# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.108.77.116
country_id: 3686110
description:
Dec 26 04:00:31 host2 sshd[179292]: Disconnected from invalid user zabbix 190.108.77.116 port 35252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.243.50.114
country_id: 3469034
description:
Dec 26 04:00:37 host2 sshd[179348]: Disconnected from invalid user cortega 8.243.50.114 port 47058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 26 04:02:03 host2 sshd[180571]: Disconnected from invalid user stefano 52.187.9.8 port 34198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 26 04:03:25 host2 sshd[181720]: Disconnected from invalid user cortega 52.187.9.8 port 52566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 26 04:04:54 host2 sshd[183494]: Disconnected from invalid user wireguard 52.187.9.8 port 44346 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.174
country_id: 6252001
description:
Dec 26 04:04:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.174, lip=66.85.158.92, TLS, session=<z7oPY85G9vvN0h+u>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 04:10:31 host2 pure-ftpd[189741]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 26 04:10:54 host2 sshd[189939]: Disconnected from invalid user bitrix 58.98.199.45 port 39285 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.75
country_id: 2635167
description:
Dec 26 04:14:55 host2 dovecot[1881837]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.75, lip=66.85.158.92, TLS, session=<rz6Xhs5GWaG594lL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-26 04:15:17 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:53175: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.246.158
country_id: 2077456
description:
2025-12-26 04:15:52 dovecot_login authenticator failed for H=([120.157.246.158]) [120.157.246.158]:59218: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 26 04:19:07 host2 sshd[199396]: Disconnected from invalid user luciano 58.98.199.45 port 54953 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 26 04:21:28 host2 sshd[202480]: Disconnected from invalid user ws 58.98.199.45 port 43532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-26 04:22:59 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:36048: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.202
country_id: 1269750
description:
2025-12-26 04:23:41 dovecot_login authenticator failed for H=(nsg-corporate-169.76.187.122.airtel.in) [182.95.124.202]:47512: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.162
country_id: 798544
description:
Dec 26 04:26:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=31.179.228.162, lip=66.85.158.91, TLS, session=<ACaGrs5G9dYfs+Si>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.210.189.21
country_id: 3277605
description:
Dec 26 04:26:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=178.210.189.21, lip=66.85.158.91, TLS, session=<NbWUr85GLqmy0r0V>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.211
country_id: 3017382
description:
Dec 26 04:28:52 host2 pure-ftpd[212898]: (?@91.196.152.211) [INFO] New connection from 91.196.152.211


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.214
country_id: 3017382
description:
Dec 26 04:28:52 host2 pure-ftpd[212894]: (?@91.196.152.214) [INFO] New connection from 91.196.152.214


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.0.171.42
country_id: 298795
description:
Dec 26 04:30:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=95.0.171.42, lip=66.85.158.91, TLS, session=<WmJ5u85Gt6lfAKsq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-26 04:29:11 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:54238: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.169.255
country_id: 3469034
description:
Dec 26 04:30:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.130.169.255, lip=66.85.158.91, TLS, session=<AmKhvM5G+s+xgqn/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.83.97
country_id: 1880251
description:
Dec 26 04:59:46 host2 sshd[242968]: Disconnected from invalid user wk 43.134.83.97 port 46474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.83.97
country_id: 1880251
description:
Dec 26 05:00:29 host2 sshd[243734]: Disconnected from invalid user test 43.134.83.97 port 43688 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Dec 26 05:01:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<r8pTLc9G8N1ChJl7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 26 05:01:37 host2 sshd[244481]: Disconnected from invalid user extern 41.216.178.119 port 54216 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.133.193.72
country_id: 130758
description:
Dec 26 05:01:40 host2 sshd[244509]: Disconnected from invalid user extern 85.133.193.72 port 32940 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 85.133.193.72
country_id: 130758
description:
Dec 26 05:04:44 host2 sshd[246974]: Received disconnect from 85.133.193.72 port 41054:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.134.83.97
country_id: 1880251
description:
Dec 26 05:05:49 host2 sshd[248839]: Disconnected from invalid user vaibhav 43.134.83.97 port 50424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.133.193.72
country_id: 130758
description:
Dec 26 05:06:18 host2 sshd[249681]: Disconnected from invalid user vhserver 85.133.193.72 port 53036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 26 05:10:14 host2 sshd[252699]: Disconnected from invalid user ftpuser 41.216.178.119 port 44494 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.216.178.119
country_id: 1643084
description:
Dec 26 05:10:58 host2 sshd[253208]: Disconnected from invalid user wsq 41.216.178.119 port 36146 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 05:13:01 host2 pure-ftpd[254753]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2025-12-26 05:13:57 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:44597: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.58.47.167
country_id: 6252001
description:
[2025-12-26 05:22:07 +0530] info [whostmgrd] 71.58.47.167 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-26 05:21:17 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:60900: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.222
country_id: 3865483
description:
Dec 26 05:26:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=179.0.251.222, lip=66.85.158.91, TLS, session=<UT/chM9GrqmzAPve>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.8
country_id: 3175395
description:
Dec 26 05:26:39 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=185.15.171.8, lip=66.85.158.91, TLS, session=<sHgYhs9GS6S5D6sI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.134.113.36
country_id: 1269750
description:
Dec 26 05:29:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.134.113.36, lip=66.85.158.91, TLS, session=<kiLGkc9GbNVnhnEk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.249
country_id: 3469034
description:
Dec 26 05:30:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.89.136.249, lip=66.85.158.91, TLS, session=<6NEFk89GcuC+WYj5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 05:35:45 host2 sshd[273939]: Disconnected from invalid user admin 2.57.121.112 port 30222 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.235.3.62
country_id: 6252001
description:
[2025-12-26 05:37:55 +0530] info [webmaild] 140.235.3.62 - info@ayuzonelanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-26 05:38:38 dovecot_login authenticator failed for H=(nsg-corporate-58.202.186.122.airtel.in) [122.186.202.58]:57160: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-26 05:40:14 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:33629: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-12-26 05:40:41 dovecot_login authenticator failed for H=227.42.246.220.static.netvigator.com [220.246.42.227]:50241: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.35
country_id: 6252001
description:
Dec 26 05:42:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.195.35, lip=66.85.158.92, session=<WQwtvs9G4LwUQcMj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.54
country_id: 6252001
description:
Dec 26 05:46:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.54, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<0GS4z89GStfN0h82>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 05:53:20 host2 sshd[287520]: Disconnected from invalid user user 2.57.121.25 port 9824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-12-26 05:56:35 dovecot_login authenticator failed for H=([123.209.106.190]) [123.209.106.190]:37102: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.196
country_id: 3996063
description:
2025-12-26 05:56:47 dovecot_login authenticator failed for H=(201.173.216.196-clientes-izzi.mx) [201.173.216.196]:36283: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-26 05:57:10 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:46469: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.7.77
country_id: 6252001
description:
Dec 26 05:58:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.122.7.77, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<7sSF+M9GRs6GegdN>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.181.171.159
country_id: 2017370
description:
[2025-12-26 06:08:49 +0530] info [webmaild] 5.181.171.159 - info@tradeceylon.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 06:11:23 host2 sshd[303663]: Disconnected from invalid user admin 2.57.121.112 port 27973 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.117.47
country_id: 2921044
description:
Dec 26 06:11:45 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=46.101.117.47, lip=66.85.158.91, session=<2htqKNBGuKYuZXUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-26 06:14:31 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:52315: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2025-12-26 06:15:14 dovecot_login authenticator failed for H=(static-200-85-150173.vnet.bo) [200.85.150.173]:51582: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 06:15:35 host2 pure-ftpd[307263]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2025-12-26 06:16:13 dovecot_login authenticator failed for H=(171.140.212.218.starhub.net.sg) [218.212.140.171]:37553: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.219.159
country_id: 3374766
description:
2025-12-26 06:16:27 dovecot_login authenticator failed for H=([41.215.219.159]) [41.215.219.159]:49973: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.253
country_id: 3469034
description:
Dec 26 06:21:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=191.240.36.253, lip=66.85.158.91, TLS, session=<9ikWS9BG0te/8CT9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.84
country_id: 3175395
description:
Dec 26 06:21:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.15.169.84, lip=66.85.158.91, TLS, session=<lxjySdBG24e5D6lU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-26 06:24:44 dovecot_login authenticator failed for H=([187.8.120.90]) [187.8.120.90]:51603: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-26 06:25:23 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:34824: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-12-26 06:29:07 dovecot_login authenticator failed for H=c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:37896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.35.53
country_id: 3144096
description:
2025-12-26 06:29:35 dovecot_login authenticator failed for H=(cm-46.212.35.53.get.no) [46.212.35.53]:46713: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.105.235.55
country_id: 3017382
description:
[2025-12-26 06:29:58 +0530] info [cpaneld] 46.105.235.55 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.133
country_id: 6252001
description:
Dec 26 06:32:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.194.133, lip=66.85.158.91, session=<4yncc9BGrIcUQcKF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.12
country_id: 6252001
description:
Dec 26 06:37:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.12, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<vXlhhdBG5M3G6xgM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.208.104.128
country_id: 3175395
description:
Dec 26 06:38:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=185.208.104.128, lip=66.85.158.91, TLS, session=<jQM8htBGyd650GiA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.188
country_id: 3469034
description:
Dec 26 06:38:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=187.120.72.188, lip=66.85.158.91, TLS, session=<ZSNuh9BGL867eEi8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.9
country_id: 1605651
description:
Dec 26 06:39:05 host2 sshd[326867]: Disconnected from invalid user dockeruser 122.155.223.9 port 58874 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.155.223.9
country_id: 1605651
description:
Dec 26 06:39:44 host2 sshd[327319]: Disconnected from invalid user erpnext 122.155.223.9 port 56208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.9
country_id: 1605651
description:
Dec 26 06:40:22 host2 sshd[328225]: Disconnected from invalid user thomas 122.155.223.9 port 45312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 26 06:41:46 host2 sshd[329188]: Disconnected from invalid user hostinger 103.132.243.250 port 42552 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.175.213.4
country_id: 6252001
description:
Dec 26 06:41:16 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.175.213.4, lip=66.85.158.91, session=<PDj6kdBGpGJCr9UE>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 128.199.26.0
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 128.199.26.0: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.75
country_id: 3865483
description:
Dec 26 06:41:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.252.75, lip=66.85.158.91, TLS, session=<9GcSkdBGgOizAPxL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.200
country_id: 2510769
description:
Dec 26 06:41:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=139.28.190.200, lip=66.85.158.91, TLS, session=<16VUktBGj5yLHL7I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.50
country_id: 6252001
description:
Dec 26 06:42:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.50, lip=66.85.158.92, TLS: Connection closed, session=<Mb3flNBG6H2nXpIy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 94.182.134.75
country_id: 130758
description:
Dec 26 06:42:12 host2 sshd[329544]: Disconnected from invalid user suporte 94.182.134.75 port 35092 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.83.255.165
country_id: 6252001
description:
[2025-12-26 06:44:06 +0530] info [webmaild] 172.83.255.165 - info@neotechlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.155.90.118
country_id: 6252001
description:
Dec 26 06:44:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=192.155.90.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<E9WxnNBGJhfAm1p2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 26 06:44:34 host2 sshd[331823]: Disconnected from invalid user control 103.132.243.250 port 36150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Dec 26 06:45:12 host2 sshd[332436]: Disconnected from invalid user ubuntu 103.132.243.250 port 35286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.44.29.6
country_id: 1819730
description:
Dec 26 06:46:35 host2 sshd[333394]: Disconnected from invalid user user53 154.44.29.6 port 51104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 06:46:43 host2 sshd[333477]: Disconnected from invalid user admin 2.57.121.112 port 60165 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.44.29.6
country_id: 1819730
description:
Dec 26 06:45:59 host2 sshd[333000]: Disconnected from invalid user thomas 154.44.29.6 port 41704 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.1
country_id: 6252001
description:
Dec 26 06:48:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.1, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JXfPqtBGHb5b5qgB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.3
country_id: 6252001
description:
Dec 26 06:48:39 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.3, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<eVNnrNBGw75b5qgD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.6
country_id: 6252001
description:
Dec 26 06:48:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.6, lip=66.85.158.91, TLS: Connection closed, session=<DVOWrNBGyd9b5qgG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:49:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<vQfCr9BGruUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:50:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<VhKHtNBGYNYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:52:27 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<wqD2udBGCqcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:53:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Xcoav9BGaKEDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:54:03 host2 dovecot[1881837]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<8Neuv9BGer0DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 26 06:53:52 host2 sshd[338781]: Disconnected from invalid user es 201.124.168.139 port 35122 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 06:55:31 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<D270xNBGbKIDhBfJ>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 26 07:00:36 host2 sshd[345076]: Received disconnect from 201.124.168.139 port 59712:11: Bye Bye [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 26 07:02:02 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<OkdA3NBGbJvPWvQc>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 26 07:01:59 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.91, session=<TLkW3NBGiIvPWvQc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 26 07:04:29 host2 sshd[347944]: Disconnected from invalid user teste 201.124.168.139 port 58954 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 201.124.168.139
country_id: 3996063
description:
Dec 26 07:06:05 host2 sshd[349594]: Received disconnect from 201.124.168.139 port 38426:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-26 07:07:27 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:63292: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-12-26 07:09:47 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [190.104.254.91]:37959: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.239.5
country_id: 3144096
description:
2025-12-26 07:10:42 dovecot_login authenticator failed for H=(cm-178.232.239.5.get.no) [178.232.239.5]:46788: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-26 07:11:26 dovecot_login authenticator failed for H=([182.95.52.194]) [182.95.52.194]:56460: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-26 07:11:35 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:58667: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-26 07:11:50 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:57376: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-26 07:10:59 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:36238: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-12-26 07:10:59 dovecot_login authenticator failed for H=([182.78.107.6]) [182.78.107.6]:37300: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.173.57
country_id: 3144096
description:
2025-12-26 07:10:58 dovecot_login authenticator failed for H=([62.97.173.57]) [62.97.173.57]:57514: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.221.84
country_id: 1210997
description:
2025-12-26 07:11:22 dovecot_login authenticator failed for H=([103.132.220.252]) [103.132.221.84]:47456: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.146.192.27
country_id: 3175395
description:
2025-12-26 07:13:46 dovecot_login authenticator failed for H=(ADMIN) [72.146.192.27]:48500: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.128.120
country_id: 2921044
description:
Dec 26 07:14:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.128.120, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PlhXB9FGYn6kXIB4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 07:16:16 host2 sshd[357795]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 07:16:48 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:55234: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 07:18:12 host2 pure-ftpd[359203]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.94.192.162
country_id: 732800
description:
[2025-12-26 07:21:11 +0530] info [webmaild] 185.94.192.162 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 07:22:04 host2 sshd[362244]: Disconnected from invalid user admin 2.57.121.112 port 58339 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.127
country_id: 6252001
description:
Dec 26 07:31:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.127, lip=66.85.158.91, TLS: Connection closed, session=<5ZrwRNFGeobHLZp/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.228.131.33
country_id: 3017382
description:
Dec 26 07:32:12 host2 sshd[370722]: Disconnected from invalid user git 152.228.131.33 port 34272 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 26 07:33:02 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<QIwaS9FGgKvPWvQc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 26 07:33:03 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.28, lip=66.85.158.92, session=<CJYxS9FGmqvPWvQc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.131.131.43
country_id: 1269750
description:
Dec 26 07:33:52 host2 sshd[372028]: Disconnected from invalid user yleng 34.131.131.43 port 56282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.228.131.33
country_id: 3017382
description:
Dec 26 07:34:49 host2 sshd[372833]: Disconnected from invalid user safeuser 152.228.131.33 port 51094 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.32
country_id: 3175395
description:
Dec 26 07:35:32 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=185.15.169.32, lip=66.85.158.91, TLS, session=<ffvnUtFGMxK5D6kg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-12-26 07:35:40 dovecot_login authenticator failed for H=([65.20.237.191]) [65.20.237.191]:43787: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.228.131.33
country_id: 3017382
description:
Dec 26 07:35:49 host2 sshd[373810]: Disconnected from invalid user testuser2 152.228.131.33 port 41584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.158
country_id: 798544
description:
Dec 26 07:35:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=91.238.166.158, lip=66.85.158.91, TLS, session=<SaTKUdFGCZxb7qae>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-12-26 07:36:00 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:48572: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 26 07:36:59 host2 sshd[374910]: Disconnected from invalid user matin 102.88.137.213 port 33765 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.131.131.43
country_id: 1269750
description:
Dec 26 07:37:04 host2 sshd[375001]: Disconnected from invalid user zhangsan 34.131.131.43 port 39686 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.240.250
country_id: 2921044
description:
Dec 26 07:38:17 host2 pure-ftpd[375915]: (?@164.92.240.250) [INFO] New connection from 164.92.240.250


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.131.131.43
country_id: 1269750
description:
Dec 26 07:38:54 host2 sshd[376297]: Disconnected from invalid user tang 34.131.131.43 port 52304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 07:39:04 host2 sshd[376501]: Disconnected from invalid user user 2.57.121.25 port 25224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-26 07:39:17 dovecot_login authenticator failed for H=(46.30.161.197.access.ipnet.ua) [46.30.161.197]:49824: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.155
country_id: 1605651
description:
Dec 26 07:41:44 host2 sshd[379782]: Disconnected from invalid user debian 103.13.215.155 port 45656 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-12-26 07:42:02 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:44149: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 26 07:42:03 host2 sshd[380147]: Disconnected from invalid user anita 102.88.137.213 port 17208 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.44
country_id: 2635167
description:
Dec 26 07:42:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=35.203.211.44, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<OLAtbdFGINEjy9Ms>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2025-12-26 07:42:38 dovecot_login authenticator failed for H=c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:54208: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 26 07:43:22 host2 sshd[381591]: Disconnected from invalid user myuser 102.88.137.213 port 49526 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.44
country_id: 2635167
description:
Dec 26 07:43:34 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=35.203.211.44, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<1GzOcNFGzv0jy9Ms>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.44
country_id: 2635167
description:
Dec 26 07:43:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=35.203.211.44, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<isHdcdFG1u8jy9Ms>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.215.155
country_id: 1605651
description:
Dec 26 07:44:10 host2 sshd[382467]: Disconnected from invalid user depot 103.13.215.155 port 59562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.213
country_id: 2328926
description:
Dec 26 07:44:40 host2 sshd[383320]: Disconnected from invalid user yleng 102.88.137.213 port 1245 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-26 07:44:52 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:50308: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-26 07:45:13 dovecot_login authenticator failed for H=net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:51219: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.28
country_id: 3017382
description:
Dec 26 07:46:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.28, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<iUZKfNFGbbFbxJgc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.118
country_id: 3017382
description:
Dec 26 07:46:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.118, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7Kb6etFG989bxJh2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.116
country_id: 3017382
description:
Dec 26 07:46:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.116, lip=66.85.158.91, TLS: Connection closed, session=<kzaae9FGk+1bxJh0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.31
country_id: 3017382
description:
Dec 26 07:46:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.31, lip=66.85.158.91, TLS: Connection closed, session=<O7h6fNFGnYlbxJgf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.44
country_id: 2635167
description:
Dec 26 07:52:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.44, lip=66.85.158.92, TLS, session=<t8Atj9FGyOgjy9Ms>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-26 07:53:34 dovecot_login authenticator failed for H=li2180-133.members.linode.com [192.46.237.133]:42038: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-12-26 07:53:46 dovecot_login authenticator failed for H=([210.56.12.205]) [210.56.12.205]:49690: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.192
country_id: 6252001
description:
Dec 26 07:55:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.192, lip=66.85.158.92, TLS, session=<oIjQm9FGaP/G6xjA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.170.251.33
country_id: 2017370
description:
2025-12-26 07:58:47 dovecot_login authenticator failed for H=([178.170.251.33]) [178.170.251.33]:60398: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.216.25.38
country_id: 798544
description:
Dec 26 07:58:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=178.216.25.38, lip=66.85.158.91, TLS, session=<T/SZpdFGX+Sy2Bkm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.84.31
country_id: 3996063
description:
2025-12-26 07:59:12 dovecot_login authenticator failed for H=([187.161.84.31]) [187.161.84.31]:52208: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.162.102
country_id: 1269750
description:
2025-12-26 07:59:23 dovecot_login authenticator failed for H=([125.19.162.102]) [125.19.162.102]:39564: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.119.198.81
country_id: 3932488
description:
Dec 26 07:59:39 host2 sshd[395583]: Disconnected from invalid user vpn 190.119.198.81 port 37534 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 84.54.150.172
country_id: 732800
description:
Dec 26 07:59:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=84.54.150.172, lip=66.85.158.91, TLS, session=<Y3RPp9FGE9ZUNpas>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2025-12-26 07:59:09 dovecot_login authenticator failed for H=([103.129.195.43]) [103.129.195.43]:56220: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.146.192.27
country_id: 3175395
description:
2025-12-26 08:00:00 dovecot_login authenticator failed for H=(ADMIN) [72.146.192.27]:32950: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.198.81
country_id: 3932488
description:
Dec 26 08:00:56 host2 sshd[396920]: Disconnected from invalid user free 190.119.198.81 port 37658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Dec 26 08:02:30 host2 sshd[398172]: Disconnected from invalid user user02 20.123.146.95 port 39309 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.119.198.81
country_id: 3932488
description:
Dec 26 08:02:50 host2 sshd[398450]: Disconnected from invalid user postgres 190.119.198.81 port 51966 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 08:03:18 host2 sshd[398973]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.164.135.45
country_id: 1835841
description:
Dec 26 08:06:22 host2 sshd[401703]: Disconnected from invalid user abhi 43.164.135.45 port 39594 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.215.228.51
country_id: 130758
description:
Dec 26 08:08:05 host2 sshd[402925]: Disconnected from invalid user erp 185.215.228.51 port 49020 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.160.75
country_id: 2186224
description:
2025-12-26 08:08:20 dovecot_login authenticator failed for H=([121.73.160.75]) [121.73.160.75]:39904: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-26 08:08:41 dovecot_login authenticator failed for H=([84.215.110.96]) [84.215.110.96]:33396: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.215.228.51
country_id: 130758
description:
Dec 26 08:09:12 host2 sshd[403857]: Disconnected from invalid user deploy 185.215.228.51 port 49104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-26 08:11:48 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:49480: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-12-26 08:12:10 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:65485: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.97
country_id: 6252001
description:
Dec 26 08:19:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.97, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<3ssE8tFGX9bN0h9h>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 08:20:49 host2 pure-ftpd[414697]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.169.15.182
country_id: 1522867
description:
2025-12-26 08:22:18 dovecot_login authenticator failed for H=31.169.15.182.dynamic.telecom.kz [31.169.15.182]:46143: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-26 08:22:29 dovecot_login authenticator failed for H=(cm-84.213.189.154.get.no) [84.213.189.154]:51917: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.77.198.112
country_id: 2542007
description:
[2025-12-26 08:25:17 +0530] info [cpaneld] 105.77.198.112 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2025-12-26 08:30:07 +0530] info [cpaneld] 38.35.225.197 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 08:32:21 host2 sshd[424348]: Disconnected from invalid user admin 2.57.121.112 port 45935 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.238.252.46
country_id: 241170
description:
2025-12-26 08:33:34 dovecot_login authenticator failed for H=([156.238.252.46]) [156.238.252.46]:59510: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-26 08:33:09 dovecot_login authenticator failed for H=(cm-178.232.168.117.get.no) [178.232.168.117]:37059: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.137.105.106
country_id: 6252001
description:
Dec 26 08:52:27 host2 pure-ftpd[443224]: (?@23.137.105.106) [INFO] New connection from 23.137.105.106


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec 26 08:55:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=31.14.32.6, lip=66.85.158.92, TLS: Connection closed, session=<zqerctJGnpwfDiAG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec 26 08:56:09 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=31.14.32.6, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<JVNgdNJGTMQfDiAG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.31
country_id: 732800
description:
Dec 26 08:56:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.255.212.31, lip=66.85.158.91, TLS, session=<hotkc9JGy4S5/9Qf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.53
country_id: 3469034
description:
Dec 26 08:56:31 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=177.44.71.53, lip=66.85.158.91, TLS, session=<s6+MdNJG3K2xLEc1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.74
country_id: 690791
description:
Dec 26 09:00:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=194.44.140.74, lip=66.85.158.91, TLS, session=<x8Y1gdJGJ+jCLIxK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.127.94.62
country_id: 798544
description:
Dec 26 08:59:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=128.127.94.62, lip=66.85.158.91, TLS, session=<rhYrgNJGnayAf14+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 09:00:08 host2 sshd[449992]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 09:07:13 host2 sshd[456235]: Disconnected from invalid user admin 2.57.121.112 port 34380 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-12-26 09:08:00 dovecot_login authenticator failed for H=([122.187.230.13]) [122.187.230.13]:44106: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2025-12-26 09:09:03 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au [210.0.90.82]:53638: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-12-26 09:08:45 dovecot_login authenticator failed for H=([128.185.222.80]) [128.185.229.126]:33454: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.115
country_id: 6252001
description:
Dec 26 09:19:58 host2 pure-ftpd[465719]: (?@147.185.132.115) [INFO] New connection from 147.185.132.115


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.202.9.133
country_id: 6252001
description:
Dec 26 09:23:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.202.9.133, lip=66.85.158.91, TLS: Connection closed, session=<1LqX1NJGuNIjygmF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 09:23:29 host2 pure-ftpd[468695]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-26 09:30:11 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:51064: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2025-12-26 09:30:26 dovecot_login authenticator failed for H=([122.184.128.193]) [182.95.185.170]:49158: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.106
country_id: 6252001
description:
Dec 26 09:35:40 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.106, lip=66.85.158.91, TLS, session=<r7KvAdNGOvjG6xhq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 09:38:27 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:53458: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-26 09:38:41 dovecot_login authenticator failed for H=([187.8.120.90]) [187.8.120.90]:37191: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 09:42:19 host2 sshd[484514]: Disconnected from invalid user admin 2.57.121.112 port 52542 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 09:47:13 host2 sshd[489484]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 26 09:56:19 host2 sshd[498362]: Disconnected from invalid user dev 150.5.169.176 port 58852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 26 09:59:11 host2 sshd[500562]: Disconnected from invalid user deployer 181.188.172.6 port 38653 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.164.246.209
country_id: 1269750
description:
Dec 26 09:59:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.164.246.209, lip=66.85.158.91, TLS, session=<AgIFVtNGB8lnpPbR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.255.158.241
country_id: 1643084
description:
2025-12-26 09:59:51 dovecot_login authenticator failed for H=([101.255.158.242]) [101.255.158.241]:37470: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.13
country_id: 3175395
description:
Dec 26 09:59:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.170.13, lip=66.85.158.91, TLS, session=<vUZQV9NGJLC5D6oN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-26 10:00:14 dovecot_login authenticator failed for H=([125.19.175.85]) [122.186.200.10]:55712: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 26 10:02:56 host2 sshd[504169]: Disconnected from invalid user laura 150.5.169.176 port 46604 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.27
country_id: 798544
description:
Dec 26 10:02:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=178.216.29.27, lip=66.85.158.91, TLS, session=<e3UzYtNGNdCy2B0b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.91.42
country_id: 3469034
description:
Dec 26 10:03:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=177.22.91.42, lip=66.85.158.91, TLS, session=<oThUY9NGWpqxFlsq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 26 10:04:54 host2 sshd[506205]: Disconnected from invalid user deploy 181.188.172.6 port 54408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.169.176
country_id: 1819730
description:
Dec 26 10:05:21 host2 sshd[506842]: Disconnected from invalid user admin123 150.5.169.176 port 46720 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Dec 26 10:06:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS handshaking: Connection closed, session=<rkoUcNNGxGlChJmG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 26 10:06:21 host2 sshd[507891]: Disconnected from invalid user devops 103.255.147.244 port 41774 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 26 10:08:24 host2 sshd[509805]: Received disconnect from 141.95.162.162 port 33396:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 26 10:08:39 host2 sshd[509985]: Disconnected from invalid user devops 181.188.172.6 port 55022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Dec 26 10:10:44 host2 sshd[512211]: Disconnected from invalid user user 181.188.172.6 port 33661 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 26 10:13:41 host2 sshd[515540]: Received disconnect from 141.95.162.162 port 45178:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.255.147.244
country_id: 1269750
description:
Dec 26 10:15:28 host2 sshd[517498]: Disconnected from invalid user ftp_user 103.255.147.244 port 33202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 26 10:16:48 host2 sshd[518638]: Disconnected from invalid user admin 141.95.162.162 port 48154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.95.162.162
country_id: 3017382
description:
Dec 26 10:17:20 host2 sshd[519147]: Disconnected from invalid user ubuntu 141.95.162.162 port 52968 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-26 10:19:53 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62686: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 10:26:11 host2 pure-ftpd[526326]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.7.141.81
country_id: 1605651
description:
Dec 26 10:35:53 host2 sshd[533988]: Disconnected from invalid user prasad 61.7.141.81 port 54912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-26 10:37:41 dovecot_login authenticator failed for H=([128.185.231.6]) [128.185.231.6]:47628: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-12-26 10:37:14 dovecot_login authenticator failed for H=([186.239.41.74]) [186.239.41.74]:58337: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 61.7.141.81
country_id: 1605651
description:
Dec 26 10:37:26 host2 sshd[535442]: Disconnected from invalid user amssys 61.7.141.81 port 50614 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 61.7.141.81
country_id: 1605651
description:
Dec 26 10:38:14 host2 sshd[536223]: Disconnected from invalid user soporte 61.7.141.81 port 38154 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 10:44:24 host2 sshd[541127]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.240.250
country_id: 2921044
description:
Dec 26 10:50:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (disconnected before auth was ready, waited 0 secs): user=<>, rip=164.92.240.250, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<O9GvDdRGZzSkXPD6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.117.47
country_id: 2921044
description:
Dec 26 10:51:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.117.47, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8hHKD9RGOHAuZXUv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.162.75
country_id: 241170
description:
Dec 26 11:00:55 host2 sshd[554652]: Disconnected from invalid user debian 154.198.162.75 port 60480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 26 11:02:22 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS: Connection closed, session=<zRnFN9RGMNlChJl1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 26 11:03:30 host2 sshd[556815]: Disconnected from invalid user sk 85.206.171.113 port 48000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 26 11:03:38 host2 sshd[556926]: Disconnected from invalid user alba 162.240.156.34 port 49484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 26 11:04:14 host2 sshd[557435]: Disconnected from invalid user tes 162.240.156.34 port 33124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.206.171.113
country_id: 597427
description:
Dec 26 11:05:40 host2 sshd[558650]: Disconnected from invalid user colin 85.206.171.113 port 37632 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.172.152.74
country_id: 3508796
description:
Dec 26 11:05:51 host2 sshd[558822]: Disconnected from invalid user rafael 45.172.152.74 port 37054 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 26 11:06:19 host2 sshd[559269]: Disconnected from invalid user production 162.240.156.34 port 52416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2025-12-26 11:07:20 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:55342: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-12-26 11:07:44 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:36172: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.208
country_id: 1643084
description:
Dec 26 11:09:09 host2 sshd[561408]: Disconnected from invalid user pq 103.172.205.208 port 52008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.52
country_id: 1819730
description:
Dec 26 11:10:19 host2 sshd[563107]: Disconnected from invalid user pq 123.58.213.52 port 60256 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 155.133.116.71
country_id: 798544
description:
Dec 26 11:10:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=155.133.116.71, lip=66.85.158.91, TLS, session=<WkEpU9RGTcKbhXRH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.212.167.152
country_id: 798544
description:
Dec 26 11:10:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00>, method=PLAIN, rip=178.212.167.152, lip=66.85.158.91, TLS, session=<K1FHVNRGrsyy1KeY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.208
country_id: 1643084
description:
Dec 26 11:11:18 host2 sshd[564257]: Disconnected from invalid user vbox 103.172.205.208 port 54898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.205.208
country_id: 1643084
description:
Dec 26 11:12:40 host2 sshd[565470]: Disconnected from invalid user tes 103.172.205.208 port 52180 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.103.3.117
country_id: 690791
description:
Dec 26 11:13:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=176.103.3.117, lip=66.85.158.91, TLS, session=<M5wBYNRGkr+wZwN1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.130.33
country_id: 99237
description:
Dec 26 11:14:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=65.20.130.33, lip=66.85.158.91, TLS, session=<0dAXYdRGcbpBFIIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 11:18:32 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:49036: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-26 11:19:25 dovecot_login authenticator failed for H=([122.186.50.17]) [182.95.61.114]:37190: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-12-26 11:19:50 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net [96.56.228.149]:59538: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.93
country_id: 2635167
description:
Dec 26 11:20:25 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=35.203.211.93, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<jb9ReNRGsckjy9Nd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.93
country_id: 2635167
description:
Dec 26 11:21:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=35.203.211.93, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<F4mpfNRGrOkjy9Nd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.31.74
country_id: 1522867
description:
2025-12-26 11:26:06 dovecot_login authenticator failed for H=2.135.31.74.dynamic.telecom.kz [2.135.31.74]:49335: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 11:26:25 host2 sshd[578294]: Disconnected from invalid user admin 2.57.121.112 port 62423 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2025-12-26 11:26:36 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:38718: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-26 11:26:21 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:34966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.26.53.164
country_id: 1269750
description:
2025-12-26 11:26:22 dovecot_login authenticator failed for H=([122.169.40.221]) [103.26.53.164]:59244: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.93
country_id: 2635167
description:
Dec 26 11:28:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.93, lip=66.85.158.91, TLS, session=<u+qLlNRGpO0jy9Nd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-12-26 11:28:34 dovecot_login authenticator failed for H=syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:44647: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 11:29:09 host2 pure-ftpd[580375]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 11:31:22 host2 sshd[582186]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.249
country_id: 2635167
description:
Dec 26 11:33:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.249, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QsuFpdRG98xX7LD5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.184
country_id: 2635167
description:
Dec 26 11:33:02 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.184, lip=66.85.158.91, TLS, session=<wvRqpdRGjcFX7LC4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.242
country_id: 2635167
description:
Dec 26 11:33:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.242, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<KZB/p9RGh86594ny>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.227
country_id: 2635167
description:
Dec 26 11:34:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.227, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<fzN7qdRGaalX7LDj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.243
country_id: 2635167
description:
Dec 26 11:34:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.243, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<6nV2q9RGF4VX7LDz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.226
country_id: 2635167
description:
Dec 26 11:35:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.226, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<uNVxrdRGHaRX7LDi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.253
country_id: 2635167
description:
Dec 26 11:35:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.253, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<eVxsr9RG1dRX7LD9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.218
country_id: 2635167
description:
Dec 26 11:36:57 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.218, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Wk1ls9RG+8dX7LDa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.219
country_id: 2635167
description:
Dec 26 11:36:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.219, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<8OBrsdRGV6m594nb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.223
country_id: 2635167
description:
Dec 26 11:37:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.223, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<K5NetdRGjdy594nf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.233
country_id: 2635167
description:
Dec 26 11:38:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.233, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<jOZZt9RGw71X7LDp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 26 11:40:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS: Connection closed, session=<3YiJv9RGpMtChJl1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.32.190.134
country_id: 3175395
description:
Dec 26 11:42:11 host2 sshd[590909]: Disconnected from invalid user nodered 79.32.190.134 port 45504 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.147
country_id: 6252001
description:
Dec 26 11:42:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.147, lip=66.85.158.91, TLS, session=<Vzk8yNRG3ufN0h+T>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.223.60.209
country_id: 3932488
description:
Dec 26 11:44:22 host2 sshd[592637]: Disconnected from invalid user user3 190.223.60.209 port 55172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 26 11:45:08 host2 sshd[593365]: Disconnected from invalid user myuser 103.210.21.178 port 56752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.223.60.209
country_id: 3932488
description:
Dec 26 11:45:42 host2 sshd[594252]: Disconnected from invalid user angel 190.223.60.209 port 54300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.248
country_id: 2658434
description:
Dec 26 11:46:09 host2 sshd[594658]: Disconnected from invalid user nodered 185.196.11.248 port 39148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.223.60.209
country_id: 3932488
description:
Dec 26 11:46:20 host2 sshd[594848]: Disconnected from invalid user myuser 190.223.60.209 port 39738 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.148.235.124
country_id: 294640
description:
[2025-12-26 11:46:56 +0530] info [webmaild] 45.148.235.124 - info@stanthonys.biz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.196.11.248
country_id: 2658434
description:
Dec 26 11:47:11 host2 sshd[595505]: Disconnected from invalid user sfserver 185.196.11.248 port 50296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.223.60.209
country_id: 3932488
description:
Dec 26 11:47:46 host2 sshd[596315]: Disconnected from invalid user ubuntu 190.223.60.209 port 38870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.178
country_id: 1880251
description:
Dec 26 11:48:06 host2 sshd[596745]: Disconnected from invalid user dev 103.210.21.178 port 36660 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 185.196.11.248
country_id: 2658434
description:
Dec 26 11:48:42 host2 sshd[597333]: Received disconnect from 185.196.11.248 port 48878:11: Bye Bye [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.130
country_id: 3469034
description:
Dec 26 11:49:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=190.89.137.130, lip=66.85.158.91, TLS, session=<5HEo4NRGBp6+WYmC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.71
country_id: 3865483
description:
Dec 26 11:50:07 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=190.181.97.71, lip=66.85.158.91, TLS, session=<dqZX4dRG0qu+tWFH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.196.11.248
country_id: 2658434
description:
Dec 26 11:50:40 host2 sshd[599173]: Disconnected from invalid user hik 185.196.11.248 port 45662 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.236.136.67
country_id: 1861060
description:
2025-12-26 11:50:51 dovecot_login authenticator failed for H=p1385068-omed01.tokyo.ocn.ne.jp [153.236.136.67]:48602: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.250.250
country_id: 1269750
description:
2025-12-26 11:51:06 dovecot_login authenticator failed for H=(nsg-corporate-250.250.187.122.airtel.in) [122.187.250.250]:43069: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.124.206
country_id: 1269750
description:
2025-12-26 11:50:21 dovecot_login authenticator failed for H=([182.95.87.3]) [182.95.124.206]:33662: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec 26 11:51:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<u01+6NRGNP/CpRCj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 11:52:21 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<nAaG6tRGzLoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 11:55:19 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<PZEV9dRGHM4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 11:56:31 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<HN1o+dRGjoMDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 11:58:08 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<dPEu/9RGzIgDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 11:58:52 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7zjJAdVGcqsDjyE/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 12:00:07 host2 sshd[608222]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 26 12:00:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<+0fTBtVGFM0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec 26 12:01:00 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=31.14.32.6, lip=66.85.158.92, TLS, session=<J8psCdVGhLcfDiAG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec 26 12:01:13 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=31.14.32.6, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<8jMuCtVGpuMfDiAG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.65.36.123
country_id: 6252001
description:
[2025-12-26 12:02:46 +0530] info [whostmgrd] 174.65.36.123 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.121.64.38
country_id: 6252001
description:
[2025-12-26 12:03:01 +0530] info [cpaneld] 23.121.64.38 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.74.102.234
country_id: 6252001
description:
[2025-12-26 12:03:01 +0530] info [cpaneld] 73.74.102.234 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.153.150.65
country_id: 6252001
description:
[2025-12-26 12:03:02 +0530] info [cpaneld] 73.153.150.65 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.74.126.239
country_id: 6252001
description:
[2025-12-26 12:02:47 +0530] info [cpaneld] 99.74.126.239 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.177.53.181
country_id: 6252001
description:
[2025-12-26 12:02:57 +0530] info [cpaneld] 198.177.53.181 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.68.97.76
country_id: 6252001
description:
[2025-12-26 12:02:59 +0530] info [cpaneld] 72.68.97.76 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.122.146.93
country_id: 6252001
description:
[2025-12-26 12:02:39 +0530] info [cpaneld] 73.122.146.93 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.135.205.207
country_id: 6252001
description:
[2025-12-26 12:02:49 +0530] info [cpaneld] 74.135.205.207 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.181.125.247
country_id: 6252001
description:
[2025-12-26 12:02:58 +0530] info [cpaneld] 67.181.125.247 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.162.171.145
country_id: 6252001
description:
[2025-12-26 12:02:41 +0530] info [cpaneld] 75.162.171.145 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.114.199.247
country_id: 6252001
description:
[2025-12-26 12:02:44 +0530] info [cpaneld] 99.114.199.247 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.222.131.118
country_id: 6252001
description:
[2025-12-26 12:02:50 +0530] info [cpaneld] 107.222.131.118 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.179.105.117
country_id: 6252001
description:
[2025-12-26 12:03:00 +0530] info [whostmgrd] 98.179.105.117 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 12:04:10 host2 sshd[611743]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.59.192.250
country_id: 6252001
description:
[2025-12-26 12:04:31 +0530] info [whostmgrd] 184.59.192.250 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.72.38.66
country_id: 6252001
description:
[2025-12-26 12:04:32 +0530] info [cpaneld] 73.72.38.66 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.44.61
country_id: 6252001
description:
[2025-12-26 12:04:33 +0530] info [cpaneld] 129.222.44.61 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.72.156
country_id: 6252001
description:
[2025-12-26 12:04:35 +0530] info [cpaneld] 76.32.72.156 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.4
country_id: 2750405
description:
Dec 26 12:04:37 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 2 secs): user=<>, rip=31.14.32.4, lip=66.85.158.92, TLS, session=<4spdFtVG3K4fDiAE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.91.128.251
country_id: 6252001
description:
[2025-12-26 12:04:26 +0530] info [cpaneld] 24.91.128.251 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.133.157.149
country_id: 6252001
description:
[2025-12-26 12:04:28 +0530] info [cpaneld] 76.133.157.149 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.23.39
country_id: 6252001
description:
[2025-12-26 12:04:29 +0530] info [cpaneld] 47.149.23.39 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-12-26 12:06:01 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:38335: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.4
country_id: 2750405
description:
Dec 26 12:05:10 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=31.14.32.4, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Uh9QGNVGAOAfDiAE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-26 12:05:30 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:45633: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-12-26 12:09:41 dovecot_login authenticator failed for H=([36.37.181.181]) [36.37.181.181]:33840: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.236
country_id: 294640
description:
2025-12-26 12:09:55 dovecot_login authenticator failed for H=(2-54-99-236.orange.net.il) [2.54.99.236]:55697: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.132
country_id: 3469034
description:
Dec 26 12:11:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=191.240.36.132, lip=66.85.158.91, TLS, session=<npbtLNVGb9O/8CSE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.12.32
country_id: 798544
description:
Dec 26 12:11:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=89.186.12.32, lip=66.85.158.91, TLS, session=<e4nwLdVGsM1Zugwg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.50.220
country_id: 953987
description:
Dec 26 12:11:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact>, method=PLAIN, rip=102.129.50.220, lip=66.85.158.91, TLS, session=<X28bLtVGD95mgTLc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.12
country_id: 3175395
description:
Dec 26 12:11:11 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=217.26.178.12, lip=66.85.158.91, TLS, session=<kHffLNVGVMbZGrIM>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.22
country_id: 1880251
description:
Dec 26 12:13:52 host2 sshd[621662]: Disconnected from invalid user miladmim 101.47.51.22 port 38052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.22
country_id: 1880251
description:
Dec 26 12:17:32 host2 sshd[625316]: Disconnected from invalid user frappe 101.47.51.22 port 57774 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.22
country_id: 1880251
description:
Dec 26 12:21:19 host2 sshd[628600]: Disconnected from invalid user testuser 101.47.51.22 port 43060 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 179.0.249.49
country_id: 3865483
description:
Dec 26 12:24:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=179.0.249.49, lip=66.85.158.91, TLS, session=<ezSTW9VGouOzAPkx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.130.207.89
country_id: 2623032
description:
Dec 26 12:24:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=212.130.207.89, lip=66.85.158.91, TLS, session=<DHLWXNVGetnUgs9Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.36
country_id: 99237
description:
2025-12-26 12:25:58 dovecot_login authenticator failed for H=([65.20.150.36]) [65.20.150.36]:40120: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 26 12:26:09 host2 sshd[632840]: Disconnected from invalid user test 154.198.215.66 port 39400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 26 12:26:20 host2 sshd[633000]: Disconnected from invalid user dev 95.231.213.73 port 53472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 26 12:26:44 host2 sshd[633213]: Disconnected from invalid user backend 66.116.199.234 port 44710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 26 12:27:25 host2 sshd[633619]: Disconnected from invalid user sshtunnel 66.116.199.234 port 36400 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.215.66
country_id: 241170
description:
Dec 26 12:27:28 host2 sshd[633658]: Disconnected from invalid user VPN 154.198.215.66 port 35348 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 12:28:59 host2 sshd[634752]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.78
country_id: 1269750
description:
2025-12-26 12:29:07 dovecot_login authenticator failed for H=(nsg-corporate-78.225.187.122.airtel.in) [122.187.225.78]:33799: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 26 12:28:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<Xpj/bNVGxr6LonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.142
country_id: 1269750
description:
2025-12-26 12:29:39 dovecot_login authenticator failed for H=([152.52.238.92]) [182.95.184.142]:59942: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 26 12:30:50 host2 sshd[636217]: Disconnected from invalid user wangbo 206.81.27.245 port 36012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 26 12:32:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<TtJceNVGvP/CpRCm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 12:32:01 host2 pure-ftpd[637080]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 26 12:32:04 host2 sshd[637177]: Disconnected from invalid user testadmin 95.231.213.73 port 47914 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.13.24.157
country_id: 2464461
description:
Dec 26 12:32:37 host2 sshd[637641]: Disconnected from invalid user VPN 197.13.24.157 port 42710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 26 12:33:22 host2 sshd[638351]: Disconnected from invalid user wangbo 95.231.213.73 port 51358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.231.213.73
country_id: 3175395
description:
Dec 26 12:35:05 host2 sshd[640023]: Disconnected from invalid user oleg 95.231.213.73 port 35894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.13.24.157
country_id: 2464461
description:
Dec 26 12:34:20 host2 sshd[639256]: Disconnected from invalid user sshtunnel 197.13.24.157 port 48696 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-12-26 12:34:36 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:51032: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.199.234
country_id: 1269750
description:
Dec 26 12:35:29 host2 sshd[640400]: Disconnected from invalid user botuser 66.116.199.234 port 39290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Dec 26 12:36:21 host2 sshd[641103]: Disconnected from invalid user sara 51.254.103.32 port 40802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 26 12:36:39 host2 sshd[641284]: Disconnected from invalid user ubuntu 206.81.27.245 port 39844 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-12-26 12:37:07 dovecot_login authenticator failed for H=([130.185.96.113]) [130.185.96.113]:53870: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.254.103.32
country_id: 3017382
description:
Dec 26 12:36:21 host2 sshd[641103]: Received disconnect from 51.254.103.32 port 40802:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.159
country_id: 3144096
description:
2025-12-26 12:37:24 dovecot_login authenticator failed for H=(159-161-97-62.cust.smartcall.no) [62.97.161.159]:60602: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.81.27.245
country_id: 2921044
description:
Dec 26 12:37:42 host2 sshd[642206]: Disconnected from invalid user ubuntu 206.81.27.245 port 45564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-26 12:38:50 dovecot_login authenticator failed for H=([128.185.235.110]) [128.185.235.110]:53786: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-12-26 12:39:09 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:44506: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.9
country_id: 6252001
description:
Dec 26 12:43:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.230.168.9, lip=66.85.158.91, TLS handshaking: Connection closed, session=<J3eTotVGsZ9b5qgJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 26 12:43:57 host2 sshd[647745]: Disconnected from invalid user server 192.210.233.234 port 57760 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.11
country_id: 6252001
description:
Dec 26 12:44:00 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.230.168.11, lip=66.85.158.91, TLS: Connection closed, session=<OoQyo9VGe8Rb5qgL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.34.166
country_id: 1819730
description:
Dec 26 12:43:29 host2 sshd[647409]: Disconnected from invalid user xerox 118.193.34.166 port 18150 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.3
country_id: 6252001
description:
Dec 26 12:44:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.3, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</lRXpNVGq8Zb5qgD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.15
country_id: 6252001
description:
Dec 26 12:44:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.15, lip=66.85.158.91, TLS: Connection closed, session=<17+FpNVGhZVb5qgP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.34.166
country_id: 1819730
description:
Dec 26 12:44:40 host2 sshd[648438]: Disconnected from invalid user merlin 118.193.34.166 port 36146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 26 12:44:51 host2 sshd[648577]: Disconnected from invalid user henry 192.210.233.234 port 41280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.34.166
country_id: 1819730
description:
Dec 26 12:45:18 host2 sshd[649119]: Disconnected from invalid user sk 118.193.34.166 port 47980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.34.166
country_id: 1819730
description:
Dec 26 12:45:54 host2 sshd[649919]: Disconnected from invalid user bodega 118.193.34.166 port 59804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.210.233.234
country_id: 6252001
description:
Dec 26 12:46:44 host2 sshd[650644]: Disconnected from invalid user ubuntu 192.210.233.234 port 44818 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.144
country_id: 6252001
description:
Dec 26 12:47:06 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.144, lip=66.85.158.91, session=<PKlTrtVGMu3G6xiQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.168
country_id: 6252001
description:
Dec 26 12:46:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.168, lip=66.85.158.92, session=<aBdoq9VG4OLG6xio>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-26 12:52:01 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:60450: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-12-26 12:52:21 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:41898: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.31
country_id: 1835841
description:
Dec 26 12:52:27 host2 sshd[656276]: Disconnected from invalid user leonardo 43.164.134.31 port 48454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.137.216
country_id: 1835841
description:
Dec 26 12:53:38 host2 sshd[657307]: Disconnected from invalid user internal 43.128.137.216 port 34890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Dec 26 12:53:53 host2 sshd[657492]: Disconnected from invalid user unity 103.161.207.2 port 45690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Dec 26 12:55:23 host2 sshd[659266]: Disconnected from invalid user unix 152.32.252.65 port 40276 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.161.207.2
country_id: 1643084
description:
Dec 26 12:55:27 host2 sshd[659326]: Disconnected from invalid user sample 103.161.207.2 port 43180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Dec 26 12:56:36 host2 sshd[660817]: Disconnected from invalid user desarrollo 152.32.252.65 port 38250 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.55.85.202
country_id: 337996
description:
Dec 26 12:58:07 host2 sshd[662366]: Disconnected from invalid user mythtv 213.55.85.202 port 3926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.137.216
country_id: 1835841
description:
Dec 26 12:57:26 host2 sshd[661676]: Disconnected from invalid user pagar 43.128.137.216 port 59254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 26 12:58:26 host2 sshd[662720]: Disconnected from invalid user apagar 34.66.72.251 port 43796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.164.134.31
country_id: 1835841
description:
Dec 26 12:58:33 host2 sshd[662796]: Disconnected from invalid user coin 43.164.134.31 port 48648 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.128.137.216
country_id: 1835841
description:
Dec 26 12:59:36 host2 sshd[663888]: Disconnected from invalid user bodega 43.128.137.216 port 59314 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-26 13:00:25 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:38990: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-26 13:08:25 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:42658: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.225.186
country_id: 1269750
description:
2025-12-26 13:13:58 dovecot_login authenticator failed for H=([125.20.232.156]) [128.185.225.186]:36356: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.19
country_id: 1733045
description:
2025-12-26 13:14:27 dovecot_login authenticator failed for H=([49.124.153.19]) [49.124.153.19]:40770: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 13:16:46 host2 sshd[678641]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-12-26 13:18:30 dovecot_login authenticator failed for H=(113-11-34-221-smile.com.bd) [113.11.34.221]:48420: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-26 13:18:50 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:54082: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.206
country_id: 3017382
description:
Dec 26 13:23:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.206, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RJazMNZGwYRb51nO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.204
country_id: 3017382
description:
Dec 26 13:23:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.204, lip=66.85.158.91, TLS: Connection closed, session=<W0dTMdZGd9lb51nM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.119
country_id: 3017382
description:
Dec 26 13:23:56 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.119, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Ft0BMtZGB9Vb51l3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.112
country_id: 3017382
description:
Dec 26 13:23:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.112, lip=66.85.158.91, TLS: Connection closed, session=<oukxMtZGIaNb51lw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.255.158.241
country_id: 1643084
description:
2025-12-26 13:24:05 dovecot_login authenticator failed for H=([101.255.158.242]) [101.255.158.241]:60291: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-12-26 13:24:37 dovecot_login authenticator failed for H=(dhcp-192-211-156.in2cable.com) [203.192.211.156]:35420: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.219.57.146
country_id: 2510769
description:
[2025-12-26 13:24:42 +0530] info [cpaneld] 185.219.57.146 - corewebm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User corewebm has their account suspended. Login blocked.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.240.224
country_id: 2510769
description:
Dec 26 13:24:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.74.240.224, lip=66.85.158.91, TLS, session=<2N0UNNZGS7m5SvDg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.134
country_id: 690791
description:
Dec 26 13:25:05 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=194.44.140.134, lip=66.85.158.91, TLS, session=<Q0snNdZG/snCLIyG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.226.132.141
country_id: 6252001
description:
[2025-12-26 13:26:06 +0530] info [cpaneld] 73.226.132.141 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 168.91.244.67
country_id: 6252001
description:
[2025-12-26 13:26:08 +0530] info [cpaneld] 168.91.244.67 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.186.75
country_id: 6252001
description:
[2025-12-26 13:26:12 +0530] info [cpaneld] 172.59.186.75 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.23.154.226
country_id: 6252001
description:
[2025-12-26 13:26:14 +0530] info [whostmgrd] 73.23.154.226 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.43.190.93
country_id: 6252001
description:
[2025-12-26 13:26:15 +0530] info [cpaneld] 73.43.190.93 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.31.94.63
country_id: 6252001
description:
[2025-12-26 13:26:16 +0530] info [cpaneld] 65.31.94.63 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.35.253.81
country_id: 6252001
description:
[2025-12-26 13:26:17 +0530] info [cpaneld] 104.35.253.81 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.210.189.16
country_id: 3277605
description:
Dec 26 13:28:23 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=178.210.189.16, lip=66.85.158.91, TLS, session=<QY/wQNZGrqqy0r0Q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.100.196
country_id: 798544
description:
Dec 26 13:28:41 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=85.202.100.196, lip=66.85.158.91, TLS, session=<4c0EQtZG57hVymTE>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.124.197.37
country_id: 3017382
description:
[2025-12-26 13:34:21 +0530] info [cpaneld] 88.124.197.37 - dragon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 13:35:13 host2 pure-ftpd[693990]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-26 13:36:15 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:62088: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.102.252.82
country_id: 1819730
description:
2025-12-26 13:36:29 dovecot_login authenticator failed for H=pcd720082.netvigator.com [218.102.252.82]:35448: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.156.6.147
country_id: 3144096
description:
2025-12-26 13:36:42 dovecot_login authenticator failed for H=(cm-78.156.6.147.get.no) [78.156.6.147]:46117: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2025-12-26 13:41:31 dovecot_login authenticator failed for H=([125.16.78.137]) [182.95.123.202]:37818: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.164.55
country_id: 3996063
description:
2025-12-26 13:41:58 dovecot_login authenticator failed for H=([177.239.164.55]) [177.239.164.55]:39569: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 13:44:30 host2 sshd[700986]: Disconnected from invalid user admin 2.57.121.112 port 25184 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.116
country_id: 6252001
description:
Dec 26 13:45:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.116, lip=66.85.158.92, TLS handshaking: Connection closed, session=<S7hqgNZG2NlChJl0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Dec 26 13:51:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.227.254.152, lip=66.85.158.91, session=<gpVNldZGsf4t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.132.32.143
country_id: 6252001
description:
2025-12-26 13:52:50 dovecot_login authenticator failed for H=(syn-072-132-032-143.res.spectrum.com) [72.132.32.143]:34030: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.49
country_id: 1819730
description:
2025-12-26 13:53:02 dovecot_login authenticator failed for H=(182.239.78.49.hk.chinamobile.com) [182.239.78.49]:44704: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-26 13:53:22 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:39822: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-12-26 13:54:00 dovecot_login authenticator failed for H=([125.17.48.129]) [152.52.210.118]:44370: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 14:00:13 host2 sshd[714153]: Disconnected from invalid user user 2.57.121.25 port 44917 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.161.168.237
country_id: 6252001
description:
[2025-12-26 14:04:18 +0530] info [cpaneld] 73.161.168.237 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.185.16.251
country_id: 6252001
description:
[2025-12-26 14:04:20 +0530] info [cpaneld] 173.185.16.251 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.153.43.3
country_id: 6252001
description:
[2025-12-26 14:04:21 +0530] info [cpaneld] 99.153.43.3 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 134.228.120.155
country_id: 6252001
description:
[2025-12-26 14:04:22 +0530] info [whostmgrd] 134.228.120.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.178.239.247
country_id: 6252001
description:
[2025-12-26 14:04:23 +0530] info [cpaneld] 71.178.239.247 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.214.100.207
country_id: 6252001
description:
[2025-12-26 14:04:25 +0530] info [cpaneld] 76.214.100.207 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.171.130.15
country_id: 6252001
description:
[2025-12-26 14:04:26 +0530] info [cpaneld] 97.171.130.15 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.181.42
country_id: 3686110
description:
Dec 26 14:07:31 host2 sshd[720557]: Disconnected from invalid user ubuntu 152.200.181.42 port 49033 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.220
country_id: 2635167
description:
Dec 26 14:11:08 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.220, lip=66.85.158.92, TLS, session=<VqjW2tZGo6lX7LDc>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 14:14:20 host2 sshd[727058]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.227
country_id: 3865483
description:
Dec 26 14:18:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=179.0.250.227, lip=66.85.158.91, TLS, session=<4afD8tZGp5uzAPrj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.28.249
country_id: 2300660
description:
Dec 26 14:17:46 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=41.139.28.249, lip=66.85.158.91, TLS, session=<PU5Y8dZGRoQpixz5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-26 14:22:47 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:39183: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-26 14:23:22 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:49444: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.26.179.239
country_id: 3175395
description:
Dec 26 14:26:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=217.26.179.239, lip=66.85.158.91, TLS, session=<iAwIEtdGYbTZGrPv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.14.79.82
country_id: 6252001
description:
Dec 26 14:27:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.14.79.82, lip=66.85.158.91, session=<9fzPE9dGJtQUDk9S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.196.87.135
country_id: 3469034
description:
Dec 26 14:27:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=131.196.87.135, lip=66.85.158.91, TLS, session=<L9YsE9dG+IODxFeH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2025-12-26 14:30:10 dovecot_login authenticator failed for H=([182.95.119.30]) [182.95.119.30]:39558: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.13
country_id: 1733045
description:
2025-12-26 14:30:29 dovecot_login authenticator failed for H=([49.124.153.13]) [49.124.153.13]:33154: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.78
country_id: 3624060
description:
2025-12-26 14:33:47 dovecot_login authenticator failed for H=([186.177.88.78]) [186.177.88.78]:60070: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-12-26 14:33:33 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:38683: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-26 14:35:25 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:50200: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.65
country_id: 6252001
description:
Dec 26 14:36:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.104.65, lip=66.85.158.92, session=<6JZaNddGYrcUQGhB>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 14:38:05 host2 pure-ftpd[747573]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-12-26 14:39:21 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:44570: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.37.221.141
country_id: 6252001
description:
[2025-12-26 14:40:27 +0530] info [cpaneld] 73.37.221.141 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-26 14:40:13 dovecot_login authenticator failed for H=([27.123.102.50]) [27.123.102.50]:42294: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.198.1.170
country_id: 6252001
description:
[2025-12-26 14:40:18 +0530] info [cpaneld] 71.198.1.170 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.59.225.184
country_id: 6252001
description:
[2025-12-26 14:40:22 +0530] info [cpaneld] 208.59.225.184 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.194.111.8
country_id: 6252001
description:
[2025-12-26 14:40:25 +0530] info [cpaneld] 71.194.111.8 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.101.11.131
country_id: 6252001
description:
[2025-12-26 14:40:21 +0530] info [cpaneld] 76.101.11.131 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.12.89.188
country_id: 6252001
description:
[2025-12-26 14:40:23 +0530] info [whostmgrd] 24.12.89.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.65.197.62
country_id: 6252001
description:
[2025-12-26 14:40:26 +0530] info [cpaneld] 108.65.197.62 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.202
country_id: 1880251
description:
Dec 26 14:44:42 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.202, lip=66.85.158.91, session=<Pz7lUtdGg8te587K>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.207
country_id: 1880251
description:
Dec 26 14:44:53 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.207, lip=66.85.158.91, session=<fz6EU9dGR6de587P>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.205
country_id: 1880251
description:
Dec 26 14:45:10 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.205, lip=66.85.158.91, session=<edqKVNdGJ+de587N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.154
country_id: 1880251
description:
Dec 26 14:45:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.154, lip=66.85.158.91, session=<FV6/VNdGBaRe586a>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.11.44
country_id: 6252001
description:
[2025-12-26 14:46:47 +0530] info [cpaneld] 172.56.11.44 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.184.178.78
country_id: 6252001
description:
[2025-12-26 14:46:50 +0530] info [cpaneld] 173.184.178.78 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.124.183.147
country_id: 6252001
description:
[2025-12-26 14:46:52 +0530] info [cpaneld] 23.124.183.147 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.48.113.162
country_id: 6252001
description:
[2025-12-26 14:46:54 +0530] info [cpaneld] 45.48.113.162 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.23.48.36
country_id: 6252001
description:
[2025-12-26 14:46:43 +0530] info [cpaneld] 98.23.48.36 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.9.131.116
country_id: 6252001
description:
[2025-12-26 14:46:44 +0530] info [cpaneld] 71.9.131.116 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.23.191.0
country_id: 6252001
description:
[2025-12-26 14:46:48 +0530] info [whostmgrd] 75.23.191.0 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.4
country_id: 1814991
description:
Dec 26 14:49:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.4, lip=66.85.158.91, session=<5cP7ZNdG75Be584E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.0
country_id: 1814991
description:
Dec 26 14:49:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.0, lip=66.85.158.91, session=<Bf2aZddGb5Ze584A>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.2
country_id: 1814991
description:
Dec 26 14:50:20 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.2, lip=66.85.158.91, session=<6rgKZ9dGMdpe584C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.8
country_id: 1814991
description:
Dec 26 14:50:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.8, lip=66.85.158.91, session=<dBI/Z9dGHahe584I>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 14:52:56 host2 sshd[760493]: Disconnected from invalid user admin 2.57.121.112 port 22069 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec 26 14:53:42 host2 sshd[760985]: Disconnected from invalid user walter 193.106.245.20 port 58904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Dec 26 14:53:58 host2 sshd[761174]: Disconnected from invalid user sajid 41.111.162.34 port 36351 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-12-26 14:54:10 dovecot_login authenticator failed for H=([128.185.189.57]) [182.78.79.134]:40332: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-12-26 14:54:29 dovecot_login authenticator failed for H=([210.177.143.61]) [210.177.143.61]:35092: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.106.245.20
country_id: 798544
description:
Dec 26 14:55:36 host2 sshd[763366]: Disconnected from invalid user distro 193.106.245.20 port 33491 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Dec 26 14:56:28 host2 sshd[763988]: Disconnected from invalid user zgr 41.111.162.34 port 9495 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.106.245.20
country_id: 798544
description:
Dec 26 14:57:29 host2 sshd[765051]: Disconnected from invalid user maha 193.106.245.20 port 51381 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 26 14:57:31 host2 sshd[765069]: Disconnected from invalid user odin 187.210.77.100 port 45072 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 26 14:58:55 host2 sshd[765707]: Disconnected from invalid user tfj 187.210.77.100 port 56598 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 15:02:12 host2 sshd[767657]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.84.202.144
country_id: 1269750
description:
Dec 26 15:07:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=103.84.202.144, lip=66.85.158.91, TLS, session=<RQcPpNdGsrFnVMqQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.129.206.42
country_id: 3469034
description:
Dec 26 15:08:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.129.206.42, lip=66.85.158.91, TLS, session=<WmRdpddG3saxgc4q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-26 15:08:52 dovecot_login authenticator failed for H=([12.202.15.69]) [12.202.15.69]:47561: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-26 15:09:18 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:47166: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.254.2
country_id: 6252001
description:
Dec 26 15:10:33 host2 sshd[774212]: Disconnected from invalid user arjun 165.154.254.2 port 42240 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.254.2
country_id: 6252001
description:
Dec 26 15:11:15 host2 sshd[774938]: Disconnected from invalid user vpsuser 165.154.254.2 port 54030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-26 15:20:48 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:57906: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.60.138
country_id: 2300660
description:
Dec 26 15:40:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=41.139.60.138, lip=66.85.158.91, TLS, session=<+3bnGNhGxJEpizyK>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 15:40:51 host2 pure-ftpd[799981]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.255.73.196
country_id: 1269750
description:
Dec 26 15:40:58 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00>, method=PLAIN, rip=103.255.73.196, lip=66.85.158.91, TLS, session=<vrb5GthGIoVn/0nE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.14
country_id: 241170
description:
Dec 26 15:43:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.14, lip=66.85.158.91, session=<WUdeI9hGbsPE+2YO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:44:24 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Z29bKNhGrJQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:45:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<GUAxLNhGVO0DlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Dec 26 15:45:45 host2 sshd[803849]: Disconnected from invalid user zeppelin 128.199.168.119 port 41030 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:46:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dJvaLthGyq4DlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.244.88
country_id: 1819730
description:
Dec 26 15:47:40 host2 sshd[805657]: Disconnected from invalid user portal 165.154.244.88 port 50572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.168.119
country_id: 1880251
description:
Dec 26 15:47:48 host2 sshd[805753]: Disconnected from invalid user dave 128.199.168.119 port 41660 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.199.168.119
country_id: 1880251
description:
Dec 26 15:48:35 host2 sshd[806667]: Disconnected from invalid user guest1 128.199.168.119 port 55788 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:48:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<WILiN9hGGqUDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:49:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS, session=<AQ7iO9hGmtYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:51:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<s/twQNhGjMkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.11
country_id: 798549
description:
Dec 26 15:51:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.11, lip=66.85.158.91, TLS: Connection closed, session=</135QNhGPMBV2YwL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.16.194.197
country_id: 3865483
description:
Dec 26 15:51:40 host2 sshd[822189]: Disconnected from invalid user smbguest 190.16.194.197 port 34056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.244.88
country_id: 1819730
description:
Dec 26 15:52:07 host2 sshd[822517]: Disconnected from invalid user soporte 165.154.244.88 port 32850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.16.194.197
country_id: 3865483
description:
Dec 26 15:52:26 host2 sshd[822833]: Disconnected from invalid user soporte 190.16.194.197 port 48492 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:52:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<OW5HRdhGJMkDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.11
country_id: 798549
description:
Dec 26 15:52:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=85.217.140.11, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<aHiNRthG+r1V2YwL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 26 15:53:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<AyqjSdhGYKQDlTsa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.16.194.197
country_id: 3865483
description:
Dec 26 15:53:11 host2 sshd[823349]: Disconnected from invalid user jens 190.16.194.197 port 34694 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.10
country_id: 798549
description:
Dec 26 15:54:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.10, lip=66.85.158.91, session=<bptrTNhGapXUSZQK>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 15:59:59 host2 sshd[830086]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-26 15:59:57 dovecot_login authenticator failed for H=([182.95.63.50]) [182.95.63.50]:36432: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.210.73.33
country_id: 3469034
description:
2025-12-26 16:00:19 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [191.210.73.33]:55313: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-26 16:16:24 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:46440: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-12-26 16:16:46 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:42526: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-26 16:24:09 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:55976: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.56.146.181
country_id: 294640
description:
[2025-12-26 16:24:30 +0530] info [cpaneld] 62.56.146.181 - dragon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-26 16:24:47 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:43932: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-26 16:24:58 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:52906: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 16:43:41 host2 pure-ftpd[869592]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 16:47:53 host2 sshd[873650]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 16:50:28 host2 sshd[875924]: Disconnected from invalid user user 2.57.121.25 port 33538 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.5.108.11
country_id: 2186224
description:
Dec 26 16:56:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<designdpt>, method=PLAIN, rip=103.5.108.11, lip=66.85.158.91, TLS, session=<XeM3KtlGI4NnBWwL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.56
country_id: 3469034
description:
Dec 26 16:56:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=187.120.76.56, lip=66.85.158.91, TLS, session=<APz6KNlGXM67eEw4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.93
country_id: 3175395
description:
Dec 26 16:58:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.197.8.93, lip=66.85.158.91, TLS, session=<wCU+MNlG7IW5xQhd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.250
country_id: 298795
description:
Dec 26 16:58:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=45.67.155.250, lip=66.85.158.91, TLS, session=<OpNzMdlGB4YtQ5v6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.131.157
country_id: 130758
description:
Dec 26 17:00:21 host2 sshd[885118]: Disconnected from invalid user  62.60.131.157 port 50934 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.178.225.45
country_id: 6252001
description:
[2025-12-26 17:00:58 +0530] info [cpaneld] 73.178.225.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.184.237.243
country_id: 6252001
description:
[2025-12-26 17:00:59 +0530] info [cpaneld] 192.184.237.243 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.222.161.239
country_id: 6252001
description:
[2025-12-26 17:01:02 +0530] info [whostmgrd] 98.222.161.239 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.34.96.107
country_id: 6252001
description:
[2025-12-26 17:01:03 +0530] info [cpaneld] 136.34.96.107 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.123.197.161
country_id: 6252001
description:
[2025-12-26 17:01:04 +0530] info [cpaneld] 99.123.197.161 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.96.10
country_id: 6252001
description:
[2025-12-26 17:01:01 +0530] info [cpaneld] 172.56.96.10 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.175.123.52
country_id: 6252001
description:
[2025-12-26 17:01:03 +0530] info [cpaneld] 67.175.123.52 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec 26 17:01:46 host2 pure-ftpd[886314]: (?@66.132.153.112) [INFO] New connection from 66.132.153.112


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-26 17:02:17 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:61493: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 121.52.147.5
country_id: 1168579
description:
Dec 26 17:05:35 host2 sshd[889597]: Disconnected from invalid user marcela 121.52.147.5 port 41816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.214.145
country_id: 1562822
description:
Dec 26 17:07:15 host2 sshd[890903]: Disconnected from invalid user sjen 165.154.214.145 port 40200 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.251.206.110
country_id: 3932488
description:
Dec 26 17:08:41 host2 pure-ftpd[892293]: (?@132.251.206.110) [INFO] New connection from 132.251.206.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-12-26 17:10:41 dovecot_login authenticator failed for H=([223.197.145.141]) [223.197.145.141]:55681: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 17:11:12 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:33572: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.52.51
country_id: 2921044
description:
[2025-12-26 17:13:37 +0530] info [webmaild] 178.16.52.51 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.83.135.122
country_id: 6251999
description:
2025-12-26 17:14:11 dovecot_login authenticator failed for H=([24.83.135.122]) [24.83.135.122]:39202: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2025-12-26 17:14:23 dovecot_login authenticator failed for H=([182.95.49.166]) [182.95.49.166]:54170: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.203
country_id: 3144096
description:
2025-12-26 17:17:19 dovecot_login authenticator failed for H=(cm-84.211.13.203.get.no) [84.211.13.203]:35579: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.190
country_id: 2287781
description:
2025-12-26 17:17:30 dovecot_login authenticator failed for H=([160.154.84.190]) [160.154.84.190]:7157: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-26 17:19:58 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:48264: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-12-26 17:20:22 dovecot_login authenticator failed for H=([103.67.152.201]) [103.67.152.201]:59924: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 26 17:24:11 host2 sshd[906639]: Disconnected from invalid user user 2.57.121.25 port 42451 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 17:32:25 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:58418: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-26 17:33:13 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [119.160.166.237]:58834: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-26 17:36:57 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:33322: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.102.252.82
country_id: 1819730
description:
2025-12-26 17:37:41 dovecot_login authenticator failed for H=pcd720082.netvigator.com [218.102.252.82]:52660: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-12-26 17:37:42 dovecot_login authenticator failed for H=ip-64-21-235-162.ideaone.net [64.21.235.162]:34391: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.223.20.191
country_id: 2077456
description:
2025-12-26 17:37:56 dovecot_login authenticator failed for H=194-223-20-191.tpgi.com.au [194.223.20.191]:55915: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-26 17:37:29 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:52398: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2025-12-26 17:38:53 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:52862: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.103.3.153
country_id: 690791
description:
Dec 26 17:38:59 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=176.103.3.153, lip=66.85.158.91, TLS, session=<2hDpwNlGRKWwZwOZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.230
country_id: 1149361
description:
2025-12-26 17:39:05 dovecot_login authenticator failed for H=([149.54.51.230]) [149.54.51.230]:48583: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.9.200.229
country_id: 2510769
description:
2025-12-26 17:39:19 dovecot_login authenticator failed for H=229.red-88-9-200.dynamicip.rima-tde.net [88.9.200.229]:39983: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-12-26 17:40:01 dovecot_login authenticator failed for H=([50.217.40.11]) [50.217.40.11]:46324: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.178
country_id: 3175395
description:
Dec 26 17:39:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.9.178, lip=66.85.158.91, TLS, session=<nyU2wtlGkee5xQmy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 26 17:43:16 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS handshaking: Connection closed, session=<j8l90dlGxqpChJly>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 17:45:47 host2 sshd[924670]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 17:46:25 host2 pure-ftpd[925210]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.12.169
country_id: 6252001
description:
Dec 26 17:50:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.168.12.169, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<2L1d7NlGVrUUqAyp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 190.89.137.32
country_id: 3469034
description:
Dec 26 17:52:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=190.89.137.32, lip=66.85.158.91, TLS, session=<G0518tlGKua+WYkg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.11.61
country_id: 3469034
description:
Dec 26 17:53:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.37.11.61, lip=66.85.158.91, TLS, session=<ygjE89lGmpq/JQs9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.10.108.159
country_id: 3469034
description:
Dec 26 17:55:33 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=177.10.108.159, lip=66.85.158.91, TLS, session=<XmsG/NlGJa2xCmyf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.39.212.84
country_id: 2510769
description:
Dec 26 17:55:54 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=46.39.212.84, lip=66.85.158.91, TLS, session=<QBF7/dlG0NYuJ9RU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2025-12-26 17:57:08 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:38272: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.109.23
country_id: 1512440
description:
2025-12-26 17:56:47 dovecot_login authenticator failed for H=([213.230.109.23]) [213.230.109.23]:25929: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 26 17:56:55 host2 sshd[934239]: Disconnected from invalid user element 108.173.137.12 port 48476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-12-26 17:58:33 dovecot_login authenticator failed for H=(nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:45600: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 26 17:58:45 host2 sshd[936055]: Disconnected from invalid user rstudio 108.173.137.12 port 40362 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-26 17:58:59 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:34333: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 26 17:59:20 host2 sshd[936552]: Disconnected from invalid user croceiris 108.173.137.12 port 34192 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.82.84.134
country_id: 1819730
description:
Dec 26 17:59:11 host2 sshd[936397]: Disconnected from invalid user april 154.82.84.134 port 48302 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 108.173.137.12
country_id: 6251999
description:
Dec 26 18:00:25 host2 sshd[938445]: Disconnected from invalid user hduser 108.173.137.12 port 36958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.82.84.134
country_id: 1819730
description:
Dec 26 18:00:29 host2 sshd[938497]: Disconnected from invalid user hub 154.82.84.134 port 33126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-12-26 18:01:08 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee [83.166.50.15]:37112: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2025-12-26 18:01:41 dovecot_login authenticator failed for H=([109.248.156.49]) [109.248.156.49]:53142: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.30.137
country_id: 290557
description:
2025-12-26 18:02:52 dovecot_login authenticator failed for H=([94.207.30.137]) [94.207.30.137]:39531: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-26 18:06:56 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:45104: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-12-26 18:08:08 dovecot_login authenticator failed for H=(vtx-b-124-014.virtex.com.br) [179.125.124.14]:56704: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-12-26 18:19:48 dovecot_plain authenticator failed for H=(molorakin) [65.20.129.67]:48737: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 26 18:29:10 host2 sshd[964304]: Disconnected from invalid user roman 81.30.162.18 port 57660 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.30.162.18
country_id: 690791
description:
Dec 26 18:29:41 host2 sshd[964818]: Disconnected from invalid user rene 81.30.162.18 port 35172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 18:29:51 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<IFMKeNpGKu4DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 26 18:30:12 host2 sshd[965840]: Disconnected from invalid user student 81.30.162.18 port 40919 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 18:30:20 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<CrzGedpGOqwDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 26 18:31:47 host2 sshd[966962]: Disconnected from invalid user amit 81.30.162.18 port 58152 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 18:31:50 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Edgjf9pGvsQDhBfJ>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 81.30.162.18
country_id: 690791
description:
Dec 26 18:31:47 host2 sshd[966962]: Received disconnect from 81.30.162.18 port 58152:11: Bye Bye [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 18:33:38 host2 sshd[968330]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 18:34:01 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<7Hj9htpGgtQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 18:35:31 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=</HBcjNpGEJoDhBfJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.23.73.166
country_id: 6252001
description:
[2025-12-26 18:35:35 +0530] info [cpaneld] 72.23.73.166 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.196.238.50
country_id: 6252001
description:
[2025-12-26 18:35:39 +0530] info [whostmgrd] 73.196.238.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.157.202.33
country_id: 6252001
description:
[2025-12-26 18:35:42 +0530] info [cpaneld] 47.157.202.33 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 131.150.22.96
country_id: 6252001
description:
[2025-12-26 18:35:43 +0530] info [cpaneld] 131.150.22.96 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.51.144.44
country_id: 6252001
description:
[2025-12-26 18:35:37 +0530] info [cpaneld] 73.51.144.44 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.211.82
country_id: 6252001
description:
[2025-12-26 18:35:38 +0530] info [cpaneld] 172.58.211.82 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.121.224
country_id: 6252001
description:
[2025-12-26 18:35:41 +0530] info [cpaneld] 172.56.121.224 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 18:35:46 host2 dovecot[1881837]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<+lRAjdpGnOsDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 26 18:37:25 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<b6gok9pGhrUDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 26 18:46:05 host2 sshd[980164]: Disconnected from invalid user incoming 102.176.81.29 port 54084 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.139
country_id: 6252001
description:
Dec 26 18:48:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.139, lip=66.85.158.91, session=<9OMtu9pGH8Rb5qiL>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 26 18:49:02 host2 sshd[982787]: Disconnected from invalid user test 102.176.81.29 port 53618 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.189
country_id: 6252001
description:
Dec 26 18:48:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.189, lip=66.85.158.91, session=<aA6TutpGsbZb5qi9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-26 18:48:39 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (linimalic) [68.40.189.43]:40384: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.142
country_id: 6252001
description:
Dec 26 18:48:48 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.142, lip=66.85.158.91, session=<9+HWu9pGpdRb5qiO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.138
country_id: 6252001
description:
Dec 26 18:48:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.138, lip=66.85.158.91, session=<wLMEvNpGNadb5qiK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 18:49:55 host2 sshd[983555]: Disconnected from invalid user admin 2.57.121.112 port 30254 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 18:49:40 host2 pure-ftpd[983348]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.72.59
country_id: 3996063
description:
2025-12-26 18:49:53 dovecot_login authenticator failed for H=(201.173.72.59-clientes-izzi.mx) [201.173.72.59]:47523: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Dec 26 18:50:08 host2 sshd[983885]: Disconnected from invalid user orange 34.93.128.179 port 59464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec 26 18:50:25 host2 sshd[984267]: Disconnected from invalid user game 102.176.81.29 port 53378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.222
country_id: 1861060
description:
2025-12-26 18:50:31 dovecot_login authenticator failed for H=(fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.222]:27137: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.93.128.179
country_id: 1269750
description:
Dec 26 18:52:07 host2 sshd[985923]: Disconnected from invalid user deploy 34.93.128.179 port 41482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Dec 26 18:51:31 host2 sshd[985260]: Disconnected from invalid user user1 34.93.128.179 port 59992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 26 18:53:08 host2 sshd[986731]: Disconnected from invalid user alireza 152.32.190.168 port 52954 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.190.168
country_id: 1819730
description:
Dec 26 18:54:58 host2 sshd[988504]: Disconnected from invalid user ubuntu 152.32.190.168 port 57750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.99.116.86
country_id: 1643084
description:
2025-12-26 18:54:19 dovecot_login authenticator failed for H=([118.99.116.86]) [118.99.116.86]:47489: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-12-26 18:54:47 dovecot_login authenticator failed for H=([121.73.168.234]) [121.73.168.234]:49770: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.207.194
country_id: 3175395
description:
Dec 26 18:55:23 host2 sshd[989173]: Disconnected from invalid user release 151.19.207.194 port 36886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Dec 26 18:55:32 host2 sshd[989270]: Disconnected from invalid user sftpuser 45.202.211.6 port 34522 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-12-26 18:55:37 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:48204: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.93.128.179
country_id: 1269750
description:
Dec 26 18:55:51 host2 sshd[989492]: Disconnected from invalid user pt 34.93.128.179 port 46038 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-12-26 18:56:05 dovecot_login authenticator failed for H=([182.78.107.6]) [182.78.107.6]:34940: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.61
country_id: 1819730
description:
Dec 26 18:57:15 host2 sshd[990458]: Disconnected from invalid user r 103.103.245.61 port 42454 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.243.14.52
country_id: 49518
description:
Dec 26 18:57:43 host2 sshd[990824]: Disconnected from invalid user mahmoud 197.243.14.52 port 43736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.103.245.61
country_id: 1819730
description:
Dec 26 18:58:34 host2 sshd[991600]: Disconnected from invalid user testuser 103.103.245.61 port 36536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.207.194
country_id: 3175395
description:
Dec 26 18:59:09 host2 sshd[992024]: Disconnected from invalid user r 151.19.207.194 port 36224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-12-26 19:00:39 dovecot_login authenticator failed for H=(80.130.83.103.static.rapidnet.in) [103.83.130.80]:43365: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-12-26 19:00:48 dovecot_login authenticator failed for H=sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:58745: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.243.14.52
country_id: 49518
description:
Dec 26 19:01:04 host2 sshd[994131]: Disconnected from invalid user qwe 197.243.14.52 port 42622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.22.226
country_id: 3469034
description:
2025-12-26 19:00:21 dovecot_login authenticator failed for H=(187.95.22.226.netjacarei.nipcable.com) [187.95.22.226]:41362: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.103.245.61
country_id: 1819730
description:
Dec 26 19:01:47 host2 sshd[994638]: Disconnected from invalid user ubuntu 103.103.245.61 port 34286 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.125.122
country_id: 6252001
description:
Dec 26 19:01:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.125.122, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<kEah6NpGiqiH7X16>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Dec 26 19:01:32 host2 sshd[994485]: Disconnected from invalid user elasticsearch 45.202.211.6 port 59546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Dec 26 19:02:08 host2 sshd[994955]: Disconnected from invalid user login 45.202.211.6 port 44140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-12-26 19:02:42 dovecot_login authenticator failed for H=(fabfibernet.com) [192.81.229.179]:39588: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-26 19:02:45 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:44548: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-26 19:02:54 dovecot_login authenticator failed for H=(223-30-0-0.lan.sify.net) [136.232.73.130]:42822: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-12-26 19:03:17 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:41322: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.103.253.48
country_id: 1820814
description:
2025-12-26 19:03:54 dovecot_login authenticator failed for H=(48-253.adsl.static.espeed.com.bn) [118.103.253.48]:58134: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.83.15
country_id: 3144096
description:
2025-12-26 19:03:07 dovecot_login authenticator failed for H=(cm-178.232.83.15.get.no) [178.232.83.15]:41333: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.80.103
country_id: 1269750
description:
Dec 26 19:04:22 host2 sshd[996932]: Disconnected from invalid user dharmesh 68.183.80.103 port 33836 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 191.53.132.193
country_id: 3469034
description:
Dec 26 19:10:50 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=191.53.132.193, lip=66.85.158.91, TLS, session=<fkqHCdtGFue/NYTB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.232.65.181
country_id: 3469034
description:
Dec 26 19:11:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.232.65.181, lip=66.85.158.91, TLS, session=<nanCCttGCM4t6EG1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.141.249.102
country_id: 3469034
description:
Dec 26 19:13:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=192.141.249.102, lip=66.85.158.91, TLS, session=<+k8UEdtGp4/Ajflm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2025-12-26 19:13:49 dovecot_login authenticator failed for H=([151.76.55.177]) [151.76.55.177]:43220: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 212.59.224.109
country_id: 798544
description:
Dec 26 19:13:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00>, method=PLAIN, rip=212.59.224.109, lip=66.85.158.91, TLS, session=<xUSCEttGvZ3UO+Bt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.178
country_id: 3144096
description:
2025-12-26 19:14:36 dovecot_login authenticator failed for H=(cm-84.211.13.178.get.no) [84.211.13.178]:41128: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.61
country_id: 2635167
description:
Dec 26 19:17:52 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.61, lip=66.85.158.91, TLS, session=<oufEI9tGsZK594k9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.237
country_id: 3895114
description:
Dec 26 19:18:05 host2 sshd[1009477]: Disconnected from invalid user developer 181.212.34.237 port 43140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2025-12-26 19:18:55 dovecot_login authenticator failed for H=(158.181.19.144.mega.kg) [158.181.19.144]:49159: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.167.210
country_id: 3144096
description:
2025-12-26 19:19:12 dovecot_login authenticator failed for H=(210-167-97-62.cust.smartcall.no) [62.97.167.210]:43830: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.237
country_id: 3895114
description:
Dec 26 19:19:39 host2 sshd[1010629]: Disconnected from invalid user dns 181.212.34.237 port 7710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.123.134.194
country_id: 6252001
description:
Dec 26 19:20:10 host2 sshd[1011204]: Disconnected from invalid user test1 34.123.134.194 port 33216 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-12-26 19:20:36 dovecot_login authenticator failed for H=(syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:61737: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.34.237
country_id: 3895114
description:
Dec 26 19:21:06 host2 sshd[1012127]: Disconnected from invalid user h 181.212.34.237 port 6186 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.60.166
country_id: 6252001
description:
[2025-12-26 19:21:45 +0530] info [cpaneld] 76.33.60.166 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.93.87.146
country_id: 6252001
description:
[2025-12-26 19:21:46 +0530] info [cpaneld] 184.93.87.146 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.33.28
country_id: 6252001
description:
[2025-12-26 19:21:51 +0530] info [cpaneld] 172.59.33.28 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.145.48.171
country_id: 6252001
description:
[2025-12-26 19:21:55 +0530] info [cpaneld] 35.145.48.171 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-12-26 19:21:26 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:57381: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.145
country_id: 2328926
description:
Dec 26 19:21:33 host2 sshd[1012558]: Disconnected from invalid user suriya 102.88.137.145 port 55710 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.238.183.41
country_id: 6252001
description:
[2025-12-26 19:21:47 +0530] info [cpaneld] 70.238.183.41 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.148.159.97
country_id: 6252001
description:
[2025-12-26 19:21:49 +0530] info [whostmgrd] 98.148.159.97 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.201.117.150
country_id: 6252001
description:
[2025-12-26 19:21:54 +0530] info [cpaneld] 71.201.117.150 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.68.69.10
country_id: 49518
description:
2025-12-26 19:22:19 dovecot_login authenticator failed for H=([154.68.69.10]) [154.68.69.10]:41218: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2025-12-26 19:22:33 dovecot_login authenticator failed for H=([128.185.241.213]) [125.19.138.74]:45858: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.145
country_id: 2328926
description:
Dec 26 19:22:14 host2 sshd[1013162]: Disconnected from invalid user l 102.88.137.145 port 36030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.230.250
country_id: 1861060
description:
Dec 26 19:23:18 host2 sshd[1014303]: Disconnected from invalid user khalil 118.194.230.250 port 59200 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.88.137.145
country_id: 2328926
description:
Dec 26 19:23:37 host2 sshd[1014528]: Disconnected from invalid user blue 102.88.137.145 port 56346 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.123.67
country_id: 1819730
description:
Dec 26 19:23:50 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=101.36.123.67, lip=66.85.158.91, session=<A3ofOdtGipFlJHtD>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 101.36.123.67
country_id: 1819730
description:
Dec 26 19:23:51 host2 dovecot[1881837]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=101.36.123.67, lip=66.85.158.91, session=<Ag83OdtG6pJlJHtD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Dec 26 19:24:57 host2 sshd[1015679]: Disconnected from invalid user riad 202.165.15.132 port 23846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.145
country_id: 2328926
description:
Dec 26 19:24:20 host2 sshd[1015144]: Disconnected from invalid user titus 102.88.137.145 port 54980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.123.134.194
country_id: 6252001
description:
Dec 26 19:25:24 host2 sshd[1016427]: Disconnected from invalid user h 34.123.134.194 port 43292 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.230.250
country_id: 1861060
description:
Dec 26 19:26:36 host2 sshd[1017464]: Disconnected from invalid user test1 118.194.230.250 port 59550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.123.134.194
country_id: 6252001
description:
Dec 26 19:26:40 host2 sshd[1017542]: Disconnected from invalid user admin 34.123.134.194 port 42394 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.148.70.62
country_id: 6252001
description:
[2025-12-26 19:27:39 +0530] info [cpaneld] 47.148.70.62 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.183.42.99
country_id: 6252001
description:
[2025-12-26 19:27:44 +0530] info [cpaneld] 97.183.42.99 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.9.137.2
country_id: 6252001
description:
[2025-12-26 19:27:57 +0530] info [cpaneld] 71.9.137.2 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.33.205.242
country_id: 6252001
description:
[2025-12-26 19:27:58 +0530] info [cpaneld] 64.33.205.242 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.212.34.237
country_id: 3895114
description:
Dec 26 19:27:35 host2 sshd[1018772]: Disconnected from invalid user khalil 181.212.34.237 port 53641 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.71.17.21
country_id: 6252001
description:
[2025-12-26 19:27:42 +0530] info [cpaneld] 97.71.17.21 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 164.68.245.158
country_id: 6252001
description:
[2025-12-26 19:27:46 +0530] info [whostmgrd] 164.68.245.158 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.227.70.114
country_id: 6252001
description:
[2025-12-26 19:27:48 +0530] info [cpaneld] 68.227.70.114 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.15.132
country_id: 1733045
description:
Dec 26 19:29:28 host2 sshd[1020809]: Disconnected from invalid user vastbase 202.165.15.132 port 28512 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 19:31:26 host2 sshd[1022853]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.60.60.230
country_id: 6252001
description:
[2025-12-26 19:32:05 +0530] info [cpaneld] 139.60.60.230 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.159.168.2
country_id: 6252001
description:
[2025-12-26 19:32:06 +0530] info [cpaneld] 47.159.168.2 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.114
country_id: 1149361
description:
2025-12-26 19:31:10 dovecot_login authenticator failed for H=([180.94.75.114]) [180.94.75.114]:46781: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.89.174.18
country_id: 3865483
description:
Dec 26 19:31:53 host2 sshd[1023171]: Disconnected from invalid user sa 200.89.174.18 port 58056 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.208
country_id: 2542007
description:
2025-12-26 19:32:25 dovecot_login authenticator failed for H=([154.144.255.208]) [154.144.255.208]:38684: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.89.174.18
country_id: 3865483
description:
Dec 26 19:32:32 host2 sshd[1023700]: Disconnected from invalid user ftpuser 200.89.174.18 port 52198 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-26 19:32:49 dovecot_login authenticator failed for H=([103.29.185.162]) [103.29.185.162]:56802: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.192.57.198
country_id: 6252001
description:
[2025-12-26 19:32:11 +0530] info [cpaneld] 76.192.57.198 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.222.0.254
country_id: 6252001
description:
[2025-12-26 19:32:08 +0530] info [whostmgrd] 129.222.0.254 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.49.208.218
country_id: 6252001
description:
[2025-12-26 19:32:10 +0530] info [cpaneld] 72.49.208.218 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.118.111.24
country_id: 6252001
description:
[2025-12-26 19:32:09 +0530] info [cpaneld] 172.118.111.24 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.249.55.106
country_id: 2017370
description:
[2025-12-26 19:32:46 +0530] info [cpaneld] 89.249.55.106 - dragon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.23.222.66
country_id: 6252001
description:
[2025-12-26 19:32:07 +0530] info [cpaneld] 98.23.222.66 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-26 19:34:28 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:47140: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.133.214.127
country_id: 1269750
description:
2025-12-26 19:35:59 dovecot_plain authenticator failed for H=(localhost) [103.133.214.127]:37910: 535 Incorrect authentication data (set_id=help@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.187
country_id: 3017382
description:
Dec 26 19:37:17 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.187, lip=66.85.158.91, session=<L4I7adtGwbxb51m7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.186
country_id: 3017382
description:
Dec 26 19:37:27 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.186, lip=66.85.158.91, session=<f9fZadtGmb9b51m6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.189
country_id: 3017382
description:
Dec 26 19:37:38 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.189, lip=66.85.158.91, session=<O91/attGm9Rb51m9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.47
country_id: 3017382
description:
Dec 26 19:37:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.47, lip=66.85.158.91, session=<ni+yattGx8Bb51kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.164.20.42
country_id: 1643084
description:
2025-12-26 19:38:11 dovecot_plain authenticator failed for H=(localhost) [103.164.20.42]:38500: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Dec 26 19:38:23 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.6, lip=66.85.158.91, TLS: Connection closed, session=<PmwlbdtGQpvCpGsG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.27.206.6
country_id: 1643084
description:
2025-12-26 19:42:45 dovecot_plain authenticator failed for H=(localhost) [103.27.206.6]:35806: 535 Incorrect authentication data (set_id=postfix@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-26 19:43:01 dovecot_plain authenticator failed for H=c-67-172-54-29.hsd1.pa.comcast.net (paspercian) [67.172.54.29]:46722: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.174.17.50
country_id: 3351879
description:
2025-12-26 19:43:56 dovecot_plain authenticator failed for H=(localhost) [105.174.17.50]:52898: 535 Incorrect authentication data (set_id=news@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.12
country_id: 241170
description:
Dec 26 19:46:03 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.12, lip=66.85.158.91, session=<PthuiNtGIo7E+2YM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.174.17.50
country_id: 3351879
description:
2025-12-26 19:46:44 dovecot_plain authenticator failed for H=(localhost) [105.174.17.50]:34488: 535 Incorrect authentication data (set_id=news@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-26 19:46:36 dovecot_plain authenticator failed for H=c-73-68-220-15.hsd1.ma.comcast.net (reediatous) [73.68.220.15]:54196: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.98.168
country_id: 3144096
description:
2025-12-26 19:47:30 dovecot_login authenticator failed for H=([84.214.98.168]) [84.214.98.168]:40271: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-12-26 19:47:44 dovecot_login authenticator failed for H=([128.185.12.179]) [128.185.12.179]:60556: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-26 19:48:32 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:51816: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-26 19:49:23 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:39864: 535 Incorrect authentication data (set_id=newsletter@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.214.62
country_id: 6251999
description:
2025-12-26 19:52:39 dovecot_plain authenticator failed for H=mars.tiqqed.us (localhost) [158.69.214.62]:40728: 535 Incorrect authentication data (set_id=admin@lankaherbalsolutions.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 19:53:05 host2 pure-ftpd[1042821]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.164.20.42
country_id: 1643084
description:
2025-12-26 19:52:37 dovecot_plain authenticator failed for H=(localhost) [103.164.20.42]:48786: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-26 19:53:18 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:56076: 535 Incorrect authentication data (set_id=hr@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-26 19:53:32 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:41016: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-26 19:53:50 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:16933: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.108.185
country_id: 3175395
description:
Dec 26 19:54:28 host2 sshd[1044388]: Disconnected from invalid user gmodserver1 156.54.108.185 port 49641 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.54.108.185
country_id: 3175395
description:
Dec 26 19:55:04 host2 sshd[1044941]: Disconnected from invalid user pepper 156.54.108.185 port 56626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.144.61.200
country_id: 6252001
description:
2025-12-26 19:55:47 dovecot_plain authenticator failed for H=(localhost) [162.144.61.200]:47786: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-26 19:56:35 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:23960: 535 Incorrect authentication data (set_id=webmaster@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-26 19:56:34 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:59360: 535 Incorrect authentication data (set_id=newsletter@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-26 19:56:52 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:34170: 535 Incorrect authentication data (set_id=help@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.54.108.185
country_id: 3175395
description:
Dec 26 19:56:24 host2 sshd[1046228]: Disconnected from invalid user vserver 156.54.108.185 port 42365 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.144.61.200
country_id: 6252001
description:
2025-12-26 19:58:05 dovecot_plain authenticator failed for H=(localhost) [162.144.61.200]:36350: 535 Incorrect authentication data (set_id=office@melanifinefood.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.99.80.102
country_id: 3469034
description:
Dec 26 19:58:58 host2 sshd[1047998]: Disconnected from invalid user fauzi 138.99.80.102 port 56744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.214.62
country_id: 6251999
description:
2025-12-26 19:59:02 dovecot_plain authenticator failed for H=mars.tiqqed.us (localhost) [158.69.214.62]:50636: 535 Incorrect authentication data (set_id=admin@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.144.61.200
country_id: 6252001
description:
2025-12-26 19:58:11 dovecot_plain authenticator failed for H=(localhost) [162.144.61.200]:40070: 535 Incorrect authentication data (set_id=office@melanifinefood.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.99.80.102
country_id: 3469034
description:
Dec 26 19:58:17 host2 sshd[1047582]: Disconnected from invalid user lzt 138.99.80.102 port 38444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 26 19:58:19 host2 sshd[1047604]: Disconnected from invalid user cod4server 123.58.209.224 port 57322 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.209.224
country_id: 1819730
description:
Dec 26 20:00:52 host2 sshd[1049762]: Disconnected from invalid user pokemon 123.58.209.224 port 33238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.174.17.50
country_id: 3351879
description:
2025-12-26 20:02:02 dovecot_plain authenticator failed for H=(localhost) [105.174.17.50]:60708: 535 Incorrect authentication data (set_id=news@lankaherbalsolutions.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-26 20:01:14 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:56348: 535 Incorrect authentication data (set_id=help@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.174.17.50
country_id: 3351879
description:
2025-12-26 20:02:10 dovecot_plain authenticator failed for H=(localhost) [105.174.17.50]:54884: 535 Incorrect authentication data (set_id=news@lankaherbalsolutions.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.17
country_id: 241170
description:
Dec 26 20:03:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.17, lip=66.85.158.91, session=<iUIzxdtG9OnE+2YR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Dec 26 20:03:44 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS: Connection closed, session=<ZLLUx9tGLpdChJmF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.249.66.40
country_id: 2661886
description:
2025-12-26 20:03:22 dovecot_login authenticator failed for H=c83-249-66-40.bredband.tele2.se [83.249.66.40]:46004: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-12-26 20:03:32 dovecot_login authenticator failed for H=([196.190.43.162]) [196.190.43.167]:59560: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
country_id: 1269750
description:
2025-12-26 20:04:37 dovecot_login authenticator failed for H=([103.55.89.5]) [116.75.218.103]:54104: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-12-26 20:05:36 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (snetally) [24.91.103.202]:50834: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.131.53.100
country_id: 1269750
description:
Dec 26 20:05:40 host2 sshd[1053263]: Disconnected from invalid user sysadm 185.131.53.100 port 60490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-12-26 20:05:22 dovecot_login authenticator failed for H=(103.51.26.198.sukaininfoway.com) [103.51.26.198]:49737: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-26 20:06:31 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:43526: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-26 20:06:43 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:6910: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.164.20.42
country_id: 1643084
description:
2025-12-26 20:06:08 dovecot_plain authenticator failed for H=(localhost) [103.164.20.42]:39052: 535 Incorrect authentication data (set_id=admin@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.214.62
country_id: 6251999
description:
2025-12-26 20:06:29 dovecot_plain authenticator failed for H=mars.tiqqed.us (localhost) [158.69.214.62]:36670: 535 Incorrect authentication data (set_id=admin@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-26 20:07:57 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:37516: 535 Incorrect authentication data (set_id=help@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-26 20:08:10 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:52674: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-26 20:08:14 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:53828: 535 Incorrect authentication data (set_id=newsletter@melanifinefood.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.131.53.100
country_id: 1269750
description:
Dec 26 20:08:43 host2 sshd[1055490]: Disconnected from invalid user scpuser 185.131.53.100 port 47696 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.226.64.141
country_id: 1819730
description:
2025-12-26 20:10:08 dovecot_plain authenticator failed for H=(localhost) [129.226.64.141]:35042: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
country_id: 1880251
description:
2025-12-26 20:09:37 dovecot_login authenticator failed for H=(448990.cloudwaysapps.com) [128.199.118.234]:24286: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2025-12-26 20:09:52 dovecot_login authenticator failed for H=([152.52.234.148]) [125.19.216.58]:50740: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-26 20:11:05 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:41437: 535 Incorrect authentication data (set_id=contact@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.138.154.128
country_id: 1814991
description:
2025-12-26 20:10:45 dovecot_plain authenticator failed for H=(localhost) [8.138.154.128]:44810: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-26 20:11:14 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:64051: 535 Incorrect authentication data (set_id=contact@mathsmotorcysle.xyz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.16
country_id: 241170
description:
Dec 26 20:11:56 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.16, lip=66.85.158.91, session=<eIgI5dtG6pzE+2YQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-26 20:14:04 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:47734: 535 Incorrect authentication data (set_id=news@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-26 20:14:10 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:41632: 535 Incorrect authentication data (set_id=news@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.198
country_id: 1269750
description:
2025-12-26 20:14:25 dovecot_login authenticator failed for H=([152.52.246.198]) [152.52.246.198]:50188: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-26 20:15:46 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:48474: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-12-26 20:16:58 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:42446: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-26 20:16:42 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:47696: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.32
country_id: 6252001
description:
Dec 26 20:17:26 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=162.216.150.32, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<PSDM+NtGMMSi2JYg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-26 20:17:30 dovecot_login authenticator failed for H=([5.32.99.14]) [5.32.99.14]:55538: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-26 20:18:19 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:57694: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.32
country_id: 6252001
description:
Dec 26 20:18:29 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.150.32, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<nw2M/NtGqOei2JYg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-26 20:18:49 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:37326: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 20:19:28 host2 sshd[1064906]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.209.252.105
country_id: 6252001
description:
2025-12-26 20:19:55 dovecot_plain authenticator failed for H=ec2-54-209-252-105.compute-1.amazonaws.com (EC2AMAZ-5DRTN3Q.ec2.internal) [54.209.252.105]:63083: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-26 20:23:19 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:38834: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-26 20:24:11 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:33208: 535 Incorrect authentication data (set_id=newsletter@lankaherbalsolutions.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.32
country_id: 6252001
description:
Dec 26 20:25:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.32, lip=66.85.158.92, TLS, session=<QvcCFtxG4OKi2JYg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.147.131.177
country_id: 1814991
description:
2025-12-26 20:26:44 dovecot_plain authenticator failed for H=(localhost) [8.147.131.177]:47876: 535 Incorrect authentication data (set_id=newsletter@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.235.107
country_id: 1880251
description:
2025-12-26 20:28:10 dovecot_plain authenticator failed for H=(localhost) [188.166.235.107]:48510: 535 Incorrect authentication data (set_id=help@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-26 20:28:25 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:55197: 535 Incorrect authentication data (set_id=hr@lankaherbalsolutions.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-26 20:28:56 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:42768: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-26 20:30:39 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:47542: 535 Incorrect authentication data (set_id=newsletter@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-26 20:30:56 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:59001: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-26 20:31:49 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:41836: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-26 20:31:56 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:56642: 535 Incorrect authentication data (set_id=test@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-26 20:31:56 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60901: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-26 20:32:00 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:55760: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-26 20:32:02 dovecot_login authenticator failed for H=([152.52.244.46]) [152.52.244.46]:39636: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-26 20:32:23 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:41586: 535 Incorrect authentication data (set_id=hr@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-26 20:32:35 dovecot_plain authenticator failed for H=(froyernic) [65.20.129.28]:54669: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-26 20:32:06 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:42464: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-26 20:32:19 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:40250: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-26 20:33:22 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:55380: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-26 20:33:26 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:39266: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-26 20:35:18 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:53622: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-26 20:35:56 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:34544: 535 Incorrect authentication data (set_id=hr@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-26 20:38:39 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:49684: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.138.154.128
country_id: 1814991
description:
2025-12-26 20:40:02 dovecot_plain authenticator failed for H=(localhost) [8.138.154.128]:54422: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.138.154.128
country_id: 1814991
description:
2025-12-26 20:40:10 dovecot_plain authenticator failed for H=(localhost) [8.138.154.128]:39470: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.239
country_id: 6252001
description:
Dec 26 20:41:46 host2 pure-ftpd[1085066]: (?@198.235.24.239) [INFO] New connection from 198.235.24.239


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.153.189.62
country_id: 6252001
description:
Dec 26 20:43:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 (no auth attempts in 1 secs): user=<>, rip=148.153.189.62, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42, session=<DKtIVNxGbo6Umb0+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-26 20:44:00 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:12488: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.197.53
country_id: 2921044
description:
2025-12-26 20:44:10 dovecot_plain authenticator failed for H=v2202507289313365218.goodsrv.de (localhost) [152.53.197.53]:42258: 535 Incorrect authentication data (set_id=newsletter@bostonlanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.190.129.227
country_id: 6252001
description:
[2025-12-26 20:45:00 +0530] info [cpaneld] 72.190.129.227 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.238.143.106
country_id: 6252001
description:
[2025-12-26 20:45:04 +0530] info [cpaneld] 98.238.143.106 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-26 20:44:09 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:60203: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.32.180.176
country_id: 6252001
description:
[2025-12-26 20:44:59 +0530] info [cpaneld] 104.32.180.176 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.16.209
country_id: 6252001
description:
[2025-12-26 20:44:58 +0530] info [cpaneld] 172.56.16.209 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.47.164.191
country_id: 6252001
description:
[2025-12-26 20:45:01 +0530] info [whostmgrd] 136.47.164.191 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.185.2.97
country_id: 6252001
description:
[2025-12-26 20:45:02 +0530] info [cpaneld] 65.185.2.97 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.29.150.115
country_id: 6252001
description:
[2025-12-26 20:45:07 +0530] info [cpaneld] 45.29.150.115 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.228.158.250
country_id: 1814991
description:
[2025-12-26 20:45:15 +0530] info [webmaild] 43.228.158.250 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.133.121.104
country_id: 1512440
description:
2025-12-26 20:45:54 dovecot_plain authenticator failed for H=(localhost) [5.133.121.104]:57312: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.255.65.147
country_id: 458258
description:
Dec 26 20:46:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=85.255.65.147, lip=66.85.158.91, TLS, session=<oAUnXtxG9QxV/0GT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.130
country_id: 3469034
description:
Dec 26 20:46:26 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<chitral00>, method=PLAIN, rip=190.89.137.130, lip=66.85.158.91, TLS, session=<eDFEX9xGgKy+WYmC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-26 20:47:19 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:59978: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.27.206.6
country_id: 1643084
description:
2025-12-26 20:47:29 dovecot_plain authenticator failed for H=(localhost) [103.27.206.6]:52980: 535 Incorrect authentication data (set_id=postfix@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-26 20:47:46 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:56264: 535 Incorrect authentication data (set_id=finance@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-26 20:48:57 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (trous) [87.103.126.54]:33185: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.221.146.87
country_id: 690791
description:
Dec 26 20:49:47 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=37.221.146.87, lip=66.85.158.91, TLS, session=<aqZ8a9xG+6El3ZJX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.179.58.114
country_id: 1269750
description:
2025-12-26 20:50:55 dovecot_plain authenticator failed for H=server1.justsee.co.in (localhost) [180.179.58.114]:51606: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.121
country_id: 3865483
description:
Dec 26 20:50:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.0.251.121, lip=66.85.158.91, TLS, session=<GzmfbNxGprCzAPt5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-26 20:52:46 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:60062: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-26 20:53:04 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:43492: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-26 20:53:12 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:38218: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-26 20:54:34 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:38862: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.233.71.242
country_id: 1880251
description:
2025-12-26 20:56:07 dovecot_plain authenticator failed for H=vmi2581136.contaboserver.net (localhost) [194.233.71.242]:35284: 535 Incorrect authentication data (set_id=postfix@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 20:56:27 host2 pure-ftpd[1097543]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.133.214.127
country_id: 1269750
description:
2025-12-26 20:56:44 dovecot_plain authenticator failed for H=(localhost) [103.133.214.127]:52056: 535 Incorrect authentication data (set_id=help@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.89.177.227
country_id: 6252001
description:
2025-12-26 20:57:41 dovecot_plain authenticator failed for H=(localhost) [47.89.177.227]:21176: 535 Incorrect authentication data (set_id=contact@lankaherbalsolutions.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 202.61.254.253
country_id: 2921044
description:
Dec 26 20:58:37 host2 pure-ftpd[1099147]: (?@202.61.254.253) [INFO] New connection from 202.61.254.253


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.61.254.253
country_id: 2921044
description:
[2025-12-26 20:58:45 +0530] info [cpaneld] 202.61.254.253 - cloudtourssrilan "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-26 20:59:06 dovecot_plain authenticator failed for H=c-98-40-101-10.hsd1.tn.comcast.net (mumplike) [98.40.101.10]:38194: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.227.144.239
country_id: 6252001
description:
[2025-12-26 21:00:48 +0530] info [cpaneld] 136.227.144.239 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.221.34.82
country_id: 6252001
description:
[2025-12-26 21:00:50 +0530] info [cpaneld] 107.221.34.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.214.42.40
country_id: 6252001
description:
[2025-12-26 21:00:51 +0530] info [cpaneld] 76.214.42.40 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.47.235.108
country_id: 6252001
description:
[2025-12-26 21:00:53 +0530] info [whostmgrd] 73.47.235.108 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 129.224.211.196
country_id: 6252001
description:
[2025-12-26 21:00:54 +0530] info [cpaneld] 129.224.211.196 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.202.204.219
country_id: 6252001
description:
[2025-12-26 21:00:57 +0530] info [cpaneld] 71.202.204.219 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.215.244.213
country_id: 6252001
description:
[2025-12-26 21:00:58 +0530] info [cpaneld] 66.215.244.213 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-26 21:01:16 dovecot_plain authenticator failed for H=c-73-230-86-50.hsd1.pa.comcast.net (examinkion) [73.230.86.50]:48088: 535 Incorrect authentication data (set_id=info@fhb.health.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.211.25.202
country_id: 2233387
description:
2025-12-26 21:01:31 dovecot_plain authenticator failed for H=(localhost) [165.211.25.202]:46266: 535 Incorrect authentication data (set_id=office@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-26 21:02:34 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:45200: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-26 21:03:47 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:55358: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-26 21:04:58 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:50252: 535 Incorrect authentication data (set_id=newsletter@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.49.147.210
country_id: 1605651
description:
2025-12-26 21:06:01 dovecot_login authenticator failed for H=([110.49.147.210]) [110.49.147.210]:37123: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-26 21:05:28 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:58036: 535 Incorrect authentication data (set_id=finance@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.2
country_id: 1733045
description:
2025-12-26 21:05:46 dovecot_login authenticator failed for H=([49.124.151.2]) [49.124.151.2]:41454: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.27.206.6
country_id: 1643084
description:
2025-12-26 21:07:35 dovecot_plain authenticator failed for H=(localhost) [103.27.206.6]:45562: 535 Incorrect authentication data (set_id=postfix@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.138.154.128
country_id: 1814991
description:
2025-12-26 21:08:48 dovecot_plain authenticator failed for H=(localhost) [8.138.154.128]:53966: 535 Incorrect authentication data (set_id=admin@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-26 21:10:45 dovecot_login authenticator failed for H=([103.251.143.14]) [103.251.143.14]:60820: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.144.61.200
country_id: 6252001
description:
2025-12-26 21:10:19 dovecot_plain authenticator failed for H=(localhost) [162.144.61.200]:53302: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
country_id: 290557
description:
2025-12-26 21:10:27 dovecot_login authenticator failed for H=([94.206.93.90]) [94.206.93.90]:37745: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-26 21:12:19 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (ducum) [87.103.126.54]:40784: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.144.61.200
country_id: 6252001
description:
2025-12-26 21:12:30 dovecot_plain authenticator failed for H=(localhost) [162.144.61.200]:39384: 535 Incorrect authentication data (set_id=office@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-26 21:12:48 dovecot_plain authenticator failed for H=c-68-60-77-128.hsd1.mi.comcast.net (comingeole) [68.60.77.128]:59992: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-26 21:13:07 dovecot_plain authenticator failed for H=(nograls) [24.187.213.29]:34070: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.135.26.113
country_id: 1522867
description:
2025-12-26 21:13:28 dovecot_login authenticator failed for H=2.135.26.113.dynamic.telecom.kz [2.135.26.113]:47887: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-26 21:13:57 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:6363: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-26 21:13:57 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:51740: 535 Incorrect authentication data (set_id=webmaster@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.14
country_id: 2186224
description:
2025-12-26 21:14:02 dovecot_login authenticator failed for H=([121.73.163.14]) [121.73.163.14]:39930: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.11
country_id: 241170
description:
Dec 26 21:14:07 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.11, lip=66.85.158.91, session=<3vFlw9xGEOrE+2YL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-26 21:16:46 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:34930: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-26 21:17:02 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:53346: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 21:17:11 host2 sshd[1115982]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.21
country_id: 1733045
description:
2025-12-26 21:17:25 dovecot_login authenticator failed for H=([49.124.151.21]) [49.124.151.21]:47344: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-26 21:17:37 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:58711: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-12-26 21:17:49 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([173.248.234.145]) [69.172.79.198]:61598: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.160.107.51
country_id: 1210997
description:
2025-12-26 21:17:07 dovecot_login authenticator failed for H=([182.160.107.51]) [182.160.107.51]:47052: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-26 21:17:09 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:43514: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.15
country_id: 241170
description:
Dec 26 21:18:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.15, lip=66.85.158.91, session=<5xaK1NxGDLfE+2YP>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 26 21:18:59 host2 sshd[1117807]: Disconnected from invalid user minecraft 141.147.62.42 port 47478 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.107
country_id: 6252001
description:
Dec 26 21:20:05 host2 pure-ftpd[1118902]: (?@205.210.31.107) [INFO] New connection from 205.210.31.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-26 21:20:27 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:56836: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-26 21:20:52 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:38654: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.233.206.154
country_id: 1327865
description:
Dec 26 21:23:15 host2 sshd[1121501]: Disconnected from invalid user deamon_root 103.233.206.154 port 35085 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.96
country_id: 3469034
description:
Dec 26 21:23:30 host2 sshd[1121724]: Disconnected from invalid user admin 189.47.10.96 port 36168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 26 21:24:01 host2 sshd[1122048]: Disconnected from invalid user test6 141.147.62.42 port 55092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.195.221.26
country_id: 934292
description:
Dec 26 21:24:06 host2 sshd[1122145]: Disconnected from invalid user zy 45.195.221.26 port 17348 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.96
country_id: 3469034
description:
Dec 26 21:24:21 host2 sshd[1122383]: Disconnected from invalid user ubuntu 189.47.10.96 port 52734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-26 21:24:33 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:39080: 535 Incorrect authentication data (set_id=news@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-26 21:24:50 dovecot_plain authenticator failed for H=(bulging) [178.250.191.189]:40832: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.252.188.15
country_id: 2782113
description:
Dec 26 21:25:41 host2 sshd[1123735]: Disconnected from invalid user csadmin 37.252.188.15 port 46436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Dec 26 21:25:12 host2 sshd[1123256]: Disconnected from invalid user template 37.252.188.15 port 34608 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-26 21:26:20 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:38260: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-26 21:26:38 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:15913: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-26 21:26:49 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:40814: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Dec 26 21:26:12 host2 sshd[1124229]: Disconnected from invalid user jawad 37.252.188.15 port 58268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.145.111
country_id: 1861060
description:
Dec 26 21:26:44 host2 sshd[1124813]: Disconnected from invalid user temp 152.32.145.111 port 46810 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.61.254.253
country_id: 2921044
description:
[2025-12-26 21:26:57 +0530] info [cpaneld] 202.61.254.253 - cloudtourssrilan "POST /login HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.195.221.26
country_id: 934292
description:
Dec 26 21:26:07 host2 sshd[1124148]: Disconnected from invalid user cooper 45.195.221.26 port 22732 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 202.61.254.253
country_id: 2921044
description:
Dec 26 21:26:43 host2 pure-ftpd[1124809]: (?@202.61.254.253) [INFO] New connection from 202.61.254.253


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Dec 26 21:27:46 host2 sshd[1125531]: Disconnected from invalid user nvidia 190.221.50.123 port 36142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.203.34.136
country_id: 6252001
description:
2025-12-26 21:28:03 dovecot_plain authenticator failed for H=c-98-203-34-136.hsd1.fl.comcast.net (abler) [98.203.34.136]:34732: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.195.221.26
country_id: 934292
description:
Dec 26 21:28:31 host2 sshd[1126357]: Disconnected from invalid user postgres 45.195.221.26 port 63280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.233.206.154
country_id: 1327865
description:
Dec 26 21:29:24 host2 sshd[1127084]: Disconnected from invalid user dev 103.233.206.154 port 37941 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.14.191
country_id: 1819730
description:
Dec 26 21:30:19 host2 sshd[1128052]: Disconnected from invalid user dave 154.92.14.191 port 42558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-26 21:30:39 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:60068: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.145.111
country_id: 1861060
description:
Dec 26 21:30:48 host2 sshd[1128569]: Disconnected from invalid user ossuser 152.32.145.111 port 54150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-26 21:31:27 dovecot_plain authenticator failed for H=(localhost) [43.163.105.233]:52746: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-26 21:31:41 dovecot_login authenticator failed for H=(nsg-corporate-113.254.185.122.airtel.in) [122.186.64.206]:46082: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-12-26 21:31:56 dovecot_login authenticator failed for H=(static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:35868: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Dec 26 21:33:03 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hoJFB91GuGNBMQFQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.145.111
country_id: 1861060
description:
Dec 26 21:32:44 host2 sshd[1130266]: Disconnected from invalid user ocean 152.32.145.111 port 45290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Dec 26 21:33:20 host2 sshd[1130807]: Disconnected from invalid user customer 190.221.50.123 port 39250 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Dec 26 21:33:21 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7CNWCN1GEOhBMQFQ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.92.14.191
country_id: 1819730
description:
Dec 26 21:33:22 host2 sshd[1130835]: Disconnected from invalid user pty 154.92.14.191 port 49468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.221.50.123
country_id: 3865483
description:
Dec 26 21:34:48 host2 sshd[1131891]: Disconnected from invalid user bitnami 190.221.50.123 port 51720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.145.111
country_id: 1861060
description:
Dec 26 21:35:22 host2 sshd[1132487]: Disconnected from invalid user soporte 152.32.145.111 port 45850 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.221.50.123
country_id: 3865483
description:
Dec 26 21:35:30 host2 sshd[1132592]: Disconnected from invalid user deploy 190.221.50.123 port 59084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 131.100.242.102
country_id: 3469034
description:
Dec 26 21:36:30 host2 sshd[1133713]: Disconnected from invalid user tp 131.100.242.102 port 44490 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 36.255.223.21
country_id: 1880251
description:
Dec 26 21:36:54 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=36.255.223.21, lip=66.85.158.91, TLS handshaking: Connection closed, session=<p4H8FN1GWhgk/98V>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.145.111
country_id: 1861060
description:
Dec 26 21:36:05 host2 sshd[1133318]: Disconnected from invalid user tp 152.32.145.111 port 41764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.115.224
country_id: 3469034
description:
Dec 26 21:38:04 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=177.87.115.224, lip=66.85.158.91, TLS, session=<uMQKGN1G/Z6xV3Pg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.13
country_id: 1819730
description:
Dec 26 21:37:38 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=45.142.154.13, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xgqdF91GOl4tjpoN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.92.14.191
country_id: 1819730
description:
Dec 26 21:37:41 host2 sshd[1134712]: Disconnected from invalid user mcadmin 154.92.14.191 port 35644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.211.35
country_id: 1819730
description:
Dec 26 21:38:14 host2 sshd[1135167]: Disconnected from invalid user administrator 103.100.211.35 port 32956 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.58
country_id: 3865483
description:
Dec 26 21:38:38 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<chitral00>, method=PLAIN, rip=186.64.71.58, lip=66.85.158.91, TLS, session=<NOf3Gd1GGOC6QEc6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-26 21:39:33 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:40696: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 131.100.242.102
country_id: 3469034
description:
Dec 26 21:39:45 host2 sshd[1136199]: Disconnected from invalid user indico 131.100.242.102 port 53814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.145.111
country_id: 1861060
description:
Dec 26 21:40:50 host2 sshd[1137343]: Disconnected from invalid user khan 152.32.145.111 port 53544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 131.100.242.102
country_id: 3469034
description:
Dec 26 21:40:37 host2 sshd[1137153]: Disconnected from invalid user ossuser 131.100.242.102 port 50218 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.211.35
country_id: 1819730
description:
Dec 26 21:40:41 host2 sshd[1137198]: Disconnected from invalid user radio 103.100.211.35 port 36274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.154
country_id: 3144096
description:
2025-12-26 21:41:53 dovecot_login authenticator failed for H=([84.213.189.154]) [84.213.189.154]:55959: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-26 21:41:08 dovecot_plain authenticator failed for H=c-174-166-153-20.hsd1.nj.comcast.net (hetry) [174.166.153.20]:56150: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-26 21:42:11 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:55976: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.145.111
country_id: 1861060
description:
Dec 26 21:43:25 host2 sshd[1139369]: Disconnected from invalid user den 152.32.145.111 port 48218 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.142.33
country_id: 2921044
description:
Dec 26 21:43:35 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=139.59.142.33, lip=66.85.158.91, TLS handshaking: Connection closed, session=<F4noLN1GCLaLO44h>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-26 21:45:41 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:33776: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-26 21:46:05 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:44898: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-26 21:46:12 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:35654: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.102.191
country_id: 6252001
description:
Dec 26 21:47:28 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.79.102.191, lip=66.85.158.91, TLS handshaking: Connection closed, session=<BtnMOt1G9M0tT2a/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-26 21:48:00 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:49492: 535 Incorrect authentication data (set_id=test@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.13.171
country_id: 3144096
description:
2025-12-26 21:48:44 dovecot_login authenticator failed for H=(cm-84.211.13.171.get.no) [84.211.13.171]:54447: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-26 21:48:08 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:58226: 535 Incorrect authentication data (set_id=test@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.6
country_id: 1269750
description:
2025-12-26 21:48:26 dovecot_login authenticator failed for H=(nsg-corporate-129.186.186.122.airtel.in) [27.123.112.6]:42170: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-12-26 21:49:15 dovecot_login authenticator failed for H=(cm-178.232.65.99.get.no) [178.232.65.99]:36735: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.51.185
country_id: 3144096
description:
2025-12-26 21:49:27 dovecot_login authenticator failed for H=([84.215.51.185]) [84.215.51.185]:36914: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-26 21:49:31 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:48032: 535 Incorrect authentication data (set_id=test@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.233.206.154
country_id: 1327865
description:
Dec 26 21:49:43 host2 sshd[1146024]: Disconnected from invalid user sonar 103.233.206.154 port 60854 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.233.206.154
country_id: 1327865
description:
Dec 26 21:50:50 host2 sshd[1147595]: Disconnected from invalid user postgres 103.233.206.154 port 35266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-26 21:51:43 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:43790: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.233.206.154
country_id: 1327865
description:
Dec 26 21:53:05 host2 sshd[1160098]: Disconnected from invalid user ubuntu 103.233.206.154 port 48551 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.113
country_id: 6252001
description:
Dec 26 21:54:06 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.113, lip=66.85.158.91, TLS handshaking: Connection closed, session=<pFmDUt1Gb1tAPpxx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.108
country_id: 6252001
description:
Dec 26 21:54:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.108, lip=66.85.158.91, TLS handshaking: Connection closed, session=<yhuSU91GKPtAPpxs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-12-26 21:55:21 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:60502: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.21
country_id: 798549
description:
Dec 26 21:56:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=212.73.148.21, lip=66.85.158.91, session=<9vF+Wt1GfJ7USZQV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.233.206.154
country_id: 1327865
description:
Dec 26 21:57:33 host2 sshd[1166731]: Disconnected from invalid user test 103.233.206.154 port 42907 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.27.206.6
country_id: 1643084
description:
2025-12-26 21:59:21 dovecot_plain authenticator failed for H=(localhost) [103.27.206.6]:35568: 535 Incorrect authentication data (set_id=postfix@essenceceylontea.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 21:59:32 host2 pure-ftpd[1168790]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-26 22:00:03 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:52000: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-26 22:00:56 dovecot_login authenticator failed for H=([170.247.248.154]) [170.247.248.154]:46398: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-12-26 22:00:58 dovecot_login authenticator failed for H=(223-197-226-51.static.imsbiz.com) [223.197.226.51]:50384: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-26 22:00:11 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:53986: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-26 22:01:43 dovecot_login authenticator failed for H=([102.53.15.17]) [102.53.15.17]:33629: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-26 22:05:02 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:40168: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-26 22:05:09 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:48052: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-26 22:09:25 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:46401: 535 Incorrect authentication data (set_id=hr@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-26 22:09:40 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:44520: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-26 22:10:06 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:7122: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-26 22:10:35 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:60578: 535 Incorrect authentication data (set_id=finance@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.144.61.200
country_id: 6252001
description:
2025-12-26 22:11:31 dovecot_plain authenticator failed for H=(localhost) [162.144.61.200]:56190: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.144.61.200
country_id: 6252001
description:
2025-12-26 22:13:42 dovecot_plain authenticator failed for H=(localhost) [162.144.61.200]:41452: 535 Incorrect authentication data (set_id=office@melanifinefood.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 22:14:03 host2 sshd[1182692]: Disconnected from invalid user admin 2.57.121.112 port 30806 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.40
country_id: 6252001
description:
Dec 26 22:14:32 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.40, lip=66.85.158.92, session=<wB2Um91Gy0BAPsUo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Dec 26 22:14:43 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.32, lip=66.85.158.92, TLS: Connection closed, session=<KKY+nN1G8h9APsUg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 102.129.55.37
country_id: 953987
description:
Dec 26 22:16:25 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=102.129.55.37, lip=66.85.158.91, TLS, session=<P54Wod1G55ZmgTcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.42.52
country_id: 2395170
description:
Dec 26 22:16:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=154.127.42.52, lip=66.85.158.91, TLS, session=<WANyot1GEs6afyo0>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 22:17:19 host2 sshd[1185437]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-26 22:17:57 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:44888: 535 Incorrect authentication data (set_id=help@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-26 22:22:16 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:38882: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-26 22:22:38 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:9193: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-12-26 22:23:10 dovecot_login authenticator failed for H=([190.85.134.20]) [190.85.134.20]:58929: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-26 22:23:54 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:34088: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-12-26 22:24:06 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:36292: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-26 22:24:08 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:54218: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-26 22:24:14 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:52522: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-26 22:24:36 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:34412: 535 Incorrect authentication data (set_id=help@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-12-26 22:27:23 dovecot_login authenticator failed for H=(nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:46915: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-26 22:28:16 dovecot_plain authenticator failed for H=(localhost) [43.163.105.233]:56802: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.18.99.10
country_id: 1269750
description:
2025-12-26 22:29:04 dovecot_login authenticator failed for H=([125.18.136.89]) [125.18.99.10]:33008: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-26 22:29:40 dovecot_login authenticator failed for H=(dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:52898: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-26 22:29:42 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:55040: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-26 22:29:59 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:47790: 535 Incorrect authentication data (set_id=news@essenceceylontea.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.105
country_id: 6252001
description:
Dec 26 22:29:35 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.105, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<9nJk0d1GscSTuYVp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.105
country_id: 6252001
description:
Dec 26 22:30:20 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=147.185.133.105, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<tKkZ1N1GWOOTuYVp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-26 22:32:26 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:58268: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-26 22:32:43 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:60120: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-26 22:33:49 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:50996: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.105
country_id: 6252001
description:
Dec 26 22:37:18 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.105, lip=66.85.158.91, TLS, session=<hNsI7d1GhP6TuYVp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.92
country_id: 3996063
description:
2025-12-26 22:38:17 dovecot_login authenticator failed for H=(189.218.82.92-clientes-izzi.mx) [189.218.82.92]:33237: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-26 22:38:35 dovecot_login authenticator failed for H=(cm-84.211.11.216.get.no) [84.211.11.216]:55158: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 87.121.77.66
country_id: 732800
description:
Dec 26 22:39:48 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact>, method=PLAIN, rip=87.121.77.66, lip=66.85.158.91, TLS, session=<rIb79N1GGopXeU1C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.52.22
country_id: 2963597
description:
Dec 26 22:39:51 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact>, method=PLAIN, rip=37.203.52.22, lip=66.85.158.91, TLS, session=<l7As9d1GyrslyzQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-26 22:39:19 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:63634: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.145.43.177
country_id: 2510769
description:
Dec 26 22:39:30 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=185.145.43.177, lip=66.85.158.91, TLS, session=<dQLv891GVq65kSux>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.76.252.82
country_id: 1269750
description:
Dec 26 22:39:34 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=103.76.252.82, lip=66.85.158.91, TLS, session=<6Lf4891Gz9JnTPxS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.226.64.141
country_id: 1819730
description:
2025-12-26 22:42:51 dovecot_plain authenticator failed for H=(localhost) [129.226.64.141]:57818: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-26 22:43:05 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:35924: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-26 22:43:22 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:39883: 535 Incorrect authentication data (set_id=hr@lankaherbalsolutions.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-26 22:46:29 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:45034: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-26 22:47:03 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:38270: 535 Incorrect authentication data (set_id=test@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.204.232
country_id: 1269750
description:
2025-12-26 22:47:12 dovecot_plain authenticator failed for H=(localhost) [66.116.204.232]:57178: 535 Incorrect authentication data (set_id=test@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-26 22:47:16 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:45328: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-26 22:47:29 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:54714: 535 Incorrect authentication data (set_id=hr@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-26 22:47:31 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:43978: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-26 22:48:08 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:63614: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-12-26 22:48:07 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:33967: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-26 22:48:13 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:44578: 535 Incorrect authentication data (set_id=hr@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-26 22:48:36 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:41286: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-26 22:48:14 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:29198: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 26 22:51:03 host2 sshd[1220571]: Disconnected from invalid user admin 2.57.121.112 port 55279 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-26 22:52:43 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:60134: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.164
country_id: 6252001
description:
Dec 26 22:54:45 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.164, lip=66.85.158.92, session=<1WdoK95GXMsUQcKk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-26 22:56:05 dovecot_login authenticator failed for H=([91.72.153.110]) [91.72.153.110]:40332: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.70.118
country_id: 1168579
description:
2025-12-26 22:56:08 dovecot_login authenticator failed for H=([115.42.70.118]) [115.42.70.118]:48366: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-12-26 22:56:27 dovecot_login authenticator failed for H=(customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:44162: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-26 22:57:02 dovecot_login authenticator failed for H=([85.19.195.12]) [85.19.195.12]:57238: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-12-26 22:57:11 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl [89.67.37.52]:50862: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.159.100
country_id: 2750405
description:
Dec 26 22:59:36 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.159.100, lip=66.85.158.91, TLS: Connection closed, session=<W8rHPN5GsqSkXJ9k>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.91
country_id: 6252001
description:
Dec 26 23:00:18 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.91, lip=66.85.158.91, session=<fmJDP95GVIkUQGlb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-26 23:01:07 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:48454: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-26 23:01:15 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:38554: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.27.206.6
country_id: 1643084
description:
2025-12-26 23:01:54 dovecot_plain authenticator failed for H=(localhost) [103.27.206.6]:49878: 535 Incorrect authentication data (set_id=postfix@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.133.121.104
country_id: 1512440
description:
2025-12-26 23:02:00 dovecot_plain authenticator failed for H=(localhost) [5.133.121.104]:40326: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.18
country_id: 241170
description:
Dec 26 23:02:02 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.18, lip=66.85.158.91, session=<HhlfRd5GpNLE+2YS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.172
country_id: 1733045
description:
2025-12-26 23:02:16 dovecot_login authenticator failed for H=([49.124.152.172]) [49.124.152.172]:48424: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 26 23:02:12 host2 pure-ftpd[1232175]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-26 23:02:14 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:61312: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.17.174
country_id: 2017370
description:
2025-12-26 23:03:25 dovecot_login authenticator failed for H=([155.212.17.174]) [155.212.17.174]:35664: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.109.101
country_id: 3144096
description:
2025-12-26 23:04:00 dovecot_login authenticator failed for H=(cm-178.232.109.101.get.no) [178.232.109.101]:58802: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 26 23:04:55 host2 sshd[1233766]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-26 23:04:36 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:52740: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.209.252.105
country_id: 6252001
description:
2025-12-26 23:05:27 dovecot_plain authenticator failed for H=ec2-54-209-252-105.compute-1.amazonaws.com (EC2AMAZ-5DRTN3Q.ec2.internal) [54.209.252.105]:64066: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.179.58.114
country_id: 1269750
description:
2025-12-26 23:06:30 dovecot_plain authenticator failed for H=server1.justsee.co.in (localhost) [180.179.58.114]:57934: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.245
country_id: 6252001
description:
Dec 26 23:06:44 host2 dovecot[1881837]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.245, lip=66.85.158.91, session=<acBOVt5GQlis7OT1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-26 23:07:16 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:49746: 535 Incorrect authentication data (set_id=finance@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-26 23:08:07 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:50592: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 168.0.224.94
country_id: 3469034
description:
Dec 26 23:08:13 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=168.0.224.94, lip=66.85.158.91, TLS, session=<jHyOWt5G1qGoAOBe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-26 23:08:15 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:48392: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.211.16.169
country_id: 2300660
description:
Dec 26 23:08:36 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=41.211.16.169, lip=66.85.158.91, TLS, session=<S/y5W95GaYMp0xCp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.233.71.242
country_id: 1880251
description:
2025-12-26 23:10:21 dovecot_plain authenticator failed for H=vmi2581136.contaboserver.net (localhost) [194.233.71.242]:37234: 535 Incorrect authentication data (set_id=postfix@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.68
country_id: 6252001
description:
Dec 26 23:11:43 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.68, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Bo8XaN5GYCe4aYtE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Dec 26 23:12:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.68, lip=66.85.158.92, TLS handshaking: Connection closed, session=<MP5cad5GMOpBMRRE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.68
country_id: 6252001
description:
Dec 26 23:12:19 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.68, lip=66.85.158.92, TLS: Connection closed, session=<Z287at5G0NC4aYtE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Dec 26 23:12:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.68, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+HuLat5GnnBBMRRE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-26 23:13:20 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:42128: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-26 23:17:25 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:47472: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.211.25.202
country_id: 2233387
description:
2025-12-26 23:17:43 dovecot_plain authenticator failed for H=(localhost) [165.211.25.202]:43406: 535 Incorrect authentication data (set_id=office@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-26 23:18:33 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:38836: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.44.159.120
country_id: 6251999
description:
Dec 26 23:19:00 host2 sshd[1245241]: Disconnected from invalid user jim 96.44.159.120 port 35158 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-26 23:20:02 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:35798: 535 Incorrect authentication data (set_id=finance@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Dec 26 23:19:33 host2 sshd[1245693]: Disconnected from invalid user gui 35.199.95.142 port 58654 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-26 23:20:17 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:42072: 535 Incorrect authentication data (set_id=newsletter@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.44.159.120
country_id: 6251999
description:
Dec 26 23:20:54 host2 sshd[1247105]: Disconnected from invalid user data 96.44.159.120 port 37934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Dec 26 23:21:16 host2 sshd[1247481]: Disconnected from invalid user felipe 35.199.95.142 port 53762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Dec 26 23:21:27 host2 sshd[1247693]: Disconnected from invalid user prios 27.254.149.199 port 43438 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.44.159.120
country_id: 6251999
description:
Dec 26 23:21:35 host2 sshd[1247843]: Disconnected from invalid user demouser 96.44.159.120 port 51274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.27.206.6
country_id: 1643084
description:
2025-12-26 23:21:40 dovecot_plain authenticator failed for H=(localhost) [103.27.206.6]:34902: 535 Incorrect authentication data (set_id=postfix@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.149.199
country_id: 1605651
description:
Dec 26 23:22:47 host2 sshd[1249281]: Disconnected from invalid user misha 27.254.149.199 port 38730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.199.95.142
country_id: 3469034
description:
Dec 26 23:23:13 host2 sshd[1249657]: Disconnected from invalid user tomek 35.199.95.142 port 60798 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.130
country_id: 1269750
description:
2025-12-26 23:23:58 dovecot_login authenticator failed for H=([182.95.58.130]) [182.95.58.130]:47638: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.30
country_id: 1269750
description:
2025-12-26 23:24:13 dovecot_login authenticator failed for H=([182.78.241.30]) [182.78.241.30]:54946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.144.61.200
country_id: 6252001
description:
2025-12-26 23:24:30 dovecot_plain authenticator failed for H=(localhost) [162.144.61.200]:39396: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.169.185
country_id: 2635167
description:
Dec 26 23:24:48 host2 sshd[1250910]: Disconnected from invalid user red5 188.166.169.185 port 43244 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.37.230
country_id: 1880251
description:
Dec 26 23:25:46 host2 sshd[1252127]: Disconnected from invalid user demo 159.223.37.230 port 54798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.37.230
country_id: 1880251
description:
Dec 26 23:26:25 host2 sshd[1252777]: Disconnected from invalid user adriano 159.223.37.230 port 44258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-26 23:26:29 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:34420: 535 Incorrect authentication data (set_id=help@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.144.61.200
country_id: 6252001
description:
2025-12-26 23:26:40 dovecot_plain authenticator failed for H=(localhost) [162.144.61.200]:52332: 535 Incorrect authentication data (set_id=office@melanifinefood.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 26 23:27:59 host2 sshd[1254301]: Disconnected from invalid user mike 101.47.51.7 port 41994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-26 23:28:21 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:16640: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-26 23:28:48 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:60214: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-12-26 23:29:50 dovecot_login authenticator failed for H=([182.78.255.201]) [125.20.245.182]:34266: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-26 23:29:11 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:22982: 535 Incorrect authentication data (set_id=webmaster@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 26 23:29:16 host2 sshd[1255966]: Disconnected from invalid user servidor 101.47.51.7 port 41188 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-12-26 23:29:30 dovecot_login authenticator failed for H=([160.191.124.201]) [160.191.124.201]:59566: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.13.139.61
country_id: 2510769
description:
2025-12-26 23:29:43 dovecot_login authenticator failed for H=61.red-88-13-139.dynamicip.rima-tde.net [88.13.139.61]:39081: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.184.114
country_id: 1269750
description:
2025-12-26 23:30:12 dovecot_login authenticator failed for H=([152.52.238.86]) [182.95.184.114]:48458: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 26 23:30:22 host2 sshd[1257395]: Disconnected from invalid user administrator 101.47.51.7 port 36918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-26 23:31:25 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:44880: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.51.7
country_id: 1880251
description:
Dec 26 23:31:38 host2 sshd[1258505]: Disconnected from invalid user webftp 101.47.51.7 port 43354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-26 23:33:05 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:37602: 535 Incorrect authentication data (set_id=help@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-26 23:35:35 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:57080: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.78.140.118
country_id: 2802361
description:
Dec 26 23:39:29 host2 pure-ftpd[1266774]: (?@34.78.140.118) [INFO] New connection from 34.78.140.118


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.58.209.243
country_id: 1819730
description:
Dec 26 23:39:42 host2 pure-ftpd[1266956]: (?@123.58.209.243) [INFO] New connection from 123.58.209.243


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.94
country_id: 6252001
description:
Dec 26 23:41:31 host2 dovecot[1881837]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=45.79.181.94, lip=66.85.158.92, session=<qY6q0t5G8iMtT7Ve>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.27.206.6
country_id: 1643084
description:
2025-12-26 23:43:08 dovecot_plain authenticator failed for H=(localhost) [103.27.206.6]:52270: 535 Incorrect authentication data (set_id=postfix@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-26 23:43:22 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:40828: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2603:3:6101:1900::
country_id: 6252001
description:
[2025-12-26 23:43:26 +0530] info [cpaneld] 2603:3:6101:1900:: - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.172.188.89
country_id: 798544
description:
Dec 26 23:45:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=31.172.188.89, lip=66.85.158.91, TLS, session=<tomj3t5GxZEfrLxZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.105.213.23
country_id: 3865483
description:
Dec 26 23:45:28 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<chitral00>, method=PLAIN, rip=190.105.213.23, lip=66.85.158.91, TLS, session=<Ueu7395GV5W+adUX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.13
country_id: 241170
description:
Dec 26 23:46:58 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.13, lip=66.85.158.91, session=<54AG5t5GyLDE+2YN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-26 23:47:56 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:47676: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-12-26 23:48:57 dovecot_login authenticator failed for H=([36.37.203.28]) [36.37.203.28]:34068: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-12-26 23:49:29 dovecot_login authenticator failed for H=([41.59.202.241]) [41.59.202.241]:53524: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.247.233
country_id: 1819730
description:
Dec 26 23:49:50 host2 sshd[1276930]: Disconnected from invalid user xerox 103.144.247.233 port 38326 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-26 23:53:31 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:37074: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-26 23:53:36 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:40567: 535 Incorrect authentication data (set_id=hr@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-26 23:53:40 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:10112: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.222.141.112
country_id: 1880251
description:
Dec 26 23:53:45 host2 sshd[1280405]: Disconnected from invalid user lighttpd 8.222.141.112 port 35206 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 8.222.141.112
country_id: 1880251
description:
Dec 26 23:54:26 host2 sshd[1281393]: Disconnected from invalid user cssserver 8.222.141.112 port 36612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.144.61.200
country_id: 6252001
description:
2025-12-26 23:55:06 dovecot_plain authenticator failed for H=(localhost) [162.144.61.200]:54474: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.144.61.200
country_id: 6252001
description:
2025-12-26 23:55:13 dovecot_plain authenticator failed for H=(localhost) [162.144.61.200]:58436: 535 Incorrect authentication data (set_id=office@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-26 23:56:31 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:48374: 535 Incorrect authentication data (set_id=newsletter@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-26 23:56:46 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:44106: 535 Incorrect authentication data (set_id=webmaster@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.171.168.165
country_id: 6252001
description:
Dec 26 23:59:29 host2 sshd[1286233]: Disconnected from invalid user bitnami 142.171.168.165 port 58470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Dec 26 23:59:41 host2 sshd[1286375]: Disconnected from invalid user erpnext 150.5.129.10 port 43868 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Dec 27 00:00:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.91, session=<KlSBFt9GxglBMRRE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2025-12-27 00:01:00 dovecot_login authenticator failed for H=([218.248.19.102]) [218.248.19.102]:35392: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 142.171.168.165
country_id: 6252001
description:
Dec 27 00:01:04 host2 sshd[1288078]: Received disconnect from 142.171.168.165 port 39958:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-27 00:01:27 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:45534: 535 Incorrect authentication data (set_id=help@nsteeleng.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.171.168.165
country_id: 6252001
description:
Dec 27 00:02:07 host2 sshd[1288844]: Disconnected from invalid user test 142.171.168.165 port 59676 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2025-12-27 00:01:20 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:46134: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 00:02:12 host2 sshd[1288885]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.28.109.188
country_id: 1694008
description:
Dec 27 00:02:59 host2 sshd[1289204]: Disconnected from invalid user nacho 120.28.109.188 port 55562 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 00:04:41 host2 pure-ftpd[1290297]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.28.109.188
country_id: 1694008
description:
Dec 27 00:04:51 host2 sshd[1290391]: Disconnected from invalid user test 120.28.109.188 port 45874 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.5.129.10
country_id: 1819730
description:
Dec 27 00:04:53 host2 sshd[1290417]: Disconnected from invalid user test 150.5.129.10 port 55688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 27 00:04:12 host2 sshd[1289931]: Disconnected from invalid user asad 64.23.180.137 port 60626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Dec 27 00:04:14 host2 sshd[1289939]: Disconnected from invalid user test 150.5.129.10 port 43642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 00:06:03 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:19110: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 27 00:05:17 host2 sshd[1290906]: Disconnected from invalid user ubuntu 64.23.180.137 port 38344 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 00:06:09 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:46922: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.54.17
country_id: 3469034
description:
2025-12-27 00:05:44 dovecot_login authenticator failed for H=(17.54.gonzagatelecom.com.br) [177.128.54.17]:45512: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.86
country_id: 3469034
description:
Dec 27 00:05:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=187.120.72.86, lip=66.85.158.91, TLS, session=<CeddKN9Gwd27eEhW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-27 00:06:00 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:51273: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 142.171.168.165
country_id: 6252001
description:
Dec 27 00:06:15 host2 sshd[1291455]: Received disconnect from 142.171.168.165 port 55350:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 00:06:12 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:18595: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.194.96
country_id: 99237
description:
Dec 27 00:06:10 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<chitral00>, method=PLAIN, rip=65.20.194.96, lip=66.85.158.91, TLS, session=<xPekKd9GBNNBFMJg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 27 00:06:14 host2 sshd[1291451]: Disconnected from invalid user username 64.23.180.137 port 40848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 00:06:15 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:52930: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Dec 27 00:06:24 host2 sshd[1291553]: Disconnected from invalid user ubuntu 125.21.53.232 port 54364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 27 00:07:44 host2 sshd[1292466]: Disconnected from invalid user test 103.123.53.88 port 53178 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-27 00:08:00 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:37130: 535 Incorrect authentication data (set_id=help@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-27 00:08:03 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:43168: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-27 00:07:51 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:39246: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.171.168.165
country_id: 6252001
description:
Dec 27 00:07:20 host2 sshd[1292236]: Disconnected from invalid user test 142.171.168.165 port 44356 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.21.53.232
country_id: 1269750
description:
Dec 27 00:07:33 host2 sshd[1292395]: Disconnected from invalid user autumn 125.21.53.232 port 59742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.123.53.88
country_id: 1269750
description:
Dec 27 00:08:19 host2 sshd[1292765]: Disconnected from invalid user ubuntu 103.123.53.88 port 52428 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.226.64.141
country_id: 1819730
description:
2025-12-27 00:10:48 dovecot_plain authenticator failed for H=(localhost) [129.226.64.141]:51046: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-27 00:11:46 dovecot_plain authenticator failed for H=(localhost) [43.163.105.233]:38590: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-27 00:11:56 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:36490: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.123
country_id: 6252001
description:
Dec 27 00:13:33 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.123, lip=66.85.158.91, session=<fstCRd9GtcxAPpx7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 00:13:37 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:49576: 535 Incorrect authentication data (set_id=news@essenceceylontea.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Dec 27 00:13:46 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.122, lip=66.85.158.91, TLS: Connection closed, session=<vCX7Rd9G6DtAPpx6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-27 00:13:46 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:47604: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-27 00:14:13 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:60307: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.92.70.82
country_id: 1694008
description:
Dec 27 00:15:29 host2 sshd[1298410]: Disconnected from invalid user justin 119.92.70.82 port 42990 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-27 00:15:57 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:33852: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-27 00:17:08 dovecot_login authenticator failed for H=host-196-47-172-253.afnet.net [196.47.172.253]:59387: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 00:17:34 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:41936: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 27 00:18:07 host2 sshd[1300305]: Disconnected from invalid user vlad 96.78.175.36 port 35806 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec 27 00:17:12 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.121, lip=66.85.158.91, TLS: Connection closed, session=<THFQUt9G1tFChJl5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-27 00:17:28 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:45860: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 27 00:18:38 host2 sshd[1300657]: Disconnected from invalid user server1 96.78.175.36 port 51560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.0.109
country_id: 3175395
description:
Dec 27 00:18:57 host2 sshd[1300904]: Disconnected from invalid user ubuntu 151.43.0.109 port 16332 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 27 00:19:12 host2 sshd[1301176]: Disconnected from invalid user mapadmin 96.78.175.36 port 41376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 27 00:20:15 host2 sshd[1302373]: Disconnected from invalid user test 96.78.175.36 port 34704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 00:22:56 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:49254: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.116.225
country_id: 3175395
description:
Dec 27 00:24:05 host2 sshd[1305547]: Disconnected from invalid user vlad 151.47.116.225 port 31777 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.116.225
country_id: 3175395
description:
Dec 27 00:25:05 host2 sshd[1306372]: Disconnected from invalid user openwrt 151.47.116.225 port 31392 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.92.70.82
country_id: 1694008
description:
Dec 27 00:25:27 host2 sshd[1306919]: Disconnected from invalid user pgsql 119.92.70.82 port 57278 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 00:26:25 host2 sshd[1307588]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 00:26:47 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:45774: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 00:27:04 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:58126: 535 Incorrect authentication data (set_id=hr@lankaherbalsolutions.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.116.225
country_id: 3175395
description:
Dec 27 00:26:12 host2 sshd[1307451]: Disconnected from invalid user ftpuser 151.47.116.225 port 31724 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.68
country_id: 6252001
description:
Dec 27 00:26:20 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.68, lip=66.85.158.92, session=<NFf6ct9GiP9BMRRE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.116.225
country_id: 3175395
description:
Dec 27 00:27:22 host2 sshd[1308209]: Disconnected from invalid user mapadmin 151.47.116.225 port 31558 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.47.116.225
country_id: 3175395
description:
Dec 27 00:27:59 host2 sshd[1308533]: Disconnected from invalid user itadmin 151.47.116.225 port 31978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-27 00:30:07 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:36048: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 00:30:53 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:59334: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 00:30:59 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:43863: 535 Incorrect authentication data (set_id=hr@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 00:31:04 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:57880: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 00:31:46 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:29032: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 00:31:10 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:39186: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-27 00:31:17 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:55726: 535 Incorrect authentication data (set_id=hr@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2025-12-27 00:34:02 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:57781: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.224
country_id: 2186224
description:
2025-12-27 00:34:39 dovecot_login authenticator failed for H=([121.73.168.224]) [121.73.168.224]:44956: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-27 00:36:57 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:33986: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.3.153
country_id: 2750405
description:
Dec 27 00:37:24 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=68.183.3.153, lip=66.85.158.92, TLS: Connection closed, session=<yJ6Bmt9GzstEtwOZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.101
country_id: 6252001
description:
Dec 27 00:38:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.101, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<jGHRn99GNsvN0h9l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 27 00:39:34 host2 sshd[1319716]: Disconnected from invalid user admin 2.57.121.112 port 54548 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 00:40:23 host2 sshd[1320971]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 27 00:42:26 host2 sshd[1322271]: Disconnected from invalid user ubuntu 200.77.172.159 port 41238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-27 00:43:08 dovecot_login authenticator failed for H=c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:51618: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 00:44:11 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:2316: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-12-27 00:43:25 dovecot_login authenticator failed for H=(nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:59678: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-12-27 00:43:45 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:50942: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-12-27 00:43:52 dovecot_login authenticator failed for H=(119.92.76.210.static.pldt.net) [119.92.76.210]:39460: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-27 00:44:00 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:41856: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 00:44:20 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:41921: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.77.172.159
country_id: 3996063
description:
Dec 27 00:44:28 host2 sshd[1323849]: Disconnected from invalid user testuser 200.77.172.159 port 54836 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.133.121.104
country_id: 1512440
description:
2025-12-27 00:45:00 dovecot_plain authenticator failed for H=(localhost) [5.133.121.104]:46582: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-27 00:45:12 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:34132: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.64.18
country_id: 1269750
description:
2025-12-27 00:47:28 dovecot_login authenticator failed for H=([125.23.178.65]) [182.78.64.18]:39866: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.179.58.114
country_id: 1269750
description:
2025-12-27 00:47:31 dovecot_plain authenticator failed for H=server1.justsee.co.in (localhost) [180.179.58.114]:34766: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-12-27 00:48:49 dovecot_login authenticator failed for H=([190.85.134.20]) [190.85.134.20]:43364: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 00:49:28 host2 sshd[1328573]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-12-27 00:49:33 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:36750: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-27 00:50:40 dovecot_login authenticator failed for H=(static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:60488: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-27 00:51:32 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:36430: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.172.247.227
country_id: 6252001
description:
Dec 27 00:51:37 host2 pure-ftpd[1331199]: (?@167.172.247.227) [INFO] New connection from 167.172.247.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.233.71.242
country_id: 1880251
description:
2025-12-27 00:52:57 dovecot_plain authenticator failed for H=vmi2581136.contaboserver.net (localhost) [194.233.71.242]:54184: 535 Incorrect authentication data (set_id=postfix@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.106
country_id: 6252001
description:
Dec 27 00:54:30 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.106, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<+mKq199G7M/G6xhq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 00:54:41 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:55072: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-27 00:55:37 dovecot_login authenticator failed for H=([122.186.50.17]) [182.95.61.114]:38380: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.22
country_id: 2186224
description:
2025-12-27 00:55:55 dovecot_login authenticator failed for H=([121.73.163.22]) [121.73.163.22]:45692: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.173.234
country_id: 6252001
description:
Dec 27 01:00:08 host2 pure-ftpd[1337921]: (?@40.124.173.234) [INFO] New connection from 40.124.173.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-27 01:00:35 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:38501: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 01:01:07 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:43058: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 01:01:13 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:41594: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-27 01:03:01 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:59520: 535 Incorrect authentication data (set_id=finance@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-27 01:03:07 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:48010: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 27 01:03:26 host2 sshd[1340951]: Disconnected from invalid user server 64.227.102.57 port 41314 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-27 01:03:42 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:35394: 535 Incorrect authentication data (set_id=newsletter@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec 27 01:03:45 host2 sshd[1341171]: Disconnected from invalid user admin 40.83.182.122 port 46418 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.102.57
country_id: 6252001
description:
Dec 27 01:04:39 host2 sshd[1341765]: Disconnected from invalid user ec2-user 64.227.102.57 port 33102 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.206
country_id: 2635167
description:
Dec 27 01:05:05 host2 dovecot[1881837]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.206, lip=66.85.158.92, TLS, session=<kMqH/d9GV65X7LDO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.136
country_id: 2635167
description:
Dec 27 01:05:09 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.136, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ZTTH/d9GSYVX7LCI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec 27 01:05:39 host2 sshd[1342728]: Disconnected from invalid user guest 40.83.182.122 port 55108 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.139
country_id: 2635167
description:
Dec 27 01:05:42 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.139, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xXLC/99GJeZX7LCL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 01:07:08 host2 pure-ftpd[1344022]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 27 01:06:13 host2 sshd[1343343]: Disconnected from invalid user admin 12.156.67.18 port 48306 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-27 01:06:44 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:43072: 535 Incorrect authentication data (set_id=finance@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.119
country_id: 2635167
description:
Dec 27 01:06:49 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.119, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<x1m5A+BG+7hX7LB3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.125
country_id: 2635167
description:
Dec 27 01:06:16 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.125, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<Zuq9AeBGY75X7LB9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.137
country_id: 6252001
description:
2025-12-27 01:06:20 dovecot_plain authenticator failed for H=([10.8.18.40]) [102.129.153.137]:14528: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.145
country_id: 2635167
description:
Dec 27 01:07:22 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.145, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yYO0BeBGB7i594mR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-27 01:07:46 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:35164: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.130
country_id: 2635167
description:
Dec 27 01:07:55 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.130, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yfetB+BGn+y594mC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.123
country_id: 2635167
description:
Dec 27 01:08:29 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.123, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<rSWrCeBG5Y+594l7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.117
country_id: 2635167
description:
Dec 27 01:09:02 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.117, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<HZ2mC+BGP91X7LB1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-27 01:09:32 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:34008: 535 Incorrect authentication data (set_id=help@nsteeleng.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.144
country_id: 2635167
description:
Dec 27 01:09:35 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.144, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=</BagDeBGDca594mQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.124
country_id: 2635167
description:
Dec 27 01:10:08 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.124, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<EnqbD+BGg+C594l8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 01:11:08 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:8310: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-12-27 01:10:39 dovecot_login authenticator failed for H=pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:59090: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Dec 27 01:10:45 host2 sshd[1346623]: Disconnected from invalid user ubuntu 40.83.182.122 port 49762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-12-27 01:10:49 dovecot_login authenticator failed for H=(cm-178.232.51.135.get.no) [178.232.51.135]:36449: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-27 01:13:51 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:53856: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-27 01:16:04 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:35734: 535 Incorrect authentication data (set_id=help@dataesite.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 47.253.82.89
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[47.253.82.89] [Authentication Database]=[mail] [Username]=[help@dataesite.lk] (10/10 failures) (blocked until [Sat Dec 27 19:46:02 2025 UTC/Sun Dec 28 01:16:02 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 01:15:10 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:55310: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.82.89
country_id: 6252001
description:
2025-12-27 01:16:10 dovecot_plain authenticator failed for H=(localhost) [47.253.82.89]:38512: 535 Incorrect authentication data (set_id=help@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-12-27 01:16:42 dovecot_login authenticator failed for H=(95.158.39.201.bestsolution.net.ua) [95.158.39.201]:45619: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.224.75.198
country_id: 6252001
description:
2025-12-27 01:16:49 dovecot_plain authenticator failed for H=ec2-34-224-75-198.compute-1.amazonaws.com (EC2AMAZ-R0I3EM1.ec2.internal) [34.224.75.198]:61723: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-27 01:17:00 dovecot_login authenticator failed for H=(105-170-97-62.cust.smartcall.no) [62.97.170.105]:49367: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.32.211
country_id: 6252001
description:
Dec 27 01:17:47 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.163.32.211, lip=66.85.158.91, TLS handshaking: Connection closed, session=<AznyKuBGpuIUoyDT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-27 01:18:26 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:46304: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-27 01:19:15 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:43840: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.181.46.5
country_id: 6252001
description:
Dec 27 01:20:59 host2 sshd[1357116]: Disconnected from invalid user luis 66.181.46.5 port 57050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 01:22:53 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:52572: 535 Incorrect authentication data (set_id=news@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.50
country_id: 1733045
description:
2025-12-27 01:23:17 dovecot_login authenticator failed for H=([49.124.153.50]) [49.124.153.50]:60530: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 01:23:29 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:8033: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.58.116.36
country_id: 1269750
description:
2025-12-27 01:23:38 dovecot_login authenticator failed for H=([103.58.116.36]) [103.58.116.36]:5073: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.181.46.5
country_id: 6252001
description:
Dec 27 01:25:59 host2 sshd[1361892]: Disconnected from invalid user myuser 66.181.46.5 port 58588 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 01:25:15 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:35638: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.181.46.5
country_id: 6252001
description:
Dec 27 01:27:03 host2 sshd[1362724]: Disconnected from invalid user dashboard 66.181.46.5 port 59782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.212.122
country_id: 1643084
description:
Dec 27 01:27:21 host2 sshd[1362958]: Disconnected from invalid user server 103.160.212.122 port 50426 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-27 01:28:48 dovecot_plain authenticator failed for H=(localhost) [43.163.105.233]:43780: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.212.122
country_id: 1643084
description:
Dec 27 01:29:25 host2 sshd[1365031]: Disconnected from invalid user client1 103.160.212.122 port 57462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 01:29:17 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:54568: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.181.46.5
country_id: 6252001
description:
Dec 27 01:30:54 host2 sshd[1366392]: Disconnected from invalid user admin1 66.181.46.5 port 56188 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.160.212.122
country_id: 1643084
description:
Dec 27 01:31:28 host2 sshd[1366766]: Disconnected from invalid user cesar 103.160.212.122 port 42638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.213.238.91
country_id: 1210997
description:
Dec 27 01:32:39 host2 sshd[1367878]: Disconnected from invalid user monika 103.213.238.91 port 51390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.160.212.122
country_id: 1643084
description:
Dec 27 01:32:46 host2 sshd[1367955]: Disconnected from invalid user developer1 103.160.212.122 port 42154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-27 01:34:17 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:37632: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 27 01:35:46 host2 sshd[1370900]: Disconnected from invalid user library 181.116.220.11 port 58221 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.83.173.252
country_id: 6252001
description:
Dec 27 01:36:22 host2 pure-ftpd[1371417]: (?@20.83.173.252) [INFO] New connection from 20.83.173.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 01:38:06 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:46516: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 01:38:12 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:15234: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 27 01:39:03 host2 sshd[1373401]: Disconnected from invalid user user 181.116.220.11 port 40725 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 01:40:28 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:55742: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-12-27 01:40:44 dovecot_login authenticator failed for H=([37.57.69.227]) [37.57.69.227]:59955: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.155.19.76
country_id: 1814991
description:
2025-12-27 01:43:51 dovecot_plain authenticator failed for H=(localhost) [8.155.19.76]:46992: 535 Incorrect authentication data (set_id=help@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.226.64.141
country_id: 1819730
description:
2025-12-27 01:44:02 dovecot_plain authenticator failed for H=(localhost) [129.226.64.141]:43152: 535 Incorrect authentication data (set_id=office@kiriaswanu.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 27 01:43:10 host2 sshd[1376818]: Disconnected from invalid user mini 181.116.220.11 port 39224 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-27 01:44:14 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:33530: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.206.225.242
country_id: 6252001
description:
Dec 27 01:46:04 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.206.225.242, lip=66.85.158.92, TLS handshaking: Connection closed, session=<RVsZkOBGDJ2szuHy>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 01:46:23 host2 sshd[1380226]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 01:48:10 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:55202: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.116.220.11
country_id: 3865483
description:
Dec 27 01:49:40 host2 sshd[1382360]: Disconnected from invalid user qiuhan 181.116.220.11 port 47498 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.93.247.247
country_id: 1643084
description:
2025-12-27 01:50:17 dovecot_plain authenticator failed for H=(localhost) [202.93.247.247]:41862: 535 Incorrect authentication data (set_id=hr@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 27 01:50:27 host2 sshd[1383153]: Disconnected from invalid user admin 2.57.121.112 port 11811 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.47
country_id: 1269750
description:
2025-12-27 01:52:15 dovecot_plain authenticator failed for H=(localhost) [66.116.199.47]:46526: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.25.223.210
country_id: 798544
description:
2025-12-27 01:52:18 dovecot_plain authenticator failed for H=host-89.25.223.210.static.3s.pl (inized) [89.25.223.210]:39168: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 01:55:01 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:37522: 535 Incorrect authentication data (set_id=hr@mathsmotorcysle.xyz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.74.148
country_id: 1269750
description:
2025-12-27 01:55:09 dovecot_plain authenticator failed for H=(localhost) [139.59.74.148]:49454: 535 Incorrect authentication data (set_id=contact@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.181.129.131
country_id: 798549
description:
2025-12-27 01:55:58 dovecot_plain authenticator failed for H=(meevas) [81.181.129.131]:58670: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec 27 01:56:14 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XHNytOBGnPZChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.133.121.104
country_id: 1512440
description:
2025-12-27 01:56:11 dovecot_plain authenticator failed for H=(localhost) [5.133.121.104]:51144: 535 Incorrect authentication data (set_id=admin@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-27 01:58:08 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:50109: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-12-27 01:58:28 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:38620: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 02:03:29 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:38108: 535 Incorrect authentication data (set_id=newsletter@dataesite.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.254.85.115
country_id: 6252001
description:
2025-12-27 02:06:02 dovecot_plain authenticator failed for H=(localhost) [47.254.85.115]:34508: 535 Incorrect authentication data (set_id=finance@anandaobauae.org)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 02:06:28 host2 sshd[1397249]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.29.174
country_id: 1643084
description:
2025-12-27 02:06:56 dovecot_plain authenticator failed for H=(localhost) [103.148.29.174]:51388: 535 Incorrect authentication data (set_id=info@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.179.58.114
country_id: 1269750
description:
2025-12-27 02:06:24 dovecot_plain authenticator failed for H=server1.justsee.co.in (localhost) [180.179.58.114]:53164: 535 Incorrect authentication data (set_id=contact@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.116.199.61
country_id: 1269750
description:
2025-12-27 02:07:19 dovecot_plain authenticator failed for H=(localhost) [66.116.199.61]:46878: 535 Incorrect authentication data (set_id=admin@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-27 02:07:42 dovecot_login authenticator failed for H=(57.92.zcomnetworks.com.pk) [103.148.92.57]:44196: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.167.170
country_id: 2186224
description:
2025-12-27 02:08:17 dovecot_login authenticator failed for H=([121.73.167.170]) [121.73.167.170]:54640: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 02:08:52 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:46626: 535 Incorrect authentication data (set_id=support@dataesite.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 27 02:09:13 host2 pure-ftpd[1399902]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.252.5.53
country_id: 6252001
description:
2025-12-27 02:10:56 dovecot_plain authenticator failed for H=(localhost) [47.252.5.53]:52170: 535 Incorrect authentication data (set_id=newsletter@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-27 02:11:32 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:54146: 535 Incorrect authentication data (set_id=support@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.184.118.5
country_id: 1168579
description:
2025-12-27 02:13:43 dovecot_plain authenticator failed for H=(localhost) [182.184.118.5]:1589: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.20.122.54
country_id: 1605651
description:
Dec 27 02:13:52 host2 sshd[1403810]: Disconnected from invalid user teamspeak 103.20.122.54 port 56482 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2025-12-27 02:15:08 dovecot_login authenticator failed for H=([203.145.142.243]) [203.145.142.243]:45132: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.30.137
country_id: 290557
description:
2025-12-27 02:15:28 dovecot_login authenticator failed for H=([94.207.30.137]) [94.207.30.137]:58870: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.156.249
country_id: 2658434
description:
Dec 27 02:15:53 host2 pure-ftpd[1405563]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.156.249
country_id: 2658434
description:
Dec 27 02:15:57 host2 pure-ftpd[1405655]: (?@35.216.156.249) [INFO] New connection from 35.216.156.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.61
country_id: 2186224
description:
2025-12-27 02:16:52 dovecot_login authenticator failed for H=([121.73.168.61]) [121.73.168.61]:49624: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2025-12-27 02:16:39 dovecot_login authenticator failed for H=([188.126.240.80]) [188.126.240.80]:44854: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.25.56.66
country_id: 2635167
description:
Dec 27 02:18:18 host2 sshd[1407445]: Disconnected from invalid user angela 82.25.56.66 port 46938 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.226.118
country_id: 1880251
description:
Dec 27 02:18:54 host2 sshd[1407819]: Disconnected from invalid user theta 45.78.226.118 port 47666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.20.122.54
country_id: 1605651
description:
Dec 27 02:19:07 host2 sshd[1408130]: Disconnected from invalid user minerhub 103.20.122.54 port 40766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.20.122.54
country_id: 1605651
description:
Dec 27 02:20:22 host2 sshd[1409399]: Disconnected from invalid user developer 103.20.122.54 port 48320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Dec 27 02:20:43 host2 sshd[1409734]: Disconnected from invalid user ubuntu 45.78.226.118 port 48646 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 82.25.56.66
country_id: 2635167
description:
Dec 27 02:21:30 host2 sshd[1410308]: Received disconnect from 82.25.56.66 port 56704:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.25.56.66
country_id: 2635167
description:
Dec 27 02:22:01 host2 sshd[1410624]: Disconnected from invalid user borg 82.25.56.66 port 39878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.202.109
country_id: 3017382
description:
2025-12-27 02:22:26 dovecot_plain authenticator failed for H=109.ip-51-77-202.eu (localhost) [51.77.202.109]:49898: 535 Incorrect authentication data (set_id=support@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.92.171.7
country_id: 6252001
description:
2025-12-27 02:24:13 dovecot_plain authenticator failed for H=d3191.use1.stableserver.net (localhost) [190.92.171.7]:52928: 535 Incorrect authentication data (set_id=test@ceylondigest.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.85
country_id: 2635167
description:
Dec 27 02:25:59 host2 pure-ftpd[1414144]: (?@87.236.176.85) [INFO] New connection from 87.236.176.85


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-27 02:26:08 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:59756: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 27 02:25:17 host2 pure-ftpd[1413622]: (?@194.165.16.162) [INFO] New connection from 194.165.16.162


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.254.192
country_id: 1819730
description:
2025-12-27 02:26:16 dovecot_plain authenticator failed for H=(localhost) [103.231.254.192]:58758: 535 Incorrect authentication data (set_id=news@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.25.223.210
country_id: 798544
description:
2025-12-27 02:26:19 dovecot_plain authenticator failed for H=host-89.25.223.210.static.3s.pl (plusly) [89.25.223.210]:41208: 535 Incorrect authentication data (set_id=it@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.115
country_id: 3175395
description:
Dec 27 02:27:37 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<chitral00@bostonlanka.com>, method=PLAIN, rip=185.197.8.115, lip=66.85.158.91, TLS, session=<BqqyI+FGKte5xQhz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.215
country_id: 1269750
description:
Dec 27 02:28:01 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<chitral00>, method=PLAIN, rip=103.70.126.215, lip=66.85.158.91, TLS, session=<eXDdJOFGZa9nRn7X>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.186.147.126
country_id: 1880251
description:
2025-12-27 02:28:19 dovecot_plain authenticator failed for H=126.147.186.35.bc.googleusercontent.com (localhost) [35.186.147.126]:54226: 535 Incorrect authentication data (set_id=webmaster@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 02:28:36 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:54654: 535 Incorrect authentication data (set_id=hr@lankaherbalsolutions.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.240.166.197
country_id: 6252001
description:
2025-12-27 02:29:00 dovecot_plain authenticator failed for H=vps-14540174.konverter.com.br (localhost) [162.240.166.197]:41068: 535 Incorrect authentication data (set_id=hr@kiriaswanu.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.237
country_id: 2186224
description:
2025-12-27 02:30:17 dovecot_login authenticator failed for H=([121.73.169.237]) [121.73.169.237]:44884: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-27 02:30:40 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:54641: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 02:32:08 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:51992: 535 Incorrect authentication data (set_id=news@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.69.209.171
country_id: 6251999
description:
2025-12-27 02:32:52 dovecot_plain authenticator failed for H=mark.tiqqedmail.com (localhost) [158.69.209.171]:44370: 535 Incorrect authentication data (set_id=support@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 02:32:14 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:52870: 535 Incorrect authentication data (set_id=news@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.210.107.22
country_id: 3017382
description:
2025-12-27 02:32:37 dovecot_plain authenticator failed for H=vps-f35c4934.vps.ovh.net (localhost) [51.210.107.22]:40878: 535 Incorrect authentication data (set_id=hr@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 02:33:26 host2 sshd[1420987]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 02:35:27 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:21908: 535 Incorrect authentication data (set_id=contact@dataesite.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 78.31.145.135
country_id: 798544
description:
Dec 27 02:36:53 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=78.31.145.135, lip=66.85.158.91, TLS, session=<bnXfROFGrqNOH5GH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.122.190
country_id: 226074
description:
Dec 27 02:37:15 host2 dovecot[1881837]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.122.190, lip=66.85.158.91, TLS, session=<KuL/ReFGuOTEAHq+>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 02:38:22 host2 sshd[1425845]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-12-27 02:38:10 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.138.237.18
country_id: 1269750
description:
2025-12-27 02:40:46 dovecot_plain authenticator failed for H=(localhost) [103.138.237.18]:6350: 535 Incorrect authentication data (set_id=newsletter@nsteeleng.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-12-27 02:44:49 dovecot_login authenticator failed for H=([223.197.145.126]) [223.197.145.126]:51181: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 174.138.59.242
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[174.138.59.242] [Authentication Database]=[mail] [Username]=[contact@nsteeleng.com] (10/10 failures) (blocked until [Sat Dec 27 21:14:14 2025 UTC/Sun Dec 28 02:44:14 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.138.59.242
country_id: 6252001
description:
2025-12-27 02:44:16 dovecot_plain authenticator failed for H=(localhost) [174.138.59.242]:10522: 535 Incorrect authentication data (set_id=contact@nsteeleng.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 27 02:45:50 host2 sshd[1433529]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.237.78.41
country_id: 3469034
description:
Dec 27 02:45:38 host2 sshd[1433402]: Disconnected from invalid user gmodserver 45.237.78.41 port 44486 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.163.105.233
country_id: 1880251
description:
2025-12-27 02:45:47 dovecot_plain authenticator failed for H=(localhost) [43.163.105.233]:53690: 535 Incorrect authentication data (set_id=support@ceylondigest.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.237.78.41
country_id: 3469034
description:
Dec 27 02:46:14 host2 sshd[1433996]: Disconnected from invalid user confluence 45.237.78.41 port 55436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.237.78.41
country_id: 3469034
description:
Dec 27 02:47:25 host2 sshd[1435037]: Disconnected from invalid user joaquin 45.237.78.41 port 44598 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.142.45
country_id: 6252001
description:
2025-12-27 02:48:40 dovecot_plain authenticator failed for H=(localhost) [47.251.142.45]:54274: 535 Incorrect authentication data (set_id=finance@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-27 02:49:49 dovecot_login authenticator failed for H=(201.173.216.16-clientes-izzi.mx) [201.173.216.16]:54789: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.250.25.214
country_id: 6252001
description:
2025-12-27 02:49:34 dovecot_plain authenticator failed for H=(localhost) [195.250.25.214]:33794: 535 Incorrect authentication data (set_id=news@melanifinefood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.223.20.191
country_id: 2077456
description:
2025-12-27 02:50:21 dovecot_login authenticator failed for H=194-223-20-191.tpgi.com.au [194.223.20.191]:50899: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.182.174.251
country_id: 6252001
description:
2025-12-27 02:50:51 dovecot_plain authenticator failed for H=163-182-174-251.static.as40244.net (localhost) [163.182.174.251]:43964: 535 Incorrect authentication data (set_id=help@kiriaswanu.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.185.167
country_id: 2802361
description:
Dec 27 02:52:38 host2 pure-ftpd[1439641]: (?@35.195.185.167) [INFO] New connection from 35.195.185.167


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.168.117
country_id: 3144096
description:
2025-12-27 02:52:57 dovecot_login authenticator failed for H=(cm-178.232.168.117.get.no) [178.232.168.117]:36701: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.89.14
country_id: 1269750
description:
2025-12-27 02:52:15 dovecot_login authenticator failed for H=([152.52.14.137]) [182.79.89.14]:60696: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.45
country_id: 6252001
description:
Dec 27 02:53:40 host2 dovecot[1881837]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=18.97.5.45, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<XM7dgeFGBoMSYQUt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.137.106.146
country_id: 1814991
description:
2025-12-27 02:55:59 dovecot_plain authenticator failed for H=(localhost) [8.137.106.146]:37130: 535 Incorrect authentication data (set_id=help@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 27 03:00:30 host2 sshd[1446943]: Disconnected from invalid user admin 2.57.121.112 port 32283 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.73.108
country_id: 294640
description:
2025-12-27 03:03:54 dovecot_login authenticator failed for H=(2-55-73-108.orange.net.il) [2.55.73.108]:35042: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.153.161.238
country_id: 2510769
description:
2025-12-27 03:04:09 dovecot_login authenticator failed for H=238.red-79-153-161.dynamicip.rima-tde.net [79.153.161.238]:37621: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-27 03:04:35 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:44400: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-12-27 03:05:03 dovecot_login authenticator failed for H=([203.129.206.14]) [203.129.206.14]:36818: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.7.163.154
country_id: 1643084
description:
2025-12-27 03:05:54 dovecot_plain authenticator failed for H=(localhost) [114.7.163.154]:58770: 535 Incorrect authentication data (set_id=support@essenceceylontea.com)


