# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.187.30
country_id: 6252001
description:
Jan 16 01:15:24 host2 sshd[1777402]: Disconnected from invalid user Administrator 45.61.187.30 port 50258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Jan 16 01:16:43 host2 sshd[1778303]: Disconnected from invalid user exim 45.61.187.30 port 48574 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-16 01:16:54 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:57058: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Jan 16 01:16:17 host2 sshd[1778069]: Disconnected from invalid user httpd 42.200.66.164 port 46534 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.66.164
country_id: 1819730
description:
Jan 16 01:16:57 host2 sshd[1778462]: Disconnected from invalid user blank 42.200.66.164 port 57510 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-16 01:17:03 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:57380: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.8.126.57
country_id: 6252001
description:
Jan 16 01:19:00 host2 sshd[1779734]: Disconnected from invalid user testuser 96.8.126.57 port 48932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.122.86
country_id: 6252001
description:
Jan 16 01:19:12 host2 sshd[1779926]: Disconnected from invalid user rstudio 167.99.122.86 port 47338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.188.80
country_id: 1269750
description:
Jan 16 01:19:27 host2 sshd[1780087]: Disconnected from invalid user airflow 143.110.188.80 port 44474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.122.86
country_id: 6252001
description:
Jan 16 01:20:09 host2 sshd[1780724]: Disconnected from invalid user admin 167.99.122.86 port 38618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.21.38.198
country_id: 1269750
description:
Jan 16 01:20:22 host2 sshd[1780946]: Disconnected from invalid user ubnt 202.21.38.198 port 52070 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.188.80
country_id: 1269750
description:
Jan 16 01:20:38 host2 sshd[1781450]: Disconnected from invalid user sidadm 143.110.188.80 port 49836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.152.250.192
country_id: 3469034
description:
Jan 16 01:21:35 host2 sshd[1782217]: Disconnected from invalid user zabbix 164.152.250.192 port 38442 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2026-01-16 01:22:44 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:57097: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-01-16 01:22:59 dovecot_login authenticator failed for H=([122.187.230.213]) [122.187.230.213]:35801: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.152.250.192
country_id: 3469034
description:
Jan 16 01:25:47 host2 sshd[1785480]: Disconnected from invalid user nic2212 164.152.250.192 port 34676 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-01-16 01:25:46 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (couste) [24.1.200.187]:45540: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2026-01-16 01:27:31 dovecot_plain authenticator failed for H=c-73-213-236-66.hsd1.va.comcast.net (gally) [73.213.236.66]:41818: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.79.19.190
country_id: 953987
description:
Jan 16 01:29:01 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=41.79.19.190, lip=66.85.158.91, TLS, session=<cWfEpnJI868pTxO+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-16 01:28:48 dovecot_plain authenticator failed for H=(nucrooks) [65.20.160.107]:42069: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.67.155.173
country_id: 298795
description:
Jan 16 01:29:18 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers>, method=PLAIN, rip=45.67.155.173, lip=66.85.158.91, TLS, session=<+MACqHJIarwtQ5ut>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.250.103.184
country_id: 3469034
description:
Jan 16 01:32:08 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 28 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=167.250.103.184, lip=66.85.158.91, TLS, session=<tiBzsXJILa+n+me4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.237.81.65
country_id: 3469034
description:
Jan 16 01:32:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=200.237.81.65, lip=66.85.158.91, TLS, session=<Ja8+s3JIPbzI7VFB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2026-01-16 01:35:02 dovecot_login authenticator failed for H=202-82-20-241.static.imsbiz.com [202.82.20.241]:54652: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Jan 16 01:35:10 host2 sshd[1792197]: Disconnected from invalid user user 2.57.121.25 port 52351 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.64.3.94
country_id: 1269750
description:
2026-01-16 01:34:34 dovecot_login authenticator failed for H=(abts-north-dynamic-094.3.64.182.airtelbroadband.in) [182.64.3.94]:47554: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.146
country_id: 3469034
description:
Jan 16 01:37:14 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=191.53.128.146, lip=66.85.158.91, TLS, session=<D35GxHJI9by/NYCS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.159.117
country_id: 99237
description:
Jan 16 01:37:34 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=65.20.159.117, lip=66.85.158.91, TLS, session=<bwZ0xXJIVrFBFJ91>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.70.19.11
country_id: 3469034
description:
2026-01-16 01:39:18 dovecot_login authenticator failed for H=(45-70-19-11.static.damsolutionsturbo.com.br) [45.70.19.11]:43095: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2026-01-16 01:39:39 dovecot_login authenticator failed for H=([128.185.241.213]) [125.19.138.74]:55806: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2026-01-16 01:41:50 dovecot_plain authenticator failed for H=(eting) [65.20.133.4]:38225: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.207.246.49
country_id: 1269750
description:
Jan 16 01:43:09 host2 sshd[1798082]: Disconnected from invalid user role1 49.207.246.49 port 51174 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.250.183.241
country_id: 4566966
description:
[2025-12-26 17:26:14 +0530] info [webmaild] 104.250.183.241 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.10.242.161
country_id: 1269750
description:
Jan 16 01:47:39 host2 sshd[1801860]: Disconnected from invalid user dockeradmin 216.10.242.161 port 56022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.207.246.49
country_id: 1269750
description:
Jan 16 01:48:40 host2 sshd[1802561]: Disconnected from invalid user wireguard 49.207.246.49 port 49550 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.10.242.161
country_id: 1269750
description:
Jan 16 01:48:45 host2 sshd[1802606]: Disconnected from invalid user nexus 216.10.242.161 port 45448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.10.242.161
country_id: 1269750
description:
Jan 16 01:49:17 host2 sshd[1803016]: Disconnected from invalid user puppet 216.10.242.161 port 52682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.139.145
country_id: 1643084
description:
Jan 16 01:49:24 host2 sshd[1803088]: Disconnected from invalid user chef 103.165.139.145 port 34010 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.207.246.49
country_id: 1269750
description:
Jan 16 01:50:37 host2 sshd[1804184]: Disconnected from invalid user nas 49.207.246.49 port 51310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.139.145
country_id: 1643084
description:
Jan 16 01:50:42 host2 sshd[1804364]: Disconnected from invalid user apc 103.165.139.145 port 57062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.139.145
country_id: 1643084
description:
Jan 16 01:51:17 host2 sshd[1804838]: Disconnected from invalid user aladmin 103.165.139.145 port 40326 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.37
country_id: 6252001
description:
Jan 16 01:51:29 host2 dovecot[221878]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.37, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wxlS+HJISN2TuYQl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.165.139.145
country_id: 1643084
description:
Jan 16 01:51:53 host2 sshd[1805227]: Disconnected from invalid user sendmail 103.165.139.145 port 51816 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2026-01-16 01:55:22 dovecot_login authenticator failed for H=(arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:47230: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2026-01-16 01:54:54 dovecot_login authenticator failed for H=([182.79.151.121]) [27.123.84.54]:38918: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.123
country_id: 2186224
description:
2026-01-16 01:55:12 dovecot_login authenticator failed for H=([121.73.163.123]) [121.73.163.123]:58336: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
country_id: 3469034
description:
2026-01-16 01:55:47 dovecot_login authenticator failed for H=(200-205-22-25.customer.tdatabrasil.net.br) [186.200.158.42]:35672: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.127
country_id: 2186224
description:
2026-01-16 01:58:55 dovecot_login authenticator failed for H=([121.73.162.127]) [121.73.162.127]:45132: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2026-01-16 01:59:05 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:46029: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Jan 16 01:59:34 host2 sshd[1811850]: Disconnected from invalid user zimbra 141.147.62.42 port 34400 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.183.0.245
country_id: 2963597
description:
2026-01-16 02:02:20 dovecot_login authenticator failed for H=(33b70f5.skybroadband.com) [51.183.0.245]:49696: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.202
country_id: 1269750
description:
2026-01-16 02:02:33 dovecot_login authenticator failed for H=([152.52.238.54]) [27.123.92.202]:55648: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Jan 16 02:05:58 host2 sshd[1817847]: Disconnected from invalid user role1 141.147.62.42 port 37698 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.66
country_id: 1269750
description:
2026-01-16 02:08:05 dovecot_login authenticator failed for H=([122.187.230.66]) [122.187.230.66]:34356: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.184.151
country_id: 1269750
description:
2026-01-16 02:08:45 dovecot_login authenticator failed for H=([103.57.184.151]) [103.57.184.151]:57328: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2026-01-16 02:08:52 dovecot_login authenticator failed for H=(ip-103-29-185-162.pascalwave.com) [103.29.185.162]:55902: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.176.136
country_id: 2139685
description:
2026-01-16 02:09:04 dovecot_login authenticator failed for H=host-202-166-176-136.static.lagoon.nc [202.166.176.136]:52028: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.74.174
country_id: 1861060
description:
Jan 16 02:10:46 host2 sshd[1821954]: Disconnected from invalid user postgres 133.117.74.174 port 50054 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.147.62.42
country_id: 2921044
description:
Jan 16 02:13:04 host2 sshd[1824019]: Disconnected from invalid user huawei 141.147.62.42 port 52304 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 02:13:56 host2 sshd[1824783]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2026-01-16 02:15:03 dovecot_login authenticator failed for H=(nsg-static-193.87.72.182.airtel.in) [182.74.12.86]:35482: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2026-01-16 02:15:18 dovecot_login authenticator failed for H=([152.52.204.27]) [128.185.254.162]:42342: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.0.182
country_id: 3469034
description:
2026-01-16 02:14:48 dovecot_login authenticator failed for H=([177.74.52.129]) [177.74.0.182]:53344: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.74.174
country_id: 1861060
description:
Jan 16 02:17:05 host2 sshd[1827741]: Disconnected from invalid user rustserver 133.117.74.174 port 49220 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Jan 16 02:17:55 host2 sshd[1828304]: Disconnected from invalid user sonar 141.147.62.42 port 50332 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 133.117.74.174
country_id: 1861060
description:
Jan 16 02:18:53 host2 sshd[1829050]: Disconnected from invalid user cyrus 133.117.74.174 port 42332 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2026-01-16 02:19:11 dovecot_login authenticator failed for H=([185.255.212.178]) [185.255.212.178]:1908: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.74.174
country_id: 1861060
description:
Jan 16 02:19:35 host2 sshd[1829589]: Disconnected from invalid user dockeradmin 133.117.74.174 port 45952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.20
country_id: 1269750
description:
2026-01-16 02:19:39 dovecot_login authenticator failed for H=(nsg-corporate-20.230.187.122.airtel.in) [122.187.230.20]:36873: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.104.166
country_id: 6252001
description:
Jan 16 02:22:02 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.104.166, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<46mJZXNIVsmsymim>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2026-01-16 02:22:06 dovecot_plain authenticator failed for H=(tabloar) [46.10.210.68]:42981: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.83.39.144
country_id: 690791
description:
Jan 16 02:26:51 host2 sshd[1836307]: Invalid user cloudtourssrilan_travel from 77.83.39.144 port 48408


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.194.88.120
country_id: 6251999
description:
2026-01-16 02:27:04 dovecot_login authenticator failed for H=([207.194.88.120]) [207.194.88.120]:59560: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.204.165
country_id: 6251999
description:
Jan 16 02:27:13 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.204.165, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CwYXeHNIZJqAy8yl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.101.146
country_id: 1269750
description:
2026-01-16 02:26:43 dovecot_login authenticator failed for H=(aes-static-217.70.22.125.airtel.in) [27.123.101.146]:56572: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.189
country_id: 6252001
description:
2026-01-16 02:29:48 dovecot_login authenticator failed for H=([209.23.72.189]) [209.23.72.189]:46824: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-01-16 02:31:10 dovecot_plain authenticator failed for H=(acidrost) [12.150.243.22]:21158: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan 16 02:38:04 host2 sshd[1846424]: Disconnected from invalid user installer 172.208.24.217 port 31188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.184.19
country_id: 1880251
description:
Jan 16 02:38:30 host2 sshd[1846740]: Disconnected from invalid user rancher 128.199.184.19 port 47132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.154.85
country_id: 6252001
description:
Jan 16 02:38:39 host2 sshd[1846902]: Disconnected from invalid user vpn 146.190.154.85 port 35566 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Jan 16 02:38:50 host2 sshd[1847005]: Disconnected from invalid user aladmin 101.36.119.218 port 50276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.180.88.176
country_id: 6252001
description:
Jan 16 02:38:53 host2 sshd[1847100]: Disconnected from invalid user home 107.180.88.176 port 36546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-01-16 02:39:04 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (thrighelo) [73.199.161.144]:53624: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.83.57
country_id: 1269750
description:
Jan 16 02:39:44 host2 sshd[1847832]: Disconnected from invalid user installer 59.98.83.57 port 57730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.24.217
country_id: 6252001
description:
Jan 16 02:40:00 host2 sshd[1848042]: Disconnected from invalid user arista 172.208.24.217 port 52616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.11.64.103
country_id: 241170
description:
Jan 16 02:40:06 host2 sshd[1848291]: Disconnected from invalid user puppet 212.11.64.103 port 36854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.13.244.219
country_id: 3686110
description:
Jan 16 02:40:10 host2 sshd[1848361]: Disconnected from invalid user tomcat 200.13.244.219 port 58626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-01-16 02:40:25 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [181.54.70.40]:45246: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.145
country_id: 2328926
description:
Jan 16 02:39:44 host2 sshd[1847841]: Disconnected from invalid user mongo 102.88.137.145 port 54854 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2026-01-16 02:40:40 dovecot_login authenticator failed for H=([182.95.52.170]) [182.95.52.170]:39388: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.151.91.78
country_id: 732800
description:
Jan 16 02:41:20 host2 sshd[1849507]: Disconnected from invalid user linksys 45.151.91.78 port 33016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.24.217
country_id: 6252001
description:
Jan 16 02:40:34 host2 sshd[1848786]: Disconnected from invalid user sys 172.208.24.217 port 21530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.35.101.66
country_id: 3175395
description:
Jan 16 02:41:04 host2 sshd[1849282]: Disconnected from invalid user arista 151.35.101.66 port 54552 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.98.83.57
country_id: 1269750
description:
Jan 16 02:41:40 host2 sshd[1849759]: Disconnected from invalid user postfix 59.98.83.57 port 35490 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.180.88.176
country_id: 6252001
description:
Jan 16 02:43:09 host2 sshd[1850998]: Disconnected from invalid user ipcop 107.180.88.176 port 54120 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 129.226.172.185
country_id: 1819730
description:
Jan 16 02:42:56 host2 sshd[1850759]: Disconnected from invalid user httpd 129.226.172.185 port 36332 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 16 02:43:47 host2 sshd[1851476]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Jan 16 02:44:03 host2 sshd[1851714]: Disconnected from invalid user Administrator 101.36.119.218 port 57176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.13.244.219
country_id: 3686110
description:
Jan 16 02:43:50 host2 sshd[1851512]: Disconnected from invalid user appuser 200.13.244.219 port 60022 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2026-01-16 02:43:57 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:56331: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.151.91.78
country_id: 732800
description:
Jan 16 02:44:12 host2 sshd[1852006]: Disconnected from invalid user debian 45.151.91.78 port 57434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.241.64
country_id: 1269750
description:
Jan 16 02:44:17 host2 sshd[1852074]: Disconnected from invalid user oleg 143.110.241.64 port 47952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.199.184.19
country_id: 1880251
description:
Jan 16 02:44:52 host2 sshd[1852697]: Disconnected from invalid user nagiosadmin 128.199.184.19 port 53756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.145
country_id: 2328926
description:
Jan 16 02:44:38 host2 sshd[1852515]: Disconnected from invalid user omv 102.88.137.145 port 50424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.107.10.66
country_id: 2921044
description:
Jan 16 02:45:31 host2 sshd[1853503]: Disconnected from invalid user oleg 89.107.10.66 port 49196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.218
country_id: 1819730
description:
Jan 16 02:45:35 host2 sshd[1853569]: Disconnected from invalid user storage 101.36.119.218 port 56730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.241.64
country_id: 1269750
description:
Jan 16 02:45:50 host2 sshd[1854024]: Disconnected from invalid user jupyter 143.110.241.64 port 37990 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.6
country_id: 6251999
description:
Jan 16 02:45:52 host2 dovecot[221878]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.6, lip=66.85.158.91, TLS: Connection closed, session=<NpjNunNIEqlV2ZUG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.35.101.66
country_id: 3175395
description:
Jan 16 02:46:19 host2 sshd[1854557]: Disconnected from invalid user wildfly 151.35.101.66 port 54521 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.88.137.145
country_id: 2328926
description:
Jan 16 02:46:37 host2 sshd[1854825]: Disconnected from invalid user jeff 102.88.137.145 port 56084 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-01-16 02:47:22 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (noposang) [196.47.172.253]:58622: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.15.118.76
country_id: 2464461
description:
2026-01-16 02:47:29 dovecot_login authenticator failed for H=([197.15.118.76]) [197.15.118.76]:37444: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.182.222.171
country_id: 3175395
description:
2026-01-16 02:47:55 dovecot_login authenticator failed for H=host-80-182-222-171.pool80182.interbusiness.it [80.182.222.171]:40512: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.74.5.91
country_id: 2395170
description:
Jan 16 02:48:19 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=41.74.5.91, lip=66.85.158.91, TLS, session=<qEwdwnNI+MwpSgVb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 131.0.249.35
country_id: 3469034
description:
Jan 16 02:48:40 host2 dovecot[221878]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<env_eng>, method=PLAIN, rip=131.0.249.35, lip=66.85.158.91, TLS, session=<acu3w3NIh5SDAPkj>


