6252001
description:
Dec 20 06:59:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.76, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<3IewH1hGdtGTuYRM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.216
country_id: 2635167
description:
Dec 20 06:59:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.216, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Ot7VH1hGj4pX7LDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 07:00:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<muGNI1hGzs8+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.217
country_id: 2635167
description:
Dec 20 07:00:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.217, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<Ic/MI1hGmd2594nZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 07:00:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<XJf9JFhG5q4+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 07:00:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<DUMhJVhG1M0+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.183
country_id: 2635167
description:
Dec 20 07:01:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.183, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<zinIJVhG9Y9X7LC3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.187
country_id: 2635167
description:
Dec 20 07:01:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.187, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<i3/BJ1hGe7S594m7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.214
country_id: 2635167
description:
Dec 20 07:02:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.214, lip=66.85.158.91, TLS handshaking: Connection closed, session=<EeC+KVhGOYNX7LDW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.188
country_id: 2635167
description:
Dec 20 07:02:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.188, lip=66.85.158.91, TLS handshaking: Connection closed, session=</zu6K1hG5aK594m8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.208
country_id: 2635167
description:
Dec 20 07:03:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.208, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<SqKzLVhGWcC594nQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.204
country_id: 2635167
description:
Dec 20 07:03:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.204, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<GPyuL1hGL4tX7LDM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 07:07:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<VhDIPVhGqL0+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 07:08:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<rvpZQFhGfIE+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-20 07:10:01 dovecot_login authenticator failed for ([109.248.156.49]) [109.248.156.49]:51538: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-12-20 07:10:38 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:54124: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 07:11:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<+/+9S1hGUqg+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.16
country_id: 6252001
description:
Dec 20 07:13:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.16, lip=66.85.158.92, TLS, session=<3btRUlhGFOqTuYQQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-12-20 07:16:43 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:44078: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.98.76
country_id: 1880251
description:
2025-12-20 07:17:09 dovecot_login authenticator failed for ([124.246.98.76]) [124.246.98.76]:57810: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 07:17:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<PRkfYVhGKrg+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Dec 20 07:18:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<vkwIZFhGYIjE+2YR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Dec 20 07:19:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<7AfDZVhG0KvE+2YQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 07:19:02 host2 sshd[775816]: Disconnected from invalid user  2.57.121.25 port 29785 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 07:21:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<LoF2bVhGQoI+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.14
country_id: 241170
description:
Dec 20 07:22:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.14, lip=66.85.158.91, session=<o/Vkc1hGOJzE+2YO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.12
country_id: 241170
description:
Dec 20 07:25:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.12, lip=66.85.158.91, session=<ao1De1hGKpjE+2YM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.250.156.241
country_id: 294640
description:
2025-12-20 07:24:14 dovecot_login authenticator failed for ([80.250.156.241]) [80.250.156.241]:51810: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-12-20 07:24:35 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:40266: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 07:25:58 host2 sshd[780320]: Disconnected from invalid user admin 2.57.121.25 port 37495 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.30
country_id: 3144096
description:
2025-12-20 07:29:25 dovecot_login authenticator failed for (30-170-97-62.cust.smartcall.no) [62.97.170.30]:43903: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-12-20 07:29:40 dovecot_login authenticator failed for (nsg-corporate-142.60.186.122.airtel.in) [122.186.60.142]:43968: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 07:30:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<kxwIkFhGpss+PIdl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.227
country_id: 3017382
description:
Dec 20 07:32:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.227, lip=66.85.158.91, session=<aVNllFhGe5JbxJjj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.152
country_id: 3017382
description:
Dec 20 07:32:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.196.152.152, lip=66.85.158.91, session=<uM8KlVhG7eVbxJiY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.159
country_id: 3017382
description:
Dec 20 07:32:30 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.159, lip=66.85.158.91, session=<EBYsllhGgatbxJif>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.229
country_id: 3017382
description:
Dec 20 07:32:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.229, lip=66.85.158.91, session=<KXFellhGf4dbxJjl>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 07:35:04 host2 sshd[786647]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.14.232
country_id: 1512440
description:
2025-12-20 07:36:07 dovecot_login authenticator failed for ([195.158.14.232]) [195.158.14.232]:55400: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.67.39
country_id: 3996063
description:
2025-12-20 07:36:25 dovecot_login authenticator failed for ([201.160.67.39]) [201.160.67.39]:49309: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Dec 20 07:40:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<sgabs1hGpMTE+2YS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Dec 20 07:41:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<FDXLtFhG4rXE+2YP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 07:41:46 host2 pure-ftpd[791214]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 07:42:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<d/57ulhGRLc+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-12-20 07:43:02 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:46966: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.137.193.222
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 3.137.193.222 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.13
country_id: 241170
description:
Dec 20 07:43:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.13, lip=66.85.158.91, session=<v0shvVhG4ObE+2YN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Dec 20 07:44:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<rVtPv1hG2ODE+2YL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-12-20 07:43:15 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:56404: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 20 07:45:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<fhc+xFhGj//CpRCh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 07:46:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<yOxwyVhGhoc+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 07:48:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<nojkz1hG9Ms+PIcm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.185.2.1
country_id: 6252001
description:
[2025-12-20 07:54:21 +0530] info [webmaild] 184.185.2.1 - info@seyawin.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-12-20 07:55:02 dovecot_plain authenticator failed for (undivibias) [185.214.169.10]:57188: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-20 07:57:30 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (gomphunde) [144.64.157.244]:38487: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-20 07:58:17 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (tropyler) [24.91.103.202]:36748: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Dec 20 07:59:32 host2 sshd[803207]: Disconnected from invalid user debian 154.83.15.123 port 49384 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-20 07:59:40 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:54540: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-12-20 08:02:59 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:58316: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-20 08:02:39 dovecot_login authenticator failed for ([115.240.244.53]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Dec 20 08:03:17 host2 sshd[806499]: Disconnected from invalid user home 172.173.117.246 port 47708 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-20 08:05:00 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (taran) [217.215.74.195]:59990: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-20 08:05:05 dovecot_plain authenticator failed for (destweed) [103.51.26.198]:55778: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 08:05:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<ev6PDVlGCMo+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Dec 20 08:06:11 host2 sshd[808847]: Disconnected from invalid user factorio 154.83.15.123 port 49574 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.123
country_id: 1819730
description:
Dec 20 08:06:45 host2 sshd[809242]: Disconnected from invalid user VM 154.83.15.123 port 33522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 08:07:08 host2 sshd[809555]: Disconnected from invalid user  2.57.121.25 port 32099 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Dec 20 08:07:12 host2 sshd[809636]: Disconnected from invalid user wzy 172.173.117.246 port 53330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Dec 20 08:07:21 host2 sshd[809737]: Disconnected from invalid user git 154.83.15.123 port 45702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.173.117.246
country_id: 6252001
description:
Dec 20 08:08:38 host2 sshd[810696]: Disconnected from invalid user yq 172.173.117.246 port 41158 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.173.117.246
country_id: 6252001
description:
Dec 20 08:09:21 host2 sshd[811402]: Disconnected from invalid user ubuntu 172.173.117.246 port 44686 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-20 08:10:29 dovecot_login authenticator failed for (cm-84.211.13.171.get.no) [84.211.13.171]:60697: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-12-20 08:10:55 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:60382: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-12-20 08:11:12 dovecot_login authenticator failed for ([125.19.165.242]) [125.19.188.98]:59046: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-12-20 08:11:56 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:53736: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2025-12-20 08:12:24 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:56253: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 08:12:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<HizMJFlGzrE+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-12-20 08:12:36 dovecot_plain authenticator failed for ip-64-21-235-162.ideaone.net (ousts) [64.21.235.162]:38617: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 08:13:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<u9M1J1lGuIA+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 08:13:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<4qneKFlGfr0+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-20 08:15:40 dovecot_plain authenticator failed for (ancove) [65.20.164.137]:34812: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 08:17:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<HkTFN1lGHLo+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-20 08:18:41 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (begly) [76.145.10.140]:36918: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 08:23:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<40udSllG9NI+PIdm>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.180.251
country_id: 6252001
description:
[2025-12-20 08:25:17 +0530] info [cpaneld] 130.12.180.251 - colperla "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user colperla (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 08:26:19 host2 sshd[823852]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 20 08:26:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<v3ioV1lGGs8+PIdh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-12-20 08:29:48 dovecot_plain authenticator failed for (sahayna) [50.231.243.28]:44084: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.180.251
country_id: 6252001
description:
[2025-12-20 08:29:54 +0530] info [cpaneld] 130.12.180.251 - ceylondi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.19.154.158
country_id: 1269750
description:
[2025-12-20 08:31:15 +0530] info [webmaild] 125.19.154.158 - info@tfab.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 08:38:24 host2 sshd[833105]: Disconnected from invalid user  2.57.121.25 port 13703 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-20 08:38:37 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (matines) [73.168.136.150]:60662: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 08:41:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<V/uGi1lG9MoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 08:41:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<zpDNjFlGtIYDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-12-20 08:42:29 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:53271: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-12-20 08:43:00 dovecot_login authenticator failed for ([179.184.218.49]) [179.184.218.49]:52157: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 08:43:44 host2 pure-ftpd[836892]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-20 08:44:14 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:42449: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-12-20 08:44:27 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:39889: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.141
country_id: 6252001
description:
Dec 20 08:44:31 host2 pure-ftpd[837357]: (?@66.132.153.141) [INFO] New connection from 66.132.153.141


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 08:44:54 host2 sshd[837622]: Disconnected from invalid user  2.57.121.25 port 12960 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.101
country_id: 6252001
description:
Dec 20 08:45:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.101, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZwRvmVlGYdzN0h9l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 08:44:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<G2WClllGnOkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 08:45:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<TwZom1lGHNsDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 08:46:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<ig0dnllGPtwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.0
country_id: 798549
description:
Dec 20 08:46:37 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.0, lip=66.85.158.91, session=<T+4wn1lGJJdV2ZUA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 08:48:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<EbXgpFlG4NgDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-20 08:48:17 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (triel) [98.40.101.10]:35388: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2025-12-20 08:48:20 dovecot_plain authenticator failed for (squic) [105.72.176.66]:42586: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 08:50:29 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<WzEHrVlGhIMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-20 08:50:43 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (barthed) [98.227.25.115]:51652: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 08:52:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<J3m4sllGpqw+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.193
country_id: 6252001
description:
Dec 20 08:52:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.193, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EPy7tFlG9M/G6xjB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 08:52:42 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<e8D4tFlGUMgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 08:54:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<kkiNullG4uADiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-20 08:54:31 dovecot_plain authenticator failed for (cously) [12.150.243.22]:64623: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 08:55:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<kD48v1lGrII+PIdj>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.70.202
country_id: 1880251
description:
[2025-12-20 08:59:00 +0530] info [cpaneld] 159.223.70.202 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 20 08:59:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<t0HjzVlG3tg+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 20 09:00:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<rbyFz1lGgOY+PIco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 09:03:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<EecT3FlGatU+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 09:04:11 host2 sshd[853223]: Disconnected from invalid user keagan 62.60.131.157 port 8719 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-20 09:05:56 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:54098: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-20 09:06:14 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:43455: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.162
country_id: 1149361
description:
2025-12-20 09:08:05 dovecot_login authenticator failed for ([149.54.15.162]) [149.54.15.162]:39318: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-20 09:08:27 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:56563: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-20 09:09:06 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (upeidel) [71.62.34.216]:42634: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Dec 20 09:09:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.3, lip=66.85.158.91, TLS: Connection closed, session=<M6Lb8VlG6O1V2YwD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-20 09:10:36 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:46530: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.3
country_id: 798549
description:
Dec 20 09:10:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=85.217.140.3, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<LJ5b81lGxJNV2YwD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-12-20 09:15:56 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:35072: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.202.195.148
country_id: 6251999
description:
2025-12-20 09:16:46 dovecot_login authenticator failed for ([209.202.195.148]) [209.202.195.148]:43570: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 09:17:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<ZVzRC1pGQto+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-20 09:18:58 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (blatistry) [174.169.224.27]:53476: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-12-20 09:19:54 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:52506: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.217
country_id: 3144096
description:
2025-12-20 09:20:07 dovecot_login authenticator failed for (cm-84.211.13.217.get.no) [84.211.13.217]:60813: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.108
country_id: 290557
description:
2025-12-20 09:20:03 dovecot_plain authenticator failed for (hoess) [5.31.15.108]:57198: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-20 09:19:12 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:60102: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 09:19:17 host2 sshd[865150]: Disconnected from invalid user admin 2.57.121.25 port 38543 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-12-20 09:19:32 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:47218: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.177
country_id: 2264397
description:
Dec 20 09:19:39 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.177, lip=66.85.158.92, session=<Jo1bFVpGEawtnIGx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.115
country_id: 6252001
description:
Dec 20 09:20:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.115, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OVWNF1pGFhxChJlz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-20 09:21:38 dovecot_plain authenticator failed for (paphydia) [102.53.15.180]:44687: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.80.99.140
country_id: 6252001
description:
2025-12-20 09:22:09 dovecot_plain authenticator failed for ec2-3-80-99-140.compute-1.amazonaws.com (EC2AMAZ-Q00RJOJ.ec2.internal) [3.80.99.140]:57439: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 09:22:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<3N1QHlpG7Oc+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.80.99.140
country_id: 6252001
description:
2025-12-20 09:22:15 dovecot_login authenticator failed for ec2-3-80-99-140.compute-1.amazonaws.com (EC2AMAZ-Q00RJOJ.ec2.internal) [3.80.99.140]:57439: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 09:22:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<F18GH1pG6tg+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 20 09:22:49 host2 sshd[868041]: Disconnected from invalid user admin 123.58.209.224 port 59574 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 20 09:23:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<8iCaI1pGJLU+PIds>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 09:24:25 host2 sshd[869342]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.255.38.183
country_id: 6252001
description:
Dec 20 09:25:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@euroentertainmentlk.com>, method=PLAIN, rip=38.255.38.183, lip=66.85.158.91, session=<f3sYKVpGms8m/ya3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 09:26:13 host2 sshd[870684]: Disconnected from invalid user  2.57.121.25 port 34064 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 20 09:27:16 host2 sshd[871365]: Disconnected from invalid user botuser 123.58.209.224 port 40462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 20 09:28:27 host2 sshd[872104]: Disconnected from invalid user itadmin 123.58.209.224 port 60168 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.176
country_id: 6252001
description:
Dec 20 09:29:55 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.176, lip=66.85.158.92, TLS, session=<K30UOlpGfv7G6xiw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.80.99.140
country_id: 6252001
description:
2025-12-20 09:32:37 dovecot_plain authenticator failed for ec2-3-80-99-140.compute-1.amazonaws.com (EC2AMAZ-Q00RJOJ.ec2.internal) [3.80.99.140]:64507: 535 Incorrect authentication data (set_id= info@idesignvector.com )


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 20 09:32:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<BJVdRFpGAMo+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-20 09:34:03 dovecot_plain authenticator failed for 89-67-37-2.dynamic.play.pl (spatoxont) [89.67.37.2]:43896: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 09:37:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<vYRrU1pGorI+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.120.50
country_id: 1269750
description:
2025-12-20 09:37:48 dovecot_login authenticator failed for (nsg-static-89.234.75.182-airtel.com) [182.95.120.50]:40526: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.119
country_id: 2186224
description:
2025-12-20 09:38:06 dovecot_login authenticator failed for ([121.73.168.119]) [121.73.168.119]:49296: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.167.183
country_id: 2635167
description:
Dec 20 09:42:42 host2 sshd[883094]: Disconnected from invalid user useradmin 138.68.167.183 port 52360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.122
country_id: 1880251
description:
Dec 20 09:43:51 host2 sshd[884001]: Disconnected from invalid user ubuntu 45.78.201.122 port 33806 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 130.131.162.82
country_id: 6252001
description:
Dec 20 09:43:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=130.131.162.82, lip=66.85.158.91, session=<n1hhbFpGps2Cg6JS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-20 09:45:14 dovecot_plain authenticator failed for (deranter) [65.20.160.107]:55377: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 09:45:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<aVkXcVpGvtI+PIdj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 09:45:47 host2 pure-ftpd[886260]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-20 09:46:11 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (hypers) [24.15.216.41]:57154: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.167.183
country_id: 2635167
description:
Dec 20 09:47:27 host2 sshd[887417]: Disconnected from invalid user szy 138.68.167.183 port 35664 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 09:48:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<EoP+elpGLNQ+PIce>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.64.199.71
country_id: 6252001
description:
[2025-12-20 09:48:36 +0530] info [webmaild] 174.64.199.71 - info@anandaobauae.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.152.52.67
country_id: 6252001
description:
Dec 20 09:51:16 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=104.152.52.67, lip=66.85.158.91, session=<Y2BuhlpGIelomDRD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 20 09:51:24 host2 sshd[890702]: Disconnected from invalid user ociisstd 36.95.194.52 port 40164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 20 09:52:45 host2 sshd[891586]: Disconnected from invalid user jtribino 36.95.194.52 port 51680 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-20 09:52:59 dovecot_login authenticator failed for ([182.74.13.219]) [182.74.12.86]:52812: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.209.84
country_id: 3144096
description:
2025-12-20 09:53:14 dovecot_login authenticator failed for (cm-178.232.209.84.get.no) [178.232.209.84]:47222: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.180.251
country_id: 6252001
description:
[2025-12-20 09:54:07 +0530] info [cpaneld] 130.12.180.251 - cloudtou "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtou (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.194.52
country_id: 1643084
description:
Dec 20 09:54:35 host2 sshd[893644]: Disconnected from invalid user roman 36.95.194.52 port 57660 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 10:01:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<6hE9qVpGRKw+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 10:00:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<pFRzqFpGMMA+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 10:01:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<tOsqq1pG3OY+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.54
country_id: 3144096
description:
2025-12-20 10:03:17 dovecot_login authenticator failed for ([62.97.170.54]) [62.97.170.54]:33600: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 10:03:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<ZXr/sVpGDI4+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-12-20 10:03:42 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:48224: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.61
country_id: 6252001
description:
Dec 20 10:06:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.61, lip=66.85.158.92, TLS: Connection closed, session=<HYe2vFpGCKenXpI9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 10:07:21 host2 sshd[904504]: Disconnected from invalid user guest 2.57.121.25 port 42471 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 10:07:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<kDMTwFpGbqM+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-20 10:07:42 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (arming) [174.161.27.82]:35546: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-20 10:07:46 dovecot_plain authenticator failed for (adratusner) [199.192.123.12]:38298: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 20 10:08:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<LZo2xFpGQIM+PIdi>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.201.58.185
country_id: 6252001
description:
[2025-12-20 10:09:11 +0530] info [webmaild] 67.201.58.185 - info@lankaherbalsolutions.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 20 10:12:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<gSK+01pGRrM+PIdo>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 10:15:44 host2 sshd[911763]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 20 10:19:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<WbgH6lpGAOA+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 20 10:20:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<RYNt7VpGMu4+PIcc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 10:20:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<FJeE7VpGoLM+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 10:20:16 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ansing) [87.103.126.54]:32423: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-20 10:20:21 dovecot_plain authenticator failed for (subculle) [94.201.22.158]:44269: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.79
country_id: 6252001
description:
Dec 20 10:25:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=162.216.150.79, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<WSz8AVtGlNOi2JZP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.79
country_id: 6252001
description:
Dec 20 10:26:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.150.79, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<vBkNBFtG5vCi2JZP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 10:27:12 host2 sshd[919330]: Disconnected from invalid user bonnie 62.60.131.157 port 18443 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-12-20 10:30:02 dovecot_login authenticator failed for ([128.185.227.166]) [128.185.227.166]:51086: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-12-20 10:30:38 dovecot_login authenticator failed for ([182.73.109.194]) [182.73.109.194]:36166: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 10:34:02 host2 sshd[924171]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.127
country_id: 6252001
description:
Dec 20 10:33:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=91.230.168.127, lip=66.85.158.91, TLS handshaking: Connection closed, session=<WSGRHFtGF9Bb5qh/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.255
country_id: 6252001
description:
Dec 20 10:33:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.230.168.255, lip=66.85.158.91, TLS: Connection closed, session=<UsVMHVtG381b5qj/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.79
country_id: 6252001
description:
Dec 20 10:33:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.79, lip=66.85.158.92, TLS, session=<6fKFHVtGwv2i2JZP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 10:35:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<XNEhI1tGesQ+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 20 10:35:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<MvFJJVtG5so+PIcq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 20 10:39:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<KdWNMltGgMY+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-20 10:39:53 dovecot_plain authenticator failed for (gamet) [176.113.155.132]:59851: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-20 10:40:38 dovecot_login authenticator failed for ([200.148.171.233]) [189.56.0.19]:46069: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-20 10:40:21 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:43648: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-20 10:42:59 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (mendum) [73.176.157.57]:58020: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-12-20 10:45:14 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (collarking) [68.82.141.145]:46566: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 10:45:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<JcfrR1tG2sw+PIcd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 20 10:45:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, session=<sAlSSFtGOf/CpRCm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.63
country_id: 2635167
description:
Dec 20 10:45:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.211.63, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<okMwSVtGTdsjy9M/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 10:47:11 host2 sshd[935858]: Disconnected from invalid user admin 2.57.121.112 port 54991 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 10:47:57 host2 pure-ftpd[936359]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 10:48:36 host2 sshd[936855]: Disconnected from invalid user  2.57.121.25 port 37984 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.164.137
country_id: 99237
description:
2025-12-20 10:49:02 dovecot_plain authenticator failed for (undigers) [65.20.164.137]:48649: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-20 10:50:59 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (ganteopy) [24.23.125.83]:45932: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.63
country_id: 2635167
description:
Dec 20 10:51:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.63, lip=66.85.158.91, TLS, session=<OZc3XFtGrukjy9M/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 10:55:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<fF/Aa1tGmIY+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 11:02:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<dhNRhltGEpI+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:06:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<SXupkVtGnJcDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:06:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<0jafk1tG3pMDiUnd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 11:06:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=</E5RlFtGpM0+PIcf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 20 11:08:46 host2 sshd[958302]: Disconnected from invalid user elk 179.40.112.10 port 48258 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:08:51 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<HWHam1tGsuMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-20 11:09:31 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (canse) [73.129.57.71]:38076: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:09:30 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<+hY2nltGkOQDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 20 11:10:50 host2 sshd[960330]: Disconnected from invalid user jack 179.40.112.10 port 47032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 20 11:11:33 host2 sshd[960729]: Disconnected from invalid user wilson 179.40.112.10 port 60232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.40.112.10
country_id: 3865483
description:
Dec 20 11:12:14 host2 sshd[961093]: Disconnected from invalid user ftp-test 179.40.112.10 port 45198 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:12:21 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<MzhpqFtGescDiUnd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.172.63.91
country_id: 2635167
description:
[2025-12-20 11:12:34 +0530] info [cpaneld] 167.172.63.91 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 11:13:57 host2 sshd[962302]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:14:19 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<MmJzr1tGFooDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Dec 20 11:15:49 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<GYPEtFtGtLcDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.208.156.50
country_id: 241170
description:
Dec 20 11:16:00 host2 sshd[964152]: Disconnected from invalid user xray 185.208.156.50 port 40838 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 11:16:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Ud60uFtGRp0+PIcs>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.199.60.176
country_id: 1880251
description:
[2025-12-20 11:16:58 +0530] info [cpaneld] 138.199.60.176 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-20 11:17:56 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (pladerpred) [73.196.144.25]:46068: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.208.156.50
country_id: 241170
description:
Dec 20 11:19:08 host2 sshd[966362]: Received disconnect from 185.208.156.50 port 57162:11: Bye Bye [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.187.155.130
country_id: 6252001
description:
[2025-12-20 11:19:11 +0530] info [webmaild] 50.187.155.130 - info@saara.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.208.156.50
country_id: 241170
description:
Dec 20 11:19:40 host2 sshd[966671]: Disconnected from invalid user tacuser 185.208.156.50 port 54502 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.26.39.178
country_id: 1819730
description:
Dec 20 11:19:52 host2 sshd[966928]: Disconnected from invalid user jack 118.26.39.178 port 46314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.26.39.178
country_id: 1819730
description:
Dec 20 11:20:28 host2 sshd[967490]: Disconnected from invalid user elk 118.26.39.178 port 57210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-20 11:20:49 dovecot_plain authenticator failed for (fromass) [65.20.153.146]:41173: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 11:22:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<QchlzFtGUts+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.2
country_id: 1512440
description:
Dec 20 11:23:45 host2 sshd[969230]: Disconnected from invalid user frappe 194.107.115.2 port 20144 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.138.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 192.111.138.28 - info@epid.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.2
country_id: 1512440
description:
Dec 20 11:25:43 host2 sshd[970619]: Disconnected from invalid user user1 194.107.115.2 port 52852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-12-20 11:25:43 dovecot_plain authenticator failed for (canse) [41.248.243.181]:44602: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.97.155.25
country_id: 6252001
description:
2025-12-20 11:25:47 dovecot_plain authenticator failed for c-76-97-155-25.hsd1.ga.comcast.net (reques) [76.97.155.25]:49332: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 112.134.213.132
country_id: 1227603
description:
Dec 20 11:26:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=112.134.213.132, lip=66.85.158.91, TLS, session=<Ajvi2ltGc1xwhtWE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.254
country_id: 3017382
description:
Dec 20 11:27:10 host2 sshd[971546]: Disconnected from invalid user guestuser 51.91.98.254 port 45716 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.112
country_id: 6252001
description:
Dec 20 11:28:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.112, lip=66.85.158.92, session=<s5yE4ltGZPPG6xhw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.91.98.254
country_id: 3017382
description:
Dec 20 11:28:42 host2 sshd[972507]: Disconnected from invalid user mcserver 51.91.98.254 port 34376 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.91.98.254
country_id: 3017382
description:
Dec 20 11:29:11 host2 sshd[972884]: Disconnected from invalid user github 51.91.98.254 port 37810 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 20 11:29:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<4uHc5VtGPuk+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.243.106.218
country_id: 2802361
description:
2025-12-20 11:31:13 dovecot_plain authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be (priperse) [81.243.106.218]:50194: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2025-12-20 11:31:40 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:54210: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-20 11:32:00 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.74]:23724: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 20 11:32:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<rhHD8FtGVM7BHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 11:33:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<9nGh81tG9qI+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.12
country_id: 798549
description:
Dec 20 11:36:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.12, lip=66.85.158.91, session=<6fJt/1tGSMRV2ZUM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-12-20 11:37:18 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:54790: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-20 11:38:06 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:55052: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 11:41:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<JttKD1xGZKc+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.198
country_id: 6252001
description:
Dec 20 11:40:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.198, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<liqxDFxG4sTN0h/G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 11:42:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<abBTFFxGytU+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.62.224.44
country_id: 3017382
description:
2025-12-20 11:47:22 dovecot_plain authenticator failed for ftp-mutu001.plug-it.com (tormen) [185.62.224.44]:36526: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 11:49:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<VD+bK1xGZpY+PIcf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 11:50:02 host2 pure-ftpd[987213]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-20 11:55:36 dovecot_plain authenticator failed for (tairrac) [65.20.250.163]:55822: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 12:00:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<pL1aU1xG/OM+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 20 12:00:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<reJvVFxGKr8+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2025-12-20 12:02:34 dovecot_plain authenticator failed for (ables) [50.202.197.108]:33789: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 12:03:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<7CXyX1xGXKQ+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 12:03:52 host2 sshd[997161]: Disconnected from invalid user moth3r 2.57.121.25 port 34484 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 12:05:21 host2 sshd[998352]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 12:05:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<Ue3vZlxGnKI+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 12:07:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<PMZObVxGcKg+PIdp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 12:10:49 host2 sshd[1002616]: Disconnected from invalid user  2.57.121.25 port 37962 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.7
country_id: 2750405
description:
Dec 20 12:13:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=31.14.32.7, lip=66.85.158.91, session=<2iLlglxGBpofDiAH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 20 12:13:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<SVzgglxGff7CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 12:14:25 host2 sshd[1005766]: Disconnected from invalid user admin 2.57.121.112 port 60685 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-20 12:15:52 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (calas) [73.197.194.98]:33508: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-20 12:18:48 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:54381: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2025-12-20 12:19:17 dovecot_login authenticator failed for ([125.23.243.66]) [125.23.41.122]:35752: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2025-12-20 12:21:13 dovecot_plain authenticator failed for (quely) [37.25.36.197]:60689: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-12-20 12:22:03 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (beaticits) [69.123.219.82]:37479: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 12:24:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<WRSZqVxGqOE+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 20 12:25:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, session=<7ATFrlxGTP7CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 20 12:27:53 host2 sshd[1017879]: Disconnected from invalid user git 45.121.147.47 port 57464 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.53
country_id: 6252001
description:
Dec 20 12:28:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.53, lip=66.85.158.92, TLS: Connection closed, session=<QK9VuVxGwD+nXpI1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-20 12:29:22 dovecot_plain authenticator failed for (memism) [65.20.129.28]:60599: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 12:29:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<cQrGvVxGnpI+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 12:30:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<NTU+v1xGhOw+PIcs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 20 12:30:52 host2 sshd[1020154]: Disconnected from invalid user fmaster 23.242.166.38 port 54700 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.121.147.47
country_id: 1733045
description:
Dec 20 12:32:07 host2 sshd[1021033]: Disconnected from invalid user simone 45.121.147.47 port 56186 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-20 12:32:09 dovecot_login authenticator failed for 2.135.31.74.dynamic.telecom.kz [2.135.31.74]:60223: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2025-12-20 12:32:46 dovecot_login authenticator failed for ([125.19.218.50]) [125.19.218.50]:36596: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 12:32:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<MBRyxlxGZqA+PIcd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.180.251
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 130.12.180.251 - dragon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-20 12:34:55 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:52988: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.43.162
country_id: 3686110
description:
2025-12-20 12:35:08 dovecot_login authenticator failed for ([190.85.43.162]) [190.85.43.162]:45052: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 20 12:36:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<i9A/1VxGEsw+PIds>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 20 12:37:46 host2 sshd[1025023]: Disconnected from invalid user reza 72.144.12.31 port 36726 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 20 12:38:22 host2 sshd[1025415]: Disconnected from invalid user alan 72.144.12.31 port 49266 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 20 12:38:17 host2 sshd[1025340]: Disconnected from invalid user magento 23.242.166.38 port 49326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.242.166.38
country_id: 6252001
description:
Dec 20 12:39:23 host2 sshd[1025994]: Disconnected from invalid user farhan 23.242.166.38 port 52304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 12:40:03 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (oconis) [87.103.126.54]:45760: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 20 12:40:35 host2 sshd[1027106]: Received disconnect from 72.144.12.31 port 37516:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 72.144.12.31
country_id: 2921044
description:
Dec 20 12:41:43 host2 sshd[1027783]: Disconnected from invalid user fmaster 72.144.12.31 port 54472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 12:45:00 host2 sshd[1029904]: Disconnected from invalid user user 2.57.121.25 port 46440 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 12:49:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<6eE3Al1GTr4+PIde>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 20 12:51:29 host2 sshd[1034390]: Disconnected from invalid user teamspeak3 125.21.59.218 port 35320 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 12:51:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<BpX3Cl1GupE+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 12:51:39 host2 sshd[1034523]: Disconnected from invalid user  2.57.121.25 port 30580 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 12:52:01 host2 pure-ftpd[1034815]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.59.218
country_id: 1269750
description:
Dec 20 12:53:48 host2 sshd[1035807]: Disconnected from invalid user mata 125.21.59.218 port 55346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 20 12:56:07 host2 sshd[1038561]: Disconnected from invalid user estest 196.189.124.195 port 57148 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.124.195
country_id: 337996
description:
Dec 20 12:59:07 host2 sshd[1041116]: Disconnected from invalid user ubuntu 196.189.124.195 port 34290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Dec 20 13:02:02 host2 sshd[1043685]: Disconnected from invalid user payam 196.189.124.195 port 59918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 13:02:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<bmo9Ml1GQLY+PIM0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 13:03:35 host2 sshd[1045416]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 20 13:05:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<62acPF1GZNvPWvQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.81.232.29
country_id: 2264397
description:
Dec 20 13:11:07 host2 sshd[1052444]: Disconnected from invalid user admin 188.81.232.29 port 45564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-20 13:12:07 dovecot_plain authenticator failed for (grousing) [176.113.155.132]:47701: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 13:12:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<MAI4Vl1G0Nk+PIdm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 20 13:12:53 host2 sshd[1053705]: Disconnected from invalid user admin 115.85.80.12 port 33824 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 13:13:34 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 20 13:16:48 host2 sshd[1056508]: Disconnected from invalid user tjones 115.85.80.12 port 44298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 20 13:17:27 host2 sshd[1057079]: Disconnected from invalid user test2 115.85.80.12 port 34222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.81.232.29
country_id: 2264397
description:
Dec 20 13:18:38 host2 sshd[1057798]: Disconnected from invalid user demo 188.81.232.29 port 35784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.85.80.12
country_id: 1643084
description:
Dec 20 13:18:48 host2 sshd[1057898]: Disconnected from invalid user test2 115.85.80.12 port 59924 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.81.232.29
country_id: 2264397
description:
Dec 20 13:19:32 host2 sshd[1058463]: Disconnected from invalid user admin 188.81.232.29 port 44434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.81.232.29
country_id: 2264397
description:
Dec 20 13:21:17 host2 sshd[1059971]: Disconnected from invalid user user1 188.81.232.29 port 54932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 13:21:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<zBkLdl1GoIc+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 13:21:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<qMZddl1GILQ+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 13:22:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<0Oh5el1GOJs+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-20 13:26:30 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:33494: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.18
country_id: 6252001
description:
Dec 20 13:27:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.18, lip=66.85.158.91, session=<ZnDail1GCuSTuYQS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-12-20 13:27:20 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:56730: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 20 13:29:36 host2 sshd[1065136]: Disconnected from invalid user git 92.191.96.115 port 47946 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-20 13:29:58 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (bectroali) [73.171.230.200]:55114: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Dec 20 13:31:57 host2 sshd[1066928]: Disconnected from invalid user hdoop 156.238.252.133 port 42386 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-20 13:31:42 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (thiss) [68.52.119.193]:38844: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 20 13:33:05 host2 sshd[1067904]: Disconnected from invalid user tunnel 92.191.96.115 port 56932 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.100
country_id: 3144096
description:
2025-12-20 13:33:12 dovecot_login authenticator failed for (cm-84.213.191.100.get.no) [84.213.191.100]:48004: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 13:32:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<2wq/nF1Gzpc+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 20 13:32:29 host2 sshd[1067432]: Disconnected from invalid user nodered 92.191.96.115 port 3938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.28
country_id: 3996063
description:
2025-12-20 13:32:57 dovecot_login authenticator failed for (189.219.138.28-clientes-izzi.mx) [189.219.138.28]:35225: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Dec 20 13:34:25 host2 sshd[1068981]: Disconnected from invalid user admin 156.238.252.133 port 48866 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 13:34:50 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (lishoely) [87.103.126.54]:22885: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.238.252.133
country_id: 241170
description:
Dec 20 13:36:05 host2 sshd[1070582]: Disconnected from invalid user admin 156.238.252.133 port 42850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.191.96.115
country_id: 2510769
description:
Dec 20 13:35:25 host2 sshd[1069915]: Disconnected from invalid user dev 92.191.96.115 port 41962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Dec 20 13:35:33 host2 sshd[1070052]: Disconnected from invalid user ubuntu 156.238.252.133 port 38442 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-20 13:36:55 dovecot_login authenticator failed for 40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:42752: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-20 13:37:13 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:46651: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 13:36:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<c6u9rF1G5KE+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Dec 20 13:38:18 host2 sshd[1071884]: Disconnected from invalid user oem 156.238.252.133 port 51606 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 13:38:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<r+Tds11GQMU+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-12-20 13:43:46 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:47424: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-12-20 13:44:05 dovecot_login authenticator failed for ([203.193.147.37]) [203.193.147.37]:61088: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.159.184.22
country_id: 798544
description:
Dec 20 13:44:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=93.159.184.22, lip=66.85.158.91, TLS, session=<WDHTxl1GVqVdn7gW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.139
country_id: 3175395
description:
Dec 20 13:44:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.15.171.139, lip=66.85.158.91, TLS, session=<KnHVxl1G+sS5D6uL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.94
country_id: 3175395
description:
Dec 20 13:44:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.197.9.94, lip=66.85.158.91, TLS, session=<JGx2x11Ga865xQle>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.110.41
country_id: 798544
description:
Dec 20 13:44:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=85.202.110.41, lip=66.85.158.91, TLS, session=<s1Dox11GucxVym4p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.133
country_id: 3865483
description:
Dec 20 13:44:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers>, method=PLAIN, rip=190.181.101.133, lip=66.85.158.91, TLS, session=<eZT1x11Gs5q+tWWF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.198
country_id: 3175395
description:
Dec 20 13:44:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=185.15.171.198, lip=66.85.158.91, TLS, session=<oFTVxl1GVp25D6vG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.237
country_id: 3469034
description:
Dec 20 13:44:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=191.53.107.237, lip=66.85.158.91, TLS, session=<vhn3x11GiZm/NWvt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.150
country_id: 3469034
description:
Dec 20 13:44:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers>, method=PLAIN, rip=177.44.71.150, lip=66.85.158.91, TLS, session=<oIOWyF1G6pyxLEeW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 20 13:47:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<BDw30l1GioQ+PIdg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.193
country_id: 1210997
description:
Dec 20 13:49:36 host2 sshd[1080317]: Disconnected from invalid user ubuntu 103.172.112.193 port 50090 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 13:49:47 host2 sshd[1080437]: Disconnected from invalid user martina 62.60.131.157 port 9227 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 13:49:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<J+Tp211GdrU+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 20 13:50:12 host2 sshd[1081134]: Disconnected from invalid user logstash 101.36.120.76 port 47944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 20 13:50:43 host2 sshd[1081708]: Disconnected from invalid user deploy 198.98.56.227 port 36474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 20 13:51:54 host2 sshd[1083153]: Disconnected from invalid user newuser 198.98.56.227 port 33018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 20 13:51:18 host2 sshd[1082499]: Disconnected from invalid user admin 198.98.56.227 port 48862 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 13:51:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<xcQS4l1Gfsc+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 13:52:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<CgGm5F1GeqE+PIcg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 13:55:03 host2 sshd[1087941]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 20 13:54:53 host2 sshd[1087572]: Disconnected from invalid user ubuntu 101.36.120.76 port 36122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2025-12-20 13:55:15 dovecot_login authenticator failed for ([125.19.173.189]) [182.95.181.166]:34394: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.4
country_id: 1643084
description:
Dec 20 13:55:18 host2 sshd[1088273]: Disconnected from invalid user ryan 103.172.204.4 port 38960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-20 13:55:37 dovecot_login authenticator failed for ([49.0.40.238]) [49.0.40.238]:34342: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.214.145
country_id: 1562822
description:
Dec 20 13:55:54 host2 sshd[1089080]: Disconnected from invalid user patrol 165.154.214.145 port 40472 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.4
country_id: 1643084
description:
Dec 20 13:56:05 host2 sshd[1089404]: Disconnected from invalid user ganesh 103.172.204.4 port 60922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 13:56:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<nRtR9F1GGpk+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-20 13:58:10 dovecot_login authenticator failed for ([178.232.30.170]) [178.232.30.170]:60837: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.214.145
country_id: 1562822
description:
Dec 20 13:57:19 host2 sshd[1090829]: Disconnected from invalid user gateway 165.154.214.145 port 53844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Dec 20 13:57:24 host2 sshd[1090909]: Disconnected from invalid user ubuntu 81.215.228.18 port 48754 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.220.210
country_id: 2403846
description:
2025-12-20 13:58:00 dovecot_login authenticator failed for ([196.216.220.210]) [196.216.220.210]:60115: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Dec 20 13:58:30 host2 sshd[1092341]: Disconnected from invalid user logstash 81.215.228.18 port 44848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 20 14:00:53 host2 sshd[1095613]: Disconnected from invalid user webapp 101.36.120.76 port 51186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 20 14:02:56 host2 sshd[1098391]: Disconnected from invalid user ubuntu 101.36.120.76 port 49658 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.120.76
country_id: 1819730
description:
Dec 20 14:03:49 host2 sshd[1099255]: Disconnected from invalid user andrew 101.36.120.76 port 52510 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 14:07:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<jXEoGV5Gmpw+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-12-20 14:06:42 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:37638: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-12-20 14:06:58 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:36575: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-20 14:09:35 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (terom) [76.16.7.82]:38122: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2025-12-20 14:11:18 dovecot_plain authenticator failed for (joing) [46.35.178.104]:38454: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 14:11:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<iyB1KV5Giuo+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 14:13:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<5Zu+Ll5GwNk+PIcf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.172.63.91
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 167.172.63.91 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 14:15:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<LFW4Nl5GzJMDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-20 14:17:16 dovecot_login authenticator failed for (187.161.213.35-clientes-izzi.mx) [187.161.213.35]:45738: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 14:18:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<pbhOQV5GHuI+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-12-20 14:17:40 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:46188: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 14:17:46 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<MneEP15GaoUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 14:19:39 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<rSY6Rl5GCJsDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 14:19:39 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<Ask+Rl5GApsDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-20 14:20:51 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (sochastry) [98.222.93.199]:54458: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-20 14:25:19 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (turoitch) [67.173.58.47]:41228: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 14:25:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<0ayKW15GpOc+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-20 14:30:11 dovecot_login authenticator failed for (nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:54486: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.191
country_id: 3996063
description:
2025-12-20 14:29:48 dovecot_login authenticator failed for ([177.236.146.191]) [177.236.146.191]:41126: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-20 14:30:05 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (mastic) [98.193.112.85]:40814: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 14:30:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<snSPbl5GbLk+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-20 14:31:58 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (mogently) [73.197.236.163]:49626: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2025-12-20 14:32:50 dovecot_plain authenticator failed for (cutoraty) [199.192.123.12]:58864: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-20 14:34:09 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (nouts) [71.62.34.216]:35884: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.199.23
country_id: 6252001
description:
Dec 20 14:33:35 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.199.23, lip=66.85.158.91, session=<0n0ReF5GPtlHBscX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.199.23
country_id: 6252001
description:
Dec 20 14:33:35 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.199.23, lip=66.85.158.91, session=<LXYTeF5G4tlHBscX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-20 14:34:29 dovecot_login authenticator failed for (nsg-corporate-185.188.186.122.airtel.in) [182.95.178.158]:41658: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-12-20 14:34:30 dovecot_login authenticator failed for (ADMIN) [23.132.164.25]:58246: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 14:34:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<UzBxfF5GqKQ+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-12-20 14:35:12 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:55159: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-20 14:36:12 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (reely) [24.98.45.238]:58520: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 14:36:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<SN4FgV5GUsE+PIMp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 14:38:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<mqcTiV5GVJE+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-20 14:42:47 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (camphom) [73.171.230.200]:48655: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-12-20 14:43:08 dovecot_login authenticator failed for ([103.120.116.162]) [103.120.116.162]:57469: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-12-20 14:43:24 dovecot_login authenticator failed for (c-50-187-155-130.unallocated.comcastbusiness.net) [50.187.155.130]:44549: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 14:43:43 host2 sshd[1136105]: Disconnected from invalid user  2.57.121.25 port 46666 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.17
country_id: 798549
description:
Dec 20 14:47:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.17, lip=66.85.158.91, TLS: Connection closed, session=<EsWlqV5G+uRV2YwR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 20 14:52:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<wgezul5GrLg+PIdr>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 14:53:28 host2 sshd[1144595]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-12-20 14:55:50 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (acharible) [73.195.211.98]:36182: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 14:56:03 host2 pure-ftpd[1146957]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-20 14:57:10 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (pizemus) [73.13.220.220]:44518: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-20 14:57:20 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:55147: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-20 14:57:47 dovecot_login authenticator failed for (cm-84.213.188.130.get.no) [84.213.188.130]:43875: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.62
country_id: 1149361
description:
2025-12-20 14:58:17 dovecot_login authenticator failed for ([149.54.62.62]) [149.54.62.62]:60422: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-20 14:59:10 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2025-12-20 14:58:46 dovecot_login authenticator failed for ([46.210.94.61]) [46.210.94.61]:46152: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-20 15:00:18 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:34312: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.18
country_id: 798549
description:
Dec 20 14:59:37 host2 pure-ftpd[1148862]: (?@85.217.149.18) [INFO] New connection from 85.217.149.18


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.18
country_id: 798549
description:
Dec 20 14:59:46 host2 pure-ftpd[1148952]: (?@85.217.149.18) [INFO] New connection from 85.217.149.18


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 14:59:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<xMjW1V5G+uE+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.28.18
country_id: 1168579
description:
2025-12-20 15:01:05 dovecot_login authenticator failed for ([210.56.28.18]) [210.56.28.18]:38071: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2025-12-20 15:01:11 dovecot_login authenticator failed for ([122.160.137.230]) [122.160.137.230]:37110: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2025-12-20 15:01:26 dovecot_login authenticator failed for ([182.95.181.166]) [182.95.181.166]:40412: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 15:02:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<zVL94F5GDME+PIMh>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.60.171.8
country_id: 1694008
description:
[2025-12-20 15:03:40 +0530] info [cpaneld] 103.60.171.8 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 20 15:05:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=</YPv6V5GqqIDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 20 15:07:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<A4G38l5GTsk+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 20 15:08:02 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<AVRC815GQuIDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 15:08:26 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (fellca) [87.103.126.54]:28220: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.146.184.19
country_id: 6252001
description:
2025-12-20 15:09:20 dovecot_plain authenticator failed for (ingir) [23.146.184.19]:55102: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 20 15:10:00 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<quBO+l5GkOsDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 20 15:12:19 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<O6aPAl9Ggt8DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 20 15:13:40 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<qv5sB19GApoDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-20 15:13:46 dovecot_plain authenticator failed for (ansacke) [65.20.184.80]:35614: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 15:13:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<qv4mCF9GwqI+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-12-20 15:19:31 dovecot_plain authenticator failed for c-73-0-191-33.hsd1.fl.comcast.net (momoch) [73.0.191.33]:45972: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.5.248
country_id: 3175395
description:
2025-12-20 15:21:34 dovecot_plain authenticator failed for host-95-229-5-248.business.telecomitalia.it (othly) [95.229.5.248]:56906: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 15:28:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=</1KdPF9GANE+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 20 15:28:56 host2 sshd[1170223]: Disconnected from invalid user dmdba 102.176.81.29 port 48846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 20 15:30:18 host2 sshd[1171837]: Disconnected from invalid user ubuntu 102.176.81.29 port 40164 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 20 15:31:01 host2 sshd[1172530]: Disconnected from invalid user admin 102.176.81.29 port 53960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.19.63
country_id: 2510769
description:
Dec 20 15:32:09 host2 sshd[1173915]: Disconnected from invalid user newuser 79.112.19.63 port 39224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.24.143
country_id: 3144096
description:
2025-12-20 15:32:39 dovecot_login authenticator failed for (cm-84.211.24.143.get.no) [84.211.24.143]:45472: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-12-20 15:33:50 dovecot_plain authenticator failed for c-73-0-191-33.hsd1.fl.comcast.net (resmopale) [73.0.191.33]:59320: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.92
country_id: 130758
description:
Dec 20 15:34:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.92, lip=66.85.158.91, session=<3aUYUF9Gjo8+PIdc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 20 15:34:19 host2 sshd[1176043]: Disconnected from invalid user pc 102.176.81.29 port 38374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.140
country_id: 3144096
description:
2025-12-20 15:33:23 dovecot_login authenticator failed for ([84.211.10.140]) [84.211.10.140]:41637: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-20 15:33:48 dovecot_plain authenticator failed for (nophom) [65.20.149.93]:38542: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 20 15:36:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<ISkmWV9Gwsw+PIdp>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 61.1.105.105
country_id: 1269750
description:
[2025-12-20 15:39:51 +0530] info [webmaild] 61.1.105.105 - info@casa18villa.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 20 15:40:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<aMDLZl9GdqI+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 20 15:41:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<sr/9a19GfKs+PIdn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 15:45:06 host2 sshd[1187638]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 20 15:46:32 host2 sshd[1189384]: Disconnected from invalid user coco 43.155.21.198 port 48242 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 20 15:47:11 host2 sshd[1190058]: Disconnected from invalid user magento 43.155.21.198 port 42304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.155.21.198
country_id: 1819730
description:
Dec 20 15:50:13 host2 sshd[1193259]: Disconnected from invalid user mapadmin 43.155.21.198 port 50042 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 15:51:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<UaDfjV9Giq8+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 20 15:52:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<jbQikl9GrP7CpRCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 15:53:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<lhqwll9Gupg+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 15:55:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<d1gzm19GcN4+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.175.118.185
country_id: 2510769
description:
Dec 20 15:55:04 host2 sshd[1197736]: Disconnected from invalid user jack 34.175.118.185 port 37962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 20 15:54:44 host2 sshd[1197362]: Disconnected from invalid user marvin 45.61.187.30 port 45664 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 20 15:55:37 host2 sshd[1198163]: Disconnected from invalid user aaron 45.61.187.30 port 57790 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 15:56:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<xOHZnl9GQJE+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Dec 20 15:56:29 host2 sshd[1198915]: Disconnected from invalid user pos 45.61.187.30 port 41684 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.175.118.185
country_id: 2510769
description:
Dec 20 15:56:56 host2 sshd[1199260]: Disconnected from invalid user hyperic 34.175.118.185 port 34882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.175.118.185
country_id: 2510769
description:
Dec 20 15:57:34 host2 sshd[1199745]: Disconnected from invalid user jacques 34.175.118.185 port 46952 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 15:58:09 host2 pure-ftpd[1200159]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.175.118.185
country_id: 2510769
description:
Dec 20 15:58:11 host2 sshd[1200167]: Disconnected from invalid user sign 34.175.118.185 port 58908 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-12-20 15:58:27 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:42748: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-20 15:58:59 dovecot_login authenticator failed for ([125.19.196.207]) [27.123.104.142]:42786: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 20 16:01:41 host2 sshd[1202808]: Disconnected from invalid user zach 152.32.172.161 port 38566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-20 16:02:18 dovecot_plain authenticator failed for (swofoice) [176.113.155.132]:50088: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-20 16:02:30 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:46880: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-20 16:02:41 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:59078: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 16:02:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<pcuNtl9GNM0+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-20 16:02:58 dovecot_login authenticator failed for (210-167-97-62.cust.smartcall.no) [62.97.167.210]:37263: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 16:03:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<+0biuV9GQt8+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 16:06:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<DxwIxV9GgOA+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-20 16:08:07 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (pressous) [81.225.30.107]:47920: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.177
country_id: 1733045
description:
2025-12-20 16:09:02 dovecot_login authenticator failed for ([49.124.155.177]) [49.124.155.177]:60890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-20 16:09:05 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:38920: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-12-20 16:09:06 dovecot_plain authenticator failed for (difily) [65.20.184.80]:46734: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-20 16:09:52 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:56174: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 16:10:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<jPSd0V9GhsY+PIdl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 16:10:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<+FbB019Gho8+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-20 16:10:59 dovecot_login authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:57260: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-20 16:10:35 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:49284: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 16:11:42 host2 sshd[1212362]: Disconnected from invalid user  2.57.121.25 port 47147 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 16:13:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<qN8Z3V9G9L0+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-20 16:14:48 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (triad) [73.197.194.98]:41192: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 16:15:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Rwvr4l9G1qQ+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.114
country_id: 1269750
description:
2025-12-20 16:16:55 dovecot_login authenticator failed for ([182.78.120.220]) [182.95.49.114]:48202: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-12-20 16:16:59 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (isandae) [50.74.136.134]:33802: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-20 16:16:37 dovecot_plain authenticator failed for (uniummathy) [103.51.26.198]:60527: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-20 16:17:25 dovecot_login authenticator failed for ([128.185.101.201]) [122.185.146.18]:36296: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-20 16:19:00 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (arilicceal) [174.166.153.20]:46152: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-20 16:20:05 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:37135: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-20 16:20:17 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:60795: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-20 16:21:35 dovecot_login authenticator failed for ([182.95.58.62]) [182.95.58.62]:47662: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.217.74
country_id: 3996063
description:
2025-12-20 16:22:29 dovecot_login authenticator failed for (201.173.217.74-clientes-izzi.mx) [201.173.217.74]:46292: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-12-20 16:27:15 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (sufromy) [73.145.107.251]:41048: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2025-12-20 16:35:02 dovecot_plain authenticator failed for (peysehed) [176.113.155.132]:48005: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 20 16:38:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<JWKSNWBGIrM+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-12-20 16:38:13 dovecot_login authenticator failed for ([118.26.153.84]) [118.26.153.84]:23242: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 16:38:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<+8qtNWBGiKw+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:37:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5u6eM2BGlqQDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-20 16:37:46 dovecot_plain authenticator failed for (ephise) [91.73.195.150]:58539: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.19.200.63
country_id: 660013
description:
2025-12-20 16:38:41 dovecot_login authenticator failed for ([146.19.200.63]) [146.19.200.63]:39510: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:39:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<LOzGOmBG9LIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:41:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mWvuQGBGFu4DhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 16:42:13 host2 sshd[1238523]: Disconnected from invalid user ubnt 2.57.121.25 port 9189 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:41:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<SQSPQWBG1LsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:43:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5FEKR2BG8OcDhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 16:43:46 host2 sshd[1239362]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:43:35 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<2n4CSWBGbNoDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-12-20 16:44:07 dovecot_login authenticator failed for (177-215-153-215.user.vivozap.com.br) [189.56.0.19]:48450: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-20 16:44:22 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:55708: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:45:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<VFJpUWBG/IIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:46:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zD1cVGBGHoADhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 20 16:48:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<YPjlWGBGwskDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 16:48:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<inuRWmBGApU+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.30
country_id: 3017382
description:
Dec 20 16:48:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.30, lip=66.85.158.91, TLS handshaking: Connection closed, session=<MnrHWmBGhZhb51ke>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.219
country_id: 3017382
description:
Dec 20 16:48:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.231.89.219, lip=66.85.158.91, TLS: Connection closed, session=<WxRlW2BGrZtb51nb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.216
country_id: 3017382
description:
Dec 20 16:48:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.216, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ws/iW2BG+epb51nY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.26
country_id: 3017382
description:
Dec 20 16:48:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.26, lip=66.85.158.91, TLS: Connection closed, session=<AdsSXGBGi+db51ka>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 16:53:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<L4rea2BGXtQ+PIdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.171.155.54
country_id: 6252001
description:
Dec 20 16:58:08 host2 sshd[1249623]: Disconnected from invalid user vector 34.171.155.54 port 53008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.211
country_id: 226074
description:
Dec 20 16:59:52 host2 sshd[1250437]: Disconnected from invalid user nokia 196.0.120.211 port 57618 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 17:00:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<ZRllhGBGVqQ+PIdf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 17:00:22 host2 pure-ftpd[1250957]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.150
country_id: 6252001
description:
Dec 20 17:01:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.150, lip=66.85.158.92, TLS: Connection closed, session=<dE83imBGLOnHLZqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 17:03:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<PErjjmBGqI4+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-20 17:03:59 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:35712: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-12-20 17:04:35 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:51826: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.171.155.54
country_id: 6252001
description:
Dec 20 17:04:52 host2 sshd[1253502]: Disconnected from invalid user app 34.171.155.54 port 57792 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 20 17:06:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<+btgmWBGHuXBHmEh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.171.155.54
country_id: 6252001
description:
Dec 20 17:06:43 host2 sshd[1255173]: Disconnected from invalid user systems 34.171.155.54 port 40296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.171.155.54
country_id: 6252001
description:
Dec 20 17:07:29 host2 sshd[1255762]: Disconnected from invalid user maha 34.171.155.54 port 51582 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 20 17:08:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<6RxWomBGENE+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 17:10:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (colingles) [87.103.126.54]:11868: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-20 17:11:06 dovecot_plain authenticator failed for (blecrati) [65.20.153.146]:60881: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.161.42
country_id: 1210997
description:
2025-12-20 17:10:48 dovecot_login authenticator failed for (103-48-161-42.Dhaka.carnival.com.bd) [103.48.161.42]:49768: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 20 17:12:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<ipcdsGBGQJc+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-20 17:15:07 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:57930: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.220.147
country_id: 3144096
description:
2025-12-20 17:15:29 dovecot_login authenticator failed for (cm-178.232.220.147.get.no) [178.232.220.147]:47946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.219.80
country_id: 3144096
description:
2025-12-20 17:15:45 dovecot_login authenticator failed for ([84.210.219.80]) [84.210.219.80]:41079: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 17:18:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<KNMYxGBGKIs+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-12-20 17:18:10 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:54323: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-12-20 17:18:00 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:58390: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 20 17:20:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<xCPYy2BGMtM+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 17:21:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<GRo30mBGeKQ+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-20 17:22:15 dovecot_plain authenticator failed for (antion) [65.20.129.28]:58666: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 17:23:55 host2 sshd[1267560]: Disconnected from invalid user  2.57.121.25 port 18480 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 17:25:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<CYBj4GBGiKI+PIcl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.224.106.229
country_id: 1694008
description:
[2025-12-20 17:26:29 +0530] info [whostmgrd] 64.224.106.229 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 17:27:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Ikhs5mBGSqQ+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-12-20 17:28:30 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:56948: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-20 17:28:44 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:56421: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 17:30:47 host2 sshd[1272748]: Disconnected from invalid user  2.57.121.25 port 36597 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Dec 20 17:31:17 host2 sshd[1273102]: Disconnected from invalid user francois 45.78.223.11 port 42184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 20 17:32:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<5+hT92BGGrc+PIdn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.115.13.62
country_id: 6252001
description:
Dec 20 17:31:35 host2 sshd[1273286]: Disconnected from invalid user debian 136.115.13.62 port 44112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.11
country_id: 1880251
description:
Dec 20 17:32:37 host2 sshd[1273999]: Disconnected from invalid user pp 45.78.223.11 port 51854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 20 17:32:47 host2 sshd[1274103]: Disconnected from invalid user update 189.50.142.82 port 39623 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 20 17:34:23 host2 sshd[1275151]: Disconnected from invalid user noc 189.50.142.82 port 45721 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-20 17:34:24 dovecot_plain authenticator failed for (sclaeau) [65.20.149.93]:54980: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.115.13.62
country_id: 6252001
description:
Dec 20 17:35:15 host2 sshd[1275831]: Disconnected from invalid user lia 136.115.13.62 port 60948 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 17:35:32 host2 sshd[1276064]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.50.142.82
country_id: 3469034
description:
Dec 20 17:35:57 host2 sshd[1276332]: Disconnected from invalid user dana 189.50.142.82 port 53866 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 17:36:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<vGb+BGFG0No+PIdl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-20 17:37:04 dovecot_plain authenticator failed for (matchore) [65.20.174.63]:41964: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.226.247.21
country_id: 1861060
description:
Dec 20 17:36:55 host2 sshd[1277131]: Disconnected from invalid user rabbit 74.226.247.21 port 1024 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 17:38:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<vjPLC2FGsts+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.226.247.21
country_id: 1861060
description:
Dec 20 17:38:13 host2 sshd[1278182]: Disconnected from invalid user cmsuser 74.226.247.21 port 1024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 20 17:38:44 host2 sshd[1278488]: Disconnected from invalid user abel 192.210.233.234 port 38082 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.226.247.21
country_id: 1861060
description:
Dec 20 17:38:51 host2 sshd[1278566]: Disconnected from invalid user abel 74.226.247.21 port 1025 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.226.247.21
country_id: 1861060
description:
Dec 20 17:39:29 host2 sshd[1278936]: Disconnected from invalid user alexis 74.226.247.21 port 1026 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-12-20 17:41:02 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:37720: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.68.114
country_id: 6252001
description:
2025-12-20 17:40:46 dovecot_plain authenticator failed for c-98-227-68-114.hsd1.il.comcast.net ([31.57.166.48]) [98.227.68.114]:59418: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-20 17:41:14 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:36528: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.188.109.206
country_id: 2378080
description:
2025-12-20 17:40:26 dovecot_plain authenticator failed for ([31.57.166.48]) [41.188.109.206]:30505: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.8.164.76
country_id: 3625428
description:
2025-12-20 17:40:37 dovecot_plain authenticator failed for ([31.57.166.48]) [190.8.164.76]:58354: 535 Incorrect authentication data (set_id=info@host2.phenomhost.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 20 17:40:37 host2 sshd[1279854]: Disconnected from invalid user design 200.91.236.125 port 49920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-20 17:42:10 dovecot_plain authenticator failed for (faysopaits) [102.53.15.18]:60118: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.91.236.125
country_id: 3686110
description:
Dec 20 17:41:46 host2 sshd[1280569]: Disconnected from invalid user martyn 200.91.236.125 port 35835 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.207.164
country_id: 1643084
description:
Dec 20 17:42:40 host2 sshd[1281097]: Disconnected from invalid user tmp 103.13.207.164 port 55980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 20 17:42:59 host2 sshd[1281265]: Disconnected from invalid user sgeadmin 192.210.233.234 port 34632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 20 17:43:32 host2 sshd[1281565]: Disconnected from invalid user system 192.210.233.234 port 49214 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 20 17:44:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<ieDaImFGvIs+PIcs>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.207.164
country_id: 1643084
description:
Dec 20 17:44:40 host2 sshd[1282381]: Disconnected from invalid user ldap 103.13.207.164 port 60120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-20 17:45:53 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (shared) [73.224.171.101]:57128: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-20 17:47:34 dovecot_plain authenticator failed for (shiceasa) [75.97.190.237]:58226: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-20 17:47:44 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (spolinize) [73.196.144.25]:60742: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.101
country_id: 130758
description:
Dec 20 17:47:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.101, lip=66.85.158.91, session=<HjXYLmFGKNI+PIdl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.233.183.40
country_id: 6252001
description:
Dec 20 17:49:23 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.233.183.40, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hmhLNGFGAI6s6bco>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 20 17:49:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<ICq+NWFGCsQ+PIcm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.233.183.40
country_id: 6252001
description:
Dec 20 17:49:29 host2 pure-ftpd[1286680]: (?@172.233.183.40) [INFO] New connection from 172.233.183.40


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.233.183.40
country_id: 6252001
description:
Dec 20 17:49:36 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.233.183.40, lip=66.85.158.91, session=<5VMYNWFG5sqs6bco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.176.29.108
country_id: 1694008
description:
2025-12-20 17:50:33 dovecot_plain authenticator failed for ([31.57.166.48]) [175.176.29.108]:15506: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.162.247
country_id: 6252001
description:
2025-12-20 17:50:43 dovecot_plain authenticator failed for ([31.57.166.48]) [172.59.162.247]:14614: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.180.206
country_id: 1168579
description:
2025-12-20 17:51:00 dovecot_plain authenticator failed for ([31.57.166.48]) [103.47.180.206]:26516: 535 Incorrect authentication data (set_id=admin@host2.phenomhost.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.197
country_id: 1643084
description:
Dec 20 17:52:11 host2 sshd[1288546]: Disconnected from invalid user tomcat 103.186.1.197 port 35914 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 17:53:09 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (aphyper) [87.103.126.54]:16543: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-20 17:55:50 dovecot_login authenticator failed for (nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:51286: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-20 17:56:17 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:52929: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.12
country_id: 798549
description:
Dec 20 17:57:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.12, lip=66.85.158.92, TLS: Connection closed, session=<snD6UWFGJtzUSZQM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.1.197
country_id: 1643084
description:
Dec 20 17:58:14 host2 sshd[1292547]: Disconnected from invalid user wangtao 103.186.1.197 port 60308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.17
country_id: 798549
description:
Dec 20 17:58:27 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=212.73.148.17, lip=66.85.158.92, TLS, session=<xua6VGFGwJPUSZQR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 17:58:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<w7WfVGFGRr4+PIdj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.94.133.80
country_id: 1643084
description:
Dec 20 17:58:46 host2 pure-ftpd[1292764]: (?@103.94.133.80) [INFO] New connection from 103.94.133.80


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.94.133.80
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.94.133.80 - info@idesignvector.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.94.133.80
country_id: 1643084
description:
Dec 20 17:58:48 host2 sshd[1292765]: Invalid user info@idesignvector.com from 103.94.133.80 port 57305


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.97
country_id: 130758
description:
Dec 20 18:00:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.97, lip=66.85.158.91, session=<ZxAsW2FG6ow+PIdh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.56.139.228
country_id: 1522867
description:
2025-12-20 18:00:25 dovecot_plain authenticator failed for 95.56.139.228.dynamic.telecom.kz ([31.57.166.48]) [95.56.139.228]:34826: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.234.227
country_id: 6252001
description:
2025-12-20 18:00:36 dovecot_plain authenticator failed for ([31.57.166.48]) [98.122.234.227]:53072: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.210.63
country_id: 192950
description:
2025-12-20 18:00:49 dovecot_plain authenticator failed for ([31.57.166.48]) [196.250.210.63]:31680: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.56.139.228
country_id: 1522867
description:
2025-12-20 18:00:32 dovecot_login authenticator failed for 95.56.139.228.dynamic.telecom.kz ([31.57.166.48]) [95.56.139.228]:34826: 535 Incorrect authentication data (set_id=support@host2.phenomhost.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 20 18:01:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<+L9oX2FGJq0+PIcd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 18:02:42 host2 pure-ftpd[1296023]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 20 18:03:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<GD7QZWFGBo0+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-20 18:09:21 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (parrefore) [98.193.112.85]:48696: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.19.154
country_id: 4566966
description:
2025-12-20 18:10:24 dovecot_plain authenticator failed for ([31.57.166.48]) [172.59.19.154]:4424: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.9
country_id: 798549
description:
Dec 20 18:10:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.149.9, lip=66.85.158.91, TLS: Connection closed, session=<mxNBfmFGlMhV2ZUJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-12-20 18:11:04 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:59740: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.19.154
country_id: 4566966
description:
2025-12-20 18:10:30 dovecot_login authenticator failed for ([31.57.166.48]) [172.59.19.154]:4424: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-12-20 18:10:34 dovecot_login authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:35473: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.187.103.24
country_id: 3469034
description:
2025-12-20 18:10:36 dovecot_plain authenticator failed for ([31.57.166.48]) [191.187.103.24]:52698: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.131.60.102
country_id: 453733
description:
2025-12-20 18:10:47 dovecot_plain authenticator failed for 82-131-60-102.ip.elisa.ee ([31.57.166.48]) [82.131.60.102]:51716: 535 Incorrect authentication data (set_id=sales@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.112.146
country_id: 1269750
description:
2025-12-20 18:15:06 dovecot_login authenticator failed for ([182.95.85.103]) [182.95.112.146]:53722: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 18:15:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<R7vTkGFGpK8+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 20 18:16:42 host2 sshd[1307335]: Disconnected from invalid user web 181.46.131.55 port 37134 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 20 18:19:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<m3jPoGFGnug+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-20 18:20:32 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (vatis) [76.16.7.82]:58600: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.245.234.92
country_id: 3996063
description:
2025-12-20 18:20:34 dovecot_plain authenticator failed for ([31.57.166.48]) [177.245.234.92]:6901: 535 Incorrect authentication data (set_id=marketing@host2.phenomhost.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.199
country_id: 6252001
description:
Dec 20 18:20:42 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.126.199, lip=66.85.158.92, session=<0BdHpGFGLpmH7X7H>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 20 18:21:29 host2 sshd[1310268]: Disconnected from invalid user rolando 181.46.131.55 port 36854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 18:23:29 host2 sshd[1311411]: Disconnected from invalid user admin 2.57.121.112 port 15381 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 20 18:24:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<rHy+sWFGdLk+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 20 18:25:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<BQPwtGFGKuI+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.12.63
country_id: 6252001
description:
Dec 20 18:28:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.168.12.63, lip=66.85.158.91, session=<NCFNv2FGwtIUqAw/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 20 18:27:38 host2 sshd[1313934]: Disconnected from invalid user tes 181.46.131.55 port 44882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.46.131.55
country_id: 3865483
description:
Dec 20 18:28:35 host2 sshd[1314508]: Disconnected from invalid user alba 181.46.131.55 port 40172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.92.174.85
country_id: 1643084
description:
2025-12-20 18:29:43 dovecot_login authenticator failed for ([36.92.174.85]) [36.92.174.85]:61237: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.139.170
country_id: 6251999
description:
2025-12-20 18:29:59 dovecot_login authenticator failed for ([207.134.139.173]) [207.134.139.170]:35727: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.73.24.6
country_id: 3469034
description:
2025-12-20 18:30:22 dovecot_plain authenticator failed for ([31.57.166.48]) [187.73.24.6]:33183: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.73.24.6
country_id: 3469034
description:
2025-12-20 18:30:28 dovecot_login authenticator failed for ([31.57.166.48]) [187.73.24.6]:33183: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.100.56.185
country_id: 3469034
description:
2025-12-20 18:30:39 dovecot_plain authenticator failed for 131-100-56-185.starconect.com.br ([31.57.166.48]) [131.100.56.185]:55603: 535 Incorrect authentication data (set_id=contact@host2.phenomhost.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 18:34:12 host2 sshd[1318131]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 20 18:39:03 host2 sshd[1321431]: Disconnected from invalid user jazmyne 62.60.131.157 port 52703 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-20 18:40:30 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:60543: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.90
country_id: 1733045
description:
2025-12-20 18:41:43 dovecot_login authenticator failed for ([49.125.201.90]) [49.125.201.90]:34992: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2025-12-20 18:42:50 dovecot_plain authenticator failed for (dostitism) [50.202.197.108]:37668: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 20 18:46:52 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<lIO7AWJG3sA+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-20 18:47:11 dovecot_plain authenticator failed for (driarat) [12.150.243.22]:4866: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-20 18:54:11 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (ovalcon) [73.196.144.25]:43398: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2025-12-20 18:57:28 dovecot_login authenticator failed for ([27.123.113.10]) [27.123.113.10]:41756: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-20 18:57:44 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:54125: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-20 18:58:40 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (saurn) [24.1.200.187]:45994: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-20 19:00:09 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (glocallees) [73.224.171.101]:39008: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.111.48
country_id: 3144096
description:
2025-12-20 19:00:48 dovecot_login authenticator failed for ([46.212.111.48]) [46.212.111.48]:33090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-20 19:02:11 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (porks) [73.196.144.25]:49028: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.5.114
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.5.114: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 19:05:06 host2 pure-ftpd[1339465]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-20 19:07:04 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (retrians) [196.47.172.253]:35960: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-20 19:07:10 dovecot_plain authenticator failed for (boscroax) [192.81.229.179]:43470: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-12-20 19:09:10 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:37504: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-12-20 19:09:32 dovecot_login authenticator failed for ([154.118.162.194]) [154.118.162.194]:32491: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.123.164.6
country_id: 2510769
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 84.123.164.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2025-12-20 19:13:55 dovecot_plain authenticator failed for (graldion) [109.226.27.227]:40080: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.202.197.108
country_id: 6252001
description:
2025-12-20 19:14:00 dovecot_plain authenticator failed for (fregous) [50.202.197.108]:33370: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 19:24:21 host2 sshd[1350145]: Disconnected from invalid user  2.57.121.25 port 53342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 19:24:28 host2 sshd[1350179]: Disconnected from invalid user admin 2.57.121.112 port 46695 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 19:25:49 host2 sshd[1351199]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 20 19:26:18 host2 sshd[1351395]: Disconnected from invalid user demo 132.248.55.4 port 41760 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 19:28:02 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<zjgBlWJG7ts+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 20 19:30:12 host2 sshd[1353597]: Disconnected from invalid user labor 132.248.55.4 port 5009 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 20 19:30:49 host2 sshd[1353982]: Disconnected from invalid user cod4server 132.248.55.4 port 21600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.55.4
country_id: 3996063
description:
Dec 20 19:31:30 host2 sshd[1354496]: Disconnected from invalid user work 132.248.55.4 port 48775 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-12-20 19:32:31 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (cakee) [73.208.81.125]:39818: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-20 19:32:44 dovecot_plain authenticator failed for (popre) [24.105.248.218]:39396: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 19:33:45 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (paverks) [87.103.126.54]:32164: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 20 19:38:38 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<mYzcumJG4KA+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Dec 20 19:49:53 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS handshaking: Connection closed, session=<pLxB42JGXoHY2s5C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.66
country_id: 6252001
description:
Dec 20 19:50:29 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.66, lip=66.85.158.92, TLS: Connection closed, session=<Y/lj5WJGwh3Y2s5C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 20 19:52:27 host2 sshd[1368680]: Disconnected from invalid user admin 201.249.192.30 port 41742 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 20 19:54:02 host2 sshd[1369549]: Disconnected from invalid user services 201.249.192.30 port 54521 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.192.30
country_id: 3625428
description:
Dec 20 19:53:24 host2 sshd[1369203]: Disconnected from invalid user minecraft 201.249.192.30 port 37698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Dec 20 19:56:19 host2 sshd[1371508]: Disconnected from invalid user mcs 196.189.237.92 port 60744 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.137
country_id: 6252001
description:
Dec 20 19:56:33 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.137, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RZsR+2JGH9aTuYWJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Dec 20 19:57:06 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<soDf/GJGGpvE+2YV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Dec 20 19:57:06 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<Lm/u/GJGtKXE+2YK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Dec 20 19:57:07 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<nMH8/GJGtJ/E+2YY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Dec 20 19:57:07 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<Sd/2/GJGQN3E+2YU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.237.92
country_id: 337996
description:
Dec 20 19:57:29 host2 sshd[1372304]: Disconnected from invalid user admin 196.189.237.92 port 45278 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Dec 20 19:58:32 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<rOIJAmNGjprE+2YT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 20 19:59:36 host2 sshd[1373540]: Disconnected from invalid user postgres 160.174.129.232 port 55781 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 20 20:01:14 host2 sshd[1374799]: Disconnected from invalid user movies 160.174.129.232 port 39653 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.237.92
country_id: 337996
description:
Dec 20 20:00:31 host2 sshd[1374363]: Disconnected from invalid user sysadmin 196.189.237.92 port 33584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-20 20:01:04 dovecot_plain authenticator failed for (peduort) [64.72.74.162]:38575: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.137
country_id: 6252001
description:
Dec 20 20:01:35 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.137, lip=66.85.158.92, TLS, session=<uC0UDWNGmvuTuYWJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.174.129.232
country_id: 2542007
description:
Dec 20 20:02:34 host2 sshd[1375572]: Disconnected from invalid user test1 160.174.129.232 port 52367 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.228.25.51
country_id: 1605651
description:
Dec 20 20:04:44 host2 sshd[1377001]: Disconnected from invalid user es 49.228.25.51 port 45690 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.228.25.51
country_id: 1605651
description:
Dec 20 20:06:05 host2 sshd[1378219]: Disconnected from invalid user server 49.228.25.51 port 42184 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 20:07:42 host2 pure-ftpd[1379208]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.40.213
country_id: 1880251
description:
[2025-12-20 20:11:10 +0530] info [cpaneld] 159.223.40.213 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-20 20:11:51 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (elygly) [73.13.220.220]:53662: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 20:14:45 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 20:15:39 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-12-20 20:19:02 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:58664: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-12-20 20:19:58 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:52378: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-20 20:20:58 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:48804: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.252.220.90
country_id: 6252001
description:
[2025-12-20 20:23:24 +0530] info [webmaild] 192.252.220.90 - info@nsteeleng.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 20:26:50 host2 sshd[1392552]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 20:26:43 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.49.216.16
country_id: 2017370
description:
[2025-12-20 20:27:52 +0530] info [cpaneld] 130.49.216.16 - nccphealthgov "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.193.159
country_id: 6252001
description:
Dec 20 20:32:34 host2 pure-ftpd[1397479]: (?@20.65.193.159) [INFO] New connection from 20.65.193.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-20 20:35:17 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (miete) [174.161.27.82]:34973: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 20:35:59 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-20 20:36:35 dovecot_plain authenticator failed for (nomaing) [94.206.93.90]:45240: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-20 20:37:06 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (corivism) [98.193.112.85]:52808: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.190.95.207
country_id: 1880251
description:
[2025-12-20 20:37:32 +0530] info [cpaneld] 146.190.95.207 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.98.128.249
country_id: 6252001
description:
Dec 20 20:40:45 host2 pure-ftpd[1403540]: (?@20.98.128.249) [INFO] New connection from 20.98.128.249


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.172.221
country_id: 1861060
description:
Dec 20 20:41:06 host2 sshd[1403807]: Disconnected from invalid user bot 160.251.172.221 port 47706 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.172.221
country_id: 1861060
description:
Dec 20 20:41:48 host2 sshd[1404334]: Disconnected from invalid user debian 160.251.172.221 port 37862 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 20:43:17 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (nastraty) [87.103.126.54]:21758: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 20:44:41 host2 sshd[1406768]: Disconnected from invalid user  2.57.121.25 port 48045 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-12-20 20:46:51 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:38104: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-12-20 20:47:07 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:56034: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 20 20:48:12 host2 sshd[1409870]: Disconnected from invalid user vyos 78.100.64.148 port 51881 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-12-20 20:48:42 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:56892: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-20 20:49:13 dovecot_login authenticator failed for ([128.185.253.122]) [128.185.253.122]:39278: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 20 20:52:30 host2 sshd[1412921]: Disconnected from invalid user db2inst1 78.100.64.148 port 19823 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.100.64.148
country_id: 289688
description:
Dec 20 20:53:10 host2 sshd[1413410]: Disconnected from invalid user deploy 78.100.64.148 port 60366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 20 20:53:50 host2 sshd[1413836]: Disconnected from invalid user usuario 78.100.64.148 port 13843 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 20 20:54:31 host2 sshd[1414980]: Disconnected from invalid user hacluster 78.100.64.148 port 55564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec 20 20:56:18 host2 sshd[1416435]: Disconnected from invalid user guest 198.12.114.232 port 57256 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.114.232
country_id: 6252001
description:
Dec 20 20:56:55 host2 sshd[1416756]: Disconnected from invalid user emo 198.12.114.232 port 60136 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 20:57:52 host2 sshd[1417284]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 20 20:58:28 host2 sshd[1417620]: Disconnected from invalid user test 68.183.224.170 port 59786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 20 21:00:00 host2 sshd[1418461]: Disconnected from invalid user yash 68.183.224.170 port 58152 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.224.170
country_id: 1880251
description:
Dec 20 21:00:42 host2 sshd[1419274]: Disconnected from invalid user vbox 68.183.224.170 port 40990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-20 21:01:12 dovecot_plain authenticator failed for (clistionic) [24.187.213.29]:34796: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-20 21:01:16 dovecot_plain authenticator failed for (unigelec) [92.62.243.174]:37977: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2025-12-20 21:01:46 dovecot_plain authenticator failed for (murking) [185.120.142.233]:38238: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-20 21:02:34 dovecot_plain authenticator failed for (balic) [5.11.221.119]:41644: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 21:07:13 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (yakinul) [87.103.126.54]:30508: 535 Incorrect authentication data (set_id=sysnytech@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 20 21:07:19 host2 sshd[1423952]: Disconnected from invalid user guest 5.182.83.231 port 39152 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Dec 20 21:06:38 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Q2e69WNG4CtAPsW2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-12-20 21:07:49 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:48388: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-20 21:08:27 dovecot_login authenticator failed for (187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:42190: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 5.182.83.231
country_id: 2510769
description:
Dec 20 21:08:29 host2 sshd[1424627]: Disconnected from invalid user yaraque 5.182.83.231 port 42484 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 21:10:11 host2 pure-ftpd[1425932]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.123
country_id: 6252001
description:
Dec 20 21:12:21 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.123, lip=66.85.158.91, TLS: Connection closed, session=<6+EvCmRG0O/HLZp7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.123
country_id: 6252001
description:
Dec 20 21:12:27 host2 dovecot[1321837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=199.45.154.123, lip=66.85.158.91, session=<yfiHCmRG8O/HLZp7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 21:18:38 host2 sshd[1430644]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-12-20 21:23:44 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:61061: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.4
country_id: 6252001
description:
Dec 20 21:23:53 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=147.185.133.4, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<3IhkM2RG2d6TuYUE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-12-20 21:24:11 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:51757: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.4
country_id: 6252001
description:
Dec 20 21:24:49 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.4, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<c6O6NmRGaPWTuYUE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.4
country_id: 6252001
description:
Dec 20 21:32:04 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.4, lip=66.85.158.91, TLS, session=<74OxUGRGqPaTuYUE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 20 21:33:14 host2 sshd[1439587]: Disconnected from invalid user webadm 79.168.139.28 port 46312 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Dec 20 21:39:13 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<y5YbamRGJtfE+2YX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Dec 20 21:39:13 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<cQolamRGOKTE+2YW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.185.64
country_id: 1605651
description:
Dec 20 21:39:34 host2 sshd[1444584]: Disconnected from invalid user larry 27.254.185.64 port 19276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 20 21:39:36 host2 sshd[1444597]: Disconnected from invalid user yann 79.168.139.28 port 57556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.185.64
country_id: 1605651
description:
Dec 20 21:40:56 host2 sshd[1445553]: Disconnected from invalid user luser 27.254.185.64 port 15733 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.168.139.28
country_id: 2264397
description:
Dec 20 21:40:46 host2 sshd[1445481]: Disconnected from invalid user alberto 79.168.139.28 port 49874 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.154.138
country_id: 6252001
description:
Dec 20 21:42:10 host2 pure-ftpd[1446567]: (?@199.45.154.138) [INFO] New connection from 199.45.154.138


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.185.64
country_id: 1605651
description:
Dec 20 21:42:15 host2 sshd[1446605]: Disconnected from invalid user hdfs 27.254.185.64 port 41306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-20 21:42:52 dovecot_plain authenticator failed for H=(leanucly) [91.73.188.251]:33503: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 21:48:37 host2 sshd[1450407]: Disconnected from invalid user admin 2.57.121.112 port 52940 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-12-20 21:51:10 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [177.174.16.55]:34699: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-12-20 21:52:38 dovecot_login authenticator failed for H=([190.223.36.108]) [190.223.36.108]:45072: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-12-20 21:52:57 dovecot_login authenticator failed for H=(abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:52098: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 21:59:58 host2 sshd[1472346]: Disconnected from invalid user admin 2.57.121.112 port 16684 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-20 22:02:20 dovecot_plain authenticator failed for H=c-75-74-211-27.hsd1.fl.comcast.net (rader) [75.74.211.27]:44242: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.55.194.114
country_id: 6252001
description:
2025-12-20 22:03:13 dovecot_plain authenticator failed for H=c-73-55-194-114.hsd1.tx.comcast.net (dings) [73.55.194.114]:39722: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 22:04:31 host2 sshd[1476101]: Disconnected from invalid user  2.57.121.25 port 17099 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-12-20 22:06:57 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:51378: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-20 22:07:26 dovecot_login authenticator failed for H=(163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:41857: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.196.212.207
country_id: 6252001
description:
Dec 20 22:07:28 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed: read(size=994) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.196.212.207, lip=66.85.158.91, session=<uQtGz2RG1NMjxNTP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.174.116.14
country_id: 6252001
description:
Dec 20 22:08:08 host2 pure-ftpd[1478789]: (?@172.174.116.14) [INFO] New connection from 172.174.116.14


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 22:08:48 host2 sshd[1479151]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 20 22:10:27 host2 sshd[1480964]: Disconnected from invalid user qa 117.250.96.66 port 57778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.113.12
country_id: 1819730
description:
Dec 20 22:13:38 host2 sshd[1485320]: Disconnected from invalid user ftpuser 154.82.113.12 port 55314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.125.218.183
country_id: 2017370
description:
Dec 20 22:13:51 host2 sshd[1485552]: Disconnected from invalid user ravi 185.125.218.183 port 44950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 20 22:13:53 host2 sshd[1485578]: Disconnected from invalid user web 117.250.96.66 port 56114 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.82.113.12
country_id: 1819730
description:
Dec 20 22:15:36 host2 sshd[1488080]: Disconnected from invalid user sysuser 154.82.113.12 port 60250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Dec 20 22:15:37 host2 sshd[1488083]: Disconnected from invalid user backoffice 117.250.96.66 port 55280 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 22:17:08 host2 sshd[1489817]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-20 22:16:47 dovecot_plain authenticator failed for H=(immandal) [65.20.143.159]:41728: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 20 22:17:03 host2 sshd[1489715]: Disconnected from invalid user proxyuser 58.98.199.45 port 45882 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-20 22:16:43 dovecot_plain authenticator failed for H=81-225-30-107-no2380.tbcn.telia.com (atrinic) [81.225.30.107]:47670: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-12-20 22:18:20 dovecot_login authenticator failed for H=(ws99-36-153-203.rcil.gov.in) [182.72.143.2]:38948: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.113.12
country_id: 1819730
description:
Dec 20 22:17:36 host2 sshd[1490460]: Disconnected from invalid user aso 154.82.113.12 port 41282 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.208
country_id: 6252001
description:
Dec 20 22:19:13 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.208, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KexO+WRGG/VBMQHQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 20 22:18:33 host2 sshd[1491275]: Disconnected from invalid user qa 58.98.199.45 port 43765 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.46.17
country_id: 6251999
description:
2025-12-20 22:18:40 dovecot_login authenticator failed for H=dhcp-b8-94-70-ce-5f-c4.cpe.i-zoom.net [24.137.46.17]:56996: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-12-20 22:18:54 dovecot_login authenticator failed for H=(213-227-245-154.static.vega-ua.net) [213.227.245.154]:40354: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Dec 20 22:19:30 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.202, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7I5U+mRGgFZBMQHK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.127
country_id: 1819730
description:
Dec 20 22:19:29 host2 sshd[1492287]: Disconnected from invalid user eren 123.58.213.127 port 40842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2025-12-20 22:20:52 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [117.250.19.91]:60202: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 20 22:21:24 host2 sshd[1494344]: Disconnected from invalid user lee 58.98.199.45 port 37426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-12-20 22:21:29 dovecot_login authenticator failed for H=40-54-166-83.dyn.estpak.ee [83.166.54.40]:53205: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.224.26.102
country_id: 6252001
description:
Dec 20 22:22:21 host2 pure-ftpd[1495086]: (?@34.224.26.102) [INFO] New connection from 34.224.26.102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-12-20 22:32:17 dovecot_login authenticator failed for H=([103.133.175.82]) [103.142.184.55]:46300: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 20 22:32:31 host2 sshd[1502834]: Disconnected from invalid user ravi 58.98.199.45 port 41640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-12-20 22:32:57 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com [220.246.40.63]:36306: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 20 22:39:32 host2 dovecot[1321837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<avvRQWVGWM/BHmEh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 20 22:39:40 host2 sshd[1507030]: Disconnected from invalid user backoffice 58.98.199.45 port 34469 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-20 22:41:38 dovecot_login authenticator failed for H=([189.108.156.41]) [187.8.64.94]:43204: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.10
country_id: 1269750
description:
2025-12-20 22:42:00 dovecot_login authenticator failed for H=([182.95.63.10]) [182.95.63.10]:42378: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.121.0.25
country_id: 1220409
description:
Dec 20 22:42:41 host2 sshd[1509097]: Disconnected from invalid user rita 185.121.0.25 port 55742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 20 22:44:05 host2 sshd[1509758]: Disconnected from invalid user  2.57.121.25 port 45753 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.186
country_id: 2186224
description:
2025-12-20 22:43:53 dovecot_login authenticator failed for H=([121.73.163.186]) [121.73.163.186]:51246: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.191.212.112
country_id: 337996
description:
Dec 20 22:45:05 host2 sshd[1510831]: Disconnected from invalid user runner 196.191.212.112 port 49766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.10
country_id: 1269750
description:
2025-12-20 22:44:26 dovecot_login authenticator failed for H=(nsg-corporate-252.223.187.122.airtel.in) [122.186.202.10]:57136: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.25
country_id: 1220409
description:
Dec 20 22:44:38 host2 sshd[1509979]: Disconnected from invalid user postgres 185.121.0.25 port 50410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-20 22:46:02 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (rallfid) [71.224.169.28]:53956: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.210.213
country_id: 3686110
description:
Dec 20 22:46:47 host2 sshd[1511841]: Disconnected from invalid user sftp 179.33.210.213 port 49762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 20 22:47:36 host2 sshd[1512524]: Disconnected from invalid user minecraft 66.116.199.234 port 41254 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.19.79.32
country_id: 285570
description:
2025-12-20 22:47:39 dovecot_plain authenticator failed for H=(billy) [185.19.79.32]:57936: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-20 22:47:45 dovecot_plain authenticator failed for H=(sylationon) [94.206.93.90]:52291: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 20 22:48:24 host2 sshd[1512988]: Disconnected from invalid user bot01 66.116.199.234 port 48454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Dec 20 22:49:42 host2 sshd[1513631]: Disconnected from invalid user sshuser 102.211.152.138 port 52224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.191.212.112
country_id: 337996
description:
Dec 20 22:49:50 host2 sshd[1513693]: Disconnected from invalid user tester 196.191.212.112 port 17550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 20 22:50:05 host2 sshd[1513776]: Disconnected from invalid user design 66.116.199.234 port 34648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.211.152.138
country_id: 3469034
description:
Dec 20 22:50:23 host2 sshd[1514244]: Disconnected from invalid user test 102.211.152.138 port 49030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.191.212.112
country_id: 337996
description:
Dec 20 22:50:28 host2 sshd[1514302]: Disconnected from invalid user admin 196.191.212.112 port 1315 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.211.152.138
country_id: 3469034
description:
Dec 20 22:50:59 host2 sshd[1514578]: Disconnected from invalid user gitserver 102.211.152.138 port 45454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-20 22:51:55 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (bologic) [87.103.126.54]:10185: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 20 23:00:05 host2 sshd[1520581]: Disconnected from invalid user admin 2.57.121.112 port 28814 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 23:04:45 host2 sshd[1523712]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.254.5
country_id: 3996063
description:
2025-12-20 23:05:50 dovecot_login authenticator failed for H=([189.219.254.5]) [189.219.254.5]:46543: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.36
country_id: 3996063
description:
2025-12-20 23:06:31 dovecot_login authenticator failed for H=(201.173.250.36-clientes-izzi.mx) [201.173.250.36]:47331: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Dec 20 23:07:35 host2 pure-ftpd[1525573]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.138
country_id: 2264397
description:
Dec 20 23:07:51 host2 pure-ftpd[1525801]: (?@45.156.129.138) [INFO] New connection from 45.156.129.138


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 20 23:08:36 host2 sshd[1526305]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.36
country_id: 6252001
description:
Dec 20 23:09:08 host2 pure-ftpd[1526618]: (?@205.210.31.36) [INFO] New connection from 205.210.31.36


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.126
country_id: 6252001
description:
Dec 20 23:10:41 host2 pure-ftpd[1527946]: (?@198.235.24.126) [INFO] New connection from 198.235.24.126


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 20 23:11:54 host2 pure-ftpd[1528867]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.147.85
country_id: 3144096
description:
2025-12-20 23:16:31 dovecot_login authenticator failed for H=(cm-178.232.147.85.get.no) [178.232.147.85]:56594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.47.92.86
country_id: 1643084
description:
Dec 20 23:16:41 host2 sshd[1532955]: Disconnected from invalid user user 38.47.92.86 port 44912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.18
country_id: 1269750
description:
2025-12-20 23:16:49 dovecot_login authenticator failed for H=(nsg-corporate-127.152.185.122.airtel.in) [122.185.146.18]:35384: 535 Incorrect authentication data (set_id=marketing)


