# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 00:25:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<+8VIRhZGmt0+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 00:25:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<sESGRhZG/ss+PIcm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 00:29:24 host2 sshd[1403195]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 61844


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.30.35
country_id: 953987
description:
2025-12-17 00:29:58 dovecot_login authenticator failed for (ADMIN) [154.47.30.35]:1409: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-17 00:30:12 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (zossain) [71.235.225.181]:56080: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 00:31:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<lzdHXBZGbLs+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.241.132.152
country_id: 1269750
description:
2025-12-17 00:32:19 dovecot_login authenticator failed for (static.ill.117.248.107.130.bsnl.co.in) [43.241.132.152]:34398: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-17 00:32:37 dovecot_login authenticator failed for ([122.184.127.86]) [122.184.127.86]:43494: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Dec 17 00:33:28 host2 sshd[1406435]: Disconnected from invalid user user 50.84.211.204 port 33544 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 50.84.211.204
country_id: 6252001
description:
Dec 17 00:34:01 host2 sshd[1406793]: Disconnected from invalid user ahmed 50.84.211.204 port 46044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.162.8
country_id: 1880251
description:
Dec 17 00:36:09 host2 sshd[1408748]: Disconnected from invalid user ahmed 15.235.162.8 port 41444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 00:35:44 host2 sshd[1408329]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 54652


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 15.235.162.8
country_id: 1880251
description:
Dec 17 00:38:11 host2 sshd[1410059]: Disconnected from invalid user hadi 15.235.162.8 port 38050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 17 00:37:41 host2 sshd[1409718]: Disconnected from invalid user user 152.32.130.118 port 54946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 17 00:38:25 host2 sshd[1410188]: Disconnected from invalid user onkar 152.32.130.118 port 54140 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 15.235.162.8
country_id: 1880251
description:
Dec 17 00:38:49 host2 sshd[1410389]: Disconnected from invalid user demo 15.235.162.8 port 42396 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.221.119
country_id: 298795
description:
2025-12-17 00:38:52 dovecot_plain authenticator failed for (mitass) [5.11.221.119]:55730: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2025-12-17 00:39:21 dovecot_plain authenticator failed for (taptly) [5.11.143.72]:53132: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 00:39:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Vz4ueBZGWpQ+PIcm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.130.118
country_id: 1819730
description:
Dec 17 00:40:51 host2 sshd[1412351]: Disconnected from invalid user ubuntu 152.32.130.118 port 37568 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 17 00:40:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<1945ehZGiJQ+PIdq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 00:42:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Y5HggBZG3rU+PIcm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.221.74.234
country_id: 226074
description:
Dec 17 00:45:17 host2 sshd[1415433]: Disconnected from invalid user faisal 45.221.74.234 port 39640 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.232.33
country_id: 6252001
description:
2025-12-17 00:45:48 dovecot_login authenticator failed for (ADMIN) [102.129.232.33]:60116: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.22.161
country_id: 6252001
description:
Dec 17 00:45:49 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.172.22.161, lip=66.85.158.92, TLS, session=<ccI7jhZGnrOnrBah>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.53.38.51
country_id: 6251999
description:
2025-12-17 00:46:02 dovecot_plain authenticator failed for (salitrole) [24.53.38.51]:48299: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-17 00:46:07 dovecot_plain authenticator failed for (peresm) [65.20.133.208]:58961: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.62
country_id: 798549
description:
2025-12-17 00:45:27 dovecot_login authenticator failed for (ADMIN) [143.244.52.62]:24496: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.156
country_id: 6252001
description:
Dec 17 00:47:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<graakhZGdNuTuYSc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-12-17 00:47:06 dovecot_login authenticator failed for (186.235.248.73.girardi-rs.com.br) [186.235.248.73]:47818: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-17 00:46:36 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:55516: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 00:48:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<rDFGmRZG9M4+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2025-12-17 00:49:21 dovecot_login authenticator failed for ([67.55.189.211]) [67.55.189.211]:53420: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-12-17 00:49:56 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:51963: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 17 00:50:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<w8p4nxZGpo8+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-17 00:51:38 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:39702: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 00:52:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<LsNSpxZG6rA+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.225.255.82
country_id: 2510769
description:
2025-12-17 00:53:36 dovecot_login authenticator failed for (82.red.255.225.212.procono.es) [212.225.255.82]:46526: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2025-12-17 00:54:02 dovecot_login authenticator failed for (static.ill.117.250.107.180.bsnl.co.in) [117.250.107.180]:47310: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.162
country_id: 6252001
description:
Dec 17 00:54:15 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.162, lip=66.85.158.92, session=<tDZdrBZGECFC5DWi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-17 00:54:28 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:38620: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-17 00:54:34 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (ambatter) [67.172.54.29]:59084: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 00:54:48 host2 sshd[1423387]: Disconnected from invalid user user 2.57.121.25 port 51704 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 00:55:17 host2 pure-ftpd[1423999]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 00:57:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<Vx+OthZGNK0+PIMh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.47.10.123
country_id: 3469034
description:
Dec 17 00:59:56 host2 sshd[1426453]: Disconnected from invalid user ria 189.47.10.123 port 60134 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-17 01:00:22 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (octainal) [87.103.126.54]:22491: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.47.10.123
country_id: 3469034
description:
Dec 17 01:01:43 host2 sshd[1427946]: Disconnected from invalid user onkar 189.47.10.123 port 50500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.168.120
country_id: 1269750
description:
2025-12-17 01:02:15 dovecot_plain authenticator failed for (6S73LVD8) [49.43.168.120]:5856: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 17 01:03:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<i5GFyxZGxOc+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 17 01:04:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<3Nml0BZGdIiLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.124
country_id: 3144096
description:
2025-12-17 01:06:28 dovecot_login authenticator failed for (ADMIN) [46.246.122.124]:13806: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 17 01:08:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<Vr773RZGboI+PIdo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.61
country_id: 6252001
description:
2025-12-17 01:08:30 dovecot_login authenticator failed for (ADMIN) [191.96.37.61]:60739: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 180.188.253.150
country_id: 1269750
description:
Dec 17 01:09:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=180.188.253.150, lip=66.85.158.91, session=<uRc84hZGTpe0vP2W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 105.73.203.129
country_id: 2542007
description:
Dec 17 01:09:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=105.73.203.129, lip=66.85.158.91, TLS, session=<yho94RZGl6lpScuB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.250.149.25
country_id: 1269750
description:
Dec 17 01:09:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=117.250.149.25, lip=66.85.158.91, TLS, session=<6/p94hZG1NJ1+pUZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.228.34
country_id: 1269750
description:
Dec 17 01:09:52 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<hr>, method=PLAIN, rip=115.241.228.34, lip=66.85.158.91, TLS, session=<PVwD4xZG6KVz8eQi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 01:09:15 host2 sshd[1433858]: Disconnected from invalid user chantel 62.60.131.157 port 46895 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.186.54.65
country_id: 298795
description:
Dec 17 01:09:29 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=78.186.54.65, lip=66.85.158.91, session=<3S6z4hZGANpOujZB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 88.82.212.15
country_id: 2510769
description:
Dec 17 01:09:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=88.82.212.15, lip=66.85.158.91, TLS, session=<FWR/4hZGBcxYUtQP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 01:09:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<MKpB5BZGetY+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 01:11:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<AoDN6RZGCMc+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-17 01:12:13 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (winioninic) [73.144.27.228]:57670: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 17 01:14:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<baKn8xZGtMY+PIdi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Dec 17 01:14:28 host2 sshd[1438308]: Disconnected from invalid user test 45.78.203.166 port 38112 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 01:16:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<bvjn+xZGqJY+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Dec 17 01:19:34 host2 sshd[1442473]: Disconnected from invalid user bravo 45.78.203.166 port 58646 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.44
country_id: 6252001
description:
Dec 17 01:19:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.169.105.44, lip=66.85.158.92, session=<vRxLBxdGaK4UqWks>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.19
country_id: 2029969
description:
2025-12-17 01:20:29 dovecot_login authenticator failed for (ADMIN) [173.244.58.19]:54088: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 01:21:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<XQ1SDBdGVNI+PIdf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.166
country_id: 1880251
description:
Dec 17 01:27:05 host2 sshd[1448153]: Disconnected from invalid user tom 45.78.203.166 port 57458 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.38.106.200
country_id: 2802361
description:
Dec 17 01:28:42 host2 pure-ftpd[1449400]: (?@34.38.106.200) [INFO] New connection from 34.38.106.200


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 01:28:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<EH8kKBdGRN0+PIcm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 01:30:01 host2 sshd[1450232]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.241.97
country_id: 2802361
description:
Dec 17 01:29:29 host2 pure-ftpd[1449964]: (?@35.195.241.97) [INFO] New connection from 35.195.241.97


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 17 01:32:12 host2 pure-ftpd[1451877]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 17 01:32:16 host2 pure-ftpd[1451901]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.166
country_id: 1880251
description:
Dec 17 01:33:34 host2 sshd[1452654]: Disconnected from invalid user psg 45.78.203.166 port 59122 [preauth]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 17 01:34:22 host2 pure-ftpd[1453094]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 01:35:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<33SXPhdGPOE+PIce>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.242.226.19
country_id: 6252001
description:
Dec 17 01:34:18 host2 pure-ftpd[1453055]: (?@185.242.226.19) [INFO] New connection from 185.242.226.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.153
country_id: 2658434
description:
2025-12-17 01:38:24 dovecot_login authenticator failed for (ADMIN) [158.173.152.153]:12770: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 01:41:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<IlvUUxdG4MU+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.133
country_id: 3077311
description:
2025-12-17 01:42:23 dovecot_login authenticator failed for (ADMIN) [212.102.39.133]:20716: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 17 01:43:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<MLRFWxdG0r4+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-12-17 01:46:11 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:33700: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-12-17 01:46:27 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:52690: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 01:47:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<o28saRdGMKw+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-17 01:48:43 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (subles) [98.193.112.85]:59120: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 01:48:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<Xes9bxdGBLA+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.166
country_id: 2993457
description:
Dec 17 01:49:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.166, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<WdeEcRdGM/7CpRCm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.110.223.72
country_id: 6251999
description:
Dec 17 01:50:59 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=143.110.223.72, lip=66.85.158.91, TLS, session=<whNNdxdGMpmPbt9I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.199.81.100
country_id: 6252001
description:
Dec 17 01:53:21 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.199.81.100, lip=66.85.158.92, session=<LLvDfxdGfKvGx1Fk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec 17 01:54:17 host2 sshd[1464144]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 62004


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 17 01:54:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<zsIFgxdG3KQ+PIcc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.223.68
country_id: 6252001
description:
Dec 17 01:54:27 host2 sshd[1464237]: Disconnected from invalid user sftp 34.66.223.68 port 55998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Dec 17 01:56:07 host2 sshd[1465287]: Disconnected from invalid user arjun 203.150.162.250 port 54532 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 01:56:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<LiPAiRdGXKA+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 17 01:56:24 host2 sshd[1465572]: Disconnected from invalid user ml 103.164.81.65 port 52356 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 01:56:53 host2 pure-ftpd[1465967]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec 17 01:57:31 host2 sshd[1466460]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 4877


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 17 01:57:39 host2 sshd[1466503]: Disconnected from invalid user admin 51.178.43.161 port 43264 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 17 01:57:43 host2 sshd[1466514]: Disconnected from invalid user ansible 103.164.81.65 port 22138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.81.65
country_id: 1819730
description:
Dec 17 01:58:21 host2 sshd[1466738]: Disconnected from invalid user admin 103.164.81.65 port 34522 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 01:58:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<u7OGkRdGZIA+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 17 02:00:11 host2 sshd[1467529]: Disconnected from invalid user vpsuser 51.178.43.161 port 48918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.42.51
country_id: 690791
description:
2025-12-17 01:59:37 dovecot_login authenticator failed for (ADMIN) [84.239.42.51]:56158: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.223.68
country_id: 6252001
description:
Dec 17 01:59:54 host2 sshd[1467189]: Disconnected from invalid user cs 34.66.223.68 port 44208 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 17 02:00:45 host2 sshd[1467758]: Received disconnect from 51.178.43.161 port 33114:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.178.43.161
country_id: 3017382
description:
Dec 17 02:00:45 host2 sshd[1467758]: Disconnected from invalid user lighthouse 51.178.43.161 port 33114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Dec 17 02:00:49 host2 sshd[1467791]: Disconnected from invalid user ubuntu 203.150.162.250 port 55100 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 02:01:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<bPzLnRdGCo8+PIde>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.150.162.250
country_id: 1605651
description:
Dec 17 02:02:06 host2 sshd[1468397]: Disconnected from invalid user lighthouse 203.150.162.250 port 38660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.162.250
country_id: 1605651
description:
Dec 17 02:02:41 host2 sshd[1468705]: Disconnected from invalid user db2inst1 203.150.162.250 port 37146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 02:03:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<ZwW1ohdGeLY+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.9
country_id: 1522867
description:
2025-12-17 02:02:35 dovecot_login authenticator failed for (ADMIN) [62.133.47.9]:59835: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.46
country_id: 6252001
description:
Dec 17 02:04:37 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.46, lip=66.85.158.92, session=<3gUIqBdGQnKsaAsu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.163
country_id: 6252001
description:
Dec 17 02:08:00 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.163, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<vlQdtBdG+sfN0h+j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-12-17 02:08:48 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (rectin) [24.98.45.238]:58094: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 02:09:23 host2 sshd[1471926]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.80
country_id: 3144096
description:
2025-12-17 02:09:48 dovecot_login authenticator failed for (80-170-97-62.cust.smartcall.no) [62.97.170.80]:46082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2025-12-17 02:10:03 dovecot_login authenticator failed for ([201.219.68.189]) [201.219.68.189]:45447: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.103.225.182
country_id: 3996063
description:
Dec 17 02:11:16 host2 sshd[1472839]: Disconnected from invalid user david 201.103.225.182 port 50014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-17 02:11:39 dovecot_login authenticator failed for ([192.169.120.37]) [192.169.120.37]:41234: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.134.231
country_id: 1819730
description:
Dec 17 02:14:43 host2 sshd[1474923]: Disconnected from invalid user precio01 152.32.134.231 port 59768 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.103.225.182
country_id: 3996063
description:
Dec 17 02:15:07 host2 sshd[1475410]: Disconnected from invalid user vyos 201.103.225.182 port 36356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.134.231
country_id: 1819730
description:
Dec 17 02:15:19 host2 sshd[1475517]: Disconnected from invalid user leo 152.32.134.231 port 32894 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.134.231
country_id: 1819730
description:
Dec 17 02:17:05 host2 sshd[1476303]: Disconnected from invalid user sun 152.32.134.231 port 34008 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.78.54.93
country_id: 2750405
description:
2025-12-17 02:17:04 dovecot_login authenticator failed for (ADMIN) [195.78.54.93]:38567: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 02:17:06 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61510: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.198.63.135
country_id: 6252001
description:
Dec 17 02:18:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=143.198.63.135, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<3JGY2BdGOpuPxj+H>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.184.27
country_id: 6252001
description:
Dec 17 02:18:35 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=40.124.184.27, lip=66.85.158.92, session=<bIv52RdGKOIofLgb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 17 02:18:41 host2 sshd[1476801]: Disconnected from invalid user wanghao 209.15.119.12 port 40818 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 02:20:25 host2 sshd[1477753]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 17 02:21:48 host2 sshd[1478470]: Disconnected from invalid user cuckoo 209.15.119.12 port 33214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.19.109.7
country_id: 3175395
description:
Dec 17 02:20:56 host2 sshd[1477938]: Disconnected from invalid user jmarquez 151.19.109.7 port 10858 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 02:22:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<3HXy5xdGuOg+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.40.218.140
country_id: 6252001
description:
Dec 17 02:22:02 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.40.218.140, lip=66.85.158.91, session=<R+FK5hdG/tAUKNqM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 02:22:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<q38C5xdGJJs+PIcl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.119.12
country_id: 1605651
description:
Dec 17 02:22:22 host2 sshd[1478803]: Disconnected from invalid user taiga 209.15.119.12 port 54336 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.29
country_id: 6290252
description:
2025-12-17 02:24:17 dovecot_login authenticator failed for (ADMIN) [37.46.115.29]:33764: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 17 02:25:21 host2 sshd[1480545]: Disconnected from invalid user runner 186.80.18.158 port 35552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 17 02:26:19 host2 sshd[1481188]: Disconnected from invalid user postgres 154.91.81.224 port 35816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 17 02:26:33 host2 sshd[1481350]: Disconnected from invalid user github 186.80.18.158 port 38024 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 02:27:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=</LxH+BdGJrI+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 17 02:27:32 host2 sshd[1481920]: Disconnected from invalid user supervisor 154.91.81.224 port 60818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.80.18.158
country_id: 3686110
description:
Dec 17 02:27:39 host2 sshd[1481998]: Disconnected from invalid user admin 186.80.18.158 port 53642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.235.139
country_id: 6252001
description:
Dec 17 02:29:41 host2 sshd[1483135]: Disconnected from invalid user neeraj 165.154.235.139 port 59212 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.81.224
country_id: 1880251
description:
Dec 17 02:29:17 host2 sshd[1482931]: Disconnected from invalid user koha 154.91.81.224 port 42544 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.79.123
country_id: 1643084
description:
Dec 17 02:31:52 host2 sshd[1484482]: Disconnected from invalid user supervisor 27.112.79.123 port 55352 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 17 02:31:27 host2 sshd[1484259]: Disconnected from invalid user hadoop 27.111.32.174 port 34290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 02:32:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<RRycDBhGhso+PIM0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.79.123
country_id: 1643084
description:
Dec 17 02:32:28 host2 sshd[1484834]: Disconnected from invalid user user 27.112.79.123 port 57950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 17 02:33:16 host2 sshd[1485613]: Disconnected from invalid user admin 27.111.32.174 port 37636 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.111.32.174
country_id: 1643084
description:
Dec 17 02:33:50 host2 sshd[1485901]: Disconnected from invalid user user 27.111.32.174 port 58992 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 165.154.235.139
country_id: 6252001
description:
Dec 17 02:34:18 host2 sshd[1486197]: Received disconnect from 165.154.235.139 port 51870:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.142.79.90
country_id: 2658434
description:
2025-12-17 02:36:15 dovecot_login authenticator failed for (ADMIN) [79.142.79.90]:60258: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-17 02:38:18 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:37299: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.170.105
country_id: 3144096
description:
2025-12-17 02:39:02 dovecot_login authenticator failed for (105-170-97-62.cust.smartcall.no) [62.97.170.105]:44050: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.112
country_id: 1880251
description:
Dec 17 02:41:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=15.235.175.112, lip=66.85.158.92, session=<dLaNKhhGLc4P669w>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.119
country_id: 1880251
description:
Dec 17 02:41:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 13 secs): user=<>, rip=15.235.175.119, lip=66.85.158.92, session=<0/JWKxhGxdsP6693>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.126
country_id: 1880251
description:
Dec 17 02:41:31 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=15.235.175.126, lip=66.85.158.92, session=<KBX5KxhGYckP669+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.127
country_id: 1880251
description:
Dec 17 02:41:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=15.235.175.127, lip=66.85.158.92, session=<sMssLBhGJ98P669/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.57
country_id: 6252001
description:
Dec 17 02:43:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.57, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mZdbNBhGqMvN0h85>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.107
country_id: 1814991
description:
Dec 17 02:44:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.107, lip=66.85.158.92, session=<4Vw7NxhGQ7he585r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.37
country_id: 1814991
description:
Dec 17 02:44:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.37, lip=66.85.158.92, session=<JY7ZNxhGp4Ve584l>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 02:44:57 host2 sshd[1494405]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.111
country_id: 1814991
description:
Dec 17 02:45:00 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.111, lip=66.85.158.92, session=<DD1uOBhG8+de585v>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.33
country_id: 1814991
description:
Dec 17 02:45:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.33, lip=66.85.158.92, session=<4c+hOBhG4eFe584h>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.203.225.221
country_id: 6252001
description:
Dec 17 02:45:13 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.203.225.221, lip=66.85.158.91, session=<fkQ9ORhGQsOsy+Hd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.128.110.15
country_id: 1880251
description:
Dec 17 02:45:58 host2 sshd[1495884]: Disconnected from invalid user dev 43.128.110.15 port 46334 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.133
country_id: 2328926
description:
2025-12-17 02:46:42 dovecot_login authenticator failed for (ADMIN) [146.70.65.133]:1029: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 02:46:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<Z7HnPhhG/qQ+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.214.132.202
country_id: 6252001
description:
2025-12-17 02:48:54 dovecot_login authenticator failed for ([72.214.132.202]) [72.214.132.202]:43982: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.128.110.15
country_id: 1880251
description:
Dec 17 02:49:03 host2 sshd[1498129]: Disconnected from invalid user ftpuser 43.128.110.15 port 33110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-17 02:54:15 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.181]:38018: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:54:45 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<8TpSWxhG3LQDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-12-17 02:54:47 dovecot_login authenticator failed for ([125.17.236.223]) [125.17.233.246]:56894: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.193.6.183
country_id: 6251999
description:
2025-12-17 02:55:31 dovecot_login authenticator failed for (ADMIN) [91.193.6.183]:53688: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:55:35 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<pI9PXhhGxJsDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 02:56:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<cHgFYhhGDsA+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:57:10 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<gw/3YxhGNOADhpQ7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 02:57:58 host2 pure-ftpd[1504501]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:58:00 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<ICLwZhhGnL0DhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:58:43 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<MHWFaRhGBIEDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:59:13 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<0dVIaxhG6MIDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 02:59:34 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<ARKRbBhGBOcDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 03:00:03 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<PR9MbhhGOuEDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 03:01:22 host2 sshd[1507122]: Disconnected from invalid user reese 62.60.131.157 port 49336 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.201
country_id: 6252001
description:
Dec 17 03:03:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=147.185.132.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<rQR5exhGhN6TuYTJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 17 03:04:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<SKRbfRhGqrk+PIds>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.87
country_id: 6252001
description:
Dec 17 03:04:25 host2 pure-ftpd[1509947]: (?@147.185.132.87) [INFO] New connection from 147.185.132.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-17 03:05:14 dovecot_login authenticator failed for ([84.211.12.107]) [84.211.12.107]:58816: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-17 03:05:15 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:51210: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-17 03:05:34 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:40856: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 03:06:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<tXo3hBhGBuo+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-12-17 03:05:57 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:47300: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-17 03:07:05 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (balbatte) [87.103.126.54]:46741: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.69
country_id: 2802361
description:
2025-12-17 03:07:11 dovecot_login authenticator failed for (ADMIN) [181.214.218.69]:46289: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 03:09:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<2c5SjhhGNN0+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 17 03:15:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<u4SXphhGvpo+PIdq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.117
country_id: 1819730
description:
Dec 17 03:16:48 host2 sshd[1518005]: Disconnected from invalid user storage 152.32.172.117 port 57606 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 03:17:48 host2 sshd[1518550]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 03:17:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<2dVNrhhGxJ8+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec 17 03:18:52 host2 sshd[1519030]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 63693


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec 17 03:19:09 host2 sshd[1519189]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 64439


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 17 03:19:38 host2 sshd[1519411]: Disconnected from invalid user runner 198.98.56.227 port 50390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.227
country_id: 6252001
description:
Dec 17 03:20:16 host2 sshd[1519933]: Disconnected from invalid user mrodelo 198.98.56.227 port 36400 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 03:21:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<FAK3uxhG2Os+PIMh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.117
country_id: 1819730
description:
Dec 17 03:21:53 host2 sshd[1520948]: Disconnected from invalid user me 152.32.172.117 port 40364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Dec 17 03:22:15 host2 sshd[1521156]: Disconnected from invalid user ociispth 9.223.176.221 port 42370 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Dec 17 03:22:54 host2 sshd[1521390]: Disconnected from invalid user admin1 9.223.176.221 port 44880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 03:23:24 host2 sshd[1521626]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 51830


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.172.117
country_id: 1819730
description:
Dec 17 03:23:39 host2 sshd[1521736]: Disconnected from invalid user www-data 152.32.172.117 port 36028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.117
country_id: 1819730
description:
Dec 17 03:24:48 host2 sshd[1522293]: Disconnected from invalid user ociispth 152.32.172.117 port 41236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-17 03:27:17 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:38064: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.178.103.158
country_id: 6252001
description:
Dec 17 03:27:19 host2 sshd[1524187]: Invalid user cloudtourssrilan_travel from 107.178.103.158 port 19507


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-17 03:27:26 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:47483: 535 Incorrect authentication data (set_id=env_eng)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 03:28:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<KsYV0xhGXtg+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.87
country_id: 597427
description:
2025-12-17 03:28:20 dovecot_login authenticator failed for (ADMIN) [194.32.122.87]:56372: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Dec 17 03:27:56 host2 sshd[1524525]: Disconnected from invalid user www-data 9.223.176.221 port 56898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 9.223.176.221
country_id: 2661886
description:
Dec 17 03:29:29 host2 sshd[1525375]: Disconnected from invalid user mrodelo 9.223.176.221 port 33494 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.125.25
country_id: 6252001
description:
Dec 17 03:35:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.125.25, lip=66.85.158.91, TLS, session=<C73l7RhGmpcNWX0Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.36
country_id: 1861060
description:
2025-12-17 03:37:17 dovecot_login authenticator failed for (ADMIN) [149.22.87.36]:5396: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.188.251
country_id: 290557
description:
2025-12-17 03:40:44 dovecot_plain authenticator failed for (unding) [91.73.188.251]:50414: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 03:40:45 host2 sshd[1533264]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 57416


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 17 03:40:55 host2 sshd[1533326]: Disconnected from invalid user sandbox 103.187.165.26 port 41918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-17 03:42:01 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (agerom) [174.169.224.27]:56238: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.99.31
country_id: 1861060
description:
Dec 17 03:43:18 host2 sshd[1534555]: Disconnected from invalid user gaurav 163.44.99.31 port 51634 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 17 03:44:50 host2 sshd[1535417]: Disconnected from invalid user xiaolin 162.240.212.247 port 38172 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 03:43:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<8dMfCxlGwO0+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.44.99.31
country_id: 1861060
description:
Dec 17 03:44:34 host2 sshd[1535296]: Disconnected from invalid user ubuntu 163.44.99.31 port 34818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 17 03:45:07 host2 sshd[1535908]: Disconnected from invalid user waleed 103.187.165.26 port 36966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 17 03:45:21 host2 sshd[1536529]: Disconnected from invalid user lighthouse 162.240.212.247 port 51996 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 163.44.99.31
country_id: 1861060
description:
Dec 17 03:46:20 host2 sshd[1537526]: Disconnected from invalid user alex 163.44.99.31 port 42964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Dec 17 03:47:31 host2 sshd[1538754]: Disconnected from invalid user lighthouse 103.187.165.26 port 44030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 03:48:10 host2 sshd[1539376]: Disconnected from invalid user stefanie 62.60.131.157 port 32373 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-17 03:48:16 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (tionia) [71.62.34.216]:36856: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec 17 03:48:47 host2 sshd[1539793]: Disconnected from invalid user admin 162.240.212.247 port 50302 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-17 03:49:43 dovecot_plain authenticator failed for (exturacost) [65.20.129.28]:56123: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.20.206
country_id: 6252001
description:
Dec 17 03:52:45 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.20.206, lip=66.85.158.92, TLS, session=<trW/KhlGwJkUoxTO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.4
country_id: 3175395
description:
2025-12-17 03:54:13 dovecot_login authenticator failed for (ADMIN) [156.146.41.4]:44334: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-17 03:54:18 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (trosining) [67.173.58.47]:46080: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-17 03:55:15 dovecot_login authenticator failed for (GH3UWJzBWE) [69.5.189.21]:50825: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-17 03:56:03 dovecot_login authenticator failed for (yKmMSWx) [69.5.189.21]:63527: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 03:57:10 host2 sshd[1547328]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.5.189.21
country_id: 241170
description:
2025-12-17 03:57:09 dovecot_login authenticator failed for (XX6yKQxVbM) [69.5.189.21]:54911: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 03:57:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<YCnPPBlG0sgDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 03:59:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hBUrQhlG2N4DjyE/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 03:59:24 host2 pure-ftpd[1549298]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:00:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<dMYeRhlGlooDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 17 04:01:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.162, lip=66.85.158.91, session=<loiaSRlGsv/CpRCi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-17 04:01:28 dovecot_plain authenticator failed for (veril) [64.72.74.162]:40534: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:02:02 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<1874SxlGRt4DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-17 04:03:07 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (plizzlik) [73.197.236.163]:50480: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-12-17 04:03:02 dovecot_plain authenticator failed for (unfelly) [5.32.99.14]:60140: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:04:05 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<4qBAUxlG/IADjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.130
country_id: 6252001
description:
2025-12-17 04:05:59 dovecot_login authenticator failed for (ADMIN) [191.96.37.130]:20693: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:06:15 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lTYNWxlGRrEDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:06:56 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<kwN5XRlGPMIDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 04:07:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<Q84lYRlGuqkDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 04:15:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<0AcSfBlGxsI+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.1
country_id: 798549
description:
Dec 17 04:15:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.1, lip=66.85.158.91, session=<r+LifBlGjIVV2ZUB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 04:18:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=</R8DhRlGiKI+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.66
country_id: 1149361
description:
2025-12-17 04:18:05 dovecot_login authenticator failed for ([149.54.62.66]) [149.54.62.66]:39660: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-17 04:18:39 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:48844: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-17 04:18:52 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:59846: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-17 04:19:05 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:58929: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 04:20:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<dyiHjRlG+MM+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.199.81.100
country_id: 6252001
description:
Dec 17 04:20:33 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.199.81.100, lip=66.85.158.91, session=<b5UwjhlGqJPGx1Fk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.160
country_id: 2658434
description:
2025-12-17 04:21:01 dovecot_login authenticator failed for (ADMIN) [158.173.152.160]:34698: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 04:23:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<lxRymRlGbMU+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 04:23:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<iSIJmhlGKMM+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 04:24:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<119bnRlG5r0+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-12-17 04:25:40 dovecot_plain authenticator failed for (umman) [65.20.149.93]:46191: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.24.98
country_id: 2635167
description:
2025-12-17 04:27:26 dovecot_login authenticator failed for (ADMIN) [158.173.24.98]:63643: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-17 04:28:33 dovecot_plain authenticator failed for (jaybly) [96.85.104.2]:49394: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Dec 17 04:27:57 host2 sshd[1578646]: Disconnected from invalid user bot 103.49.238.104 port 55760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec 17 04:29:40 host2 sshd[1579716]: Disconnected from invalid user user 45.78.230.104 port 38232 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.78.30
country_id: 2921044
description:
Dec 17 04:31:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.232.78.30, lip=66.85.158.92, TLS handshaking: Connection closed, session=<mEEXtBlGJP+l6E4e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-17 04:33:01 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (coetion) [68.40.189.43]:45372: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.54.213
country_id: 6252001
description:
Dec 17 04:33:04 host2 pure-ftpd[1581584]: (?@161.35.54.213) [INFO] New connection from 161.35.54.213


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.74.239.125
country_id: 1643084
description:
Dec 17 04:33:55 host2 sshd[1582093]: Disconnected from invalid user hasan 202.74.239.125 port 40450 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.238.104
country_id: 1643084
description:
Dec 17 04:35:14 host2 sshd[1583055]: Disconnected from invalid user ftptest 103.49.238.104 port 58738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 17 04:34:59 host2 sshd[1582708]: Disconnected from invalid user admin 45.40.57.41 port 39504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Dec 17 04:36:25 host2 sshd[1583899]: Disconnected from invalid user myftp 103.49.238.104 port 54248 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 17 04:36:39 host2 sshd[1584023]: Disconnected from invalid user drcom 103.144.28.85 port 47648 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-17 04:36:51 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (brost) [174.166.153.20]:34588: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 17 04:36:08 host2 sshd[1583774]: Disconnected from invalid user nominatim 103.144.28.85 port 35320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 17 04:37:24 host2 sshd[1584375]: Disconnected from invalid user ubuntu 45.40.57.41 port 45854 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.64.106.222
country_id: 6252001
description:
Dec 17 04:37:33 host2 pure-ftpd[1584437]: (?@20.64.106.222) [INFO] New connection from 20.64.106.222


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.28.85
country_id: 1819730
description:
Dec 17 04:37:41 host2 sshd[1584497]: Disconnected from invalid user ubuntu 103.144.28.85 port 44072 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.162
country_id: 2993457
description:
Dec 17 04:38:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.162, lip=66.85.158.92, session=<b66LzBlGtP/CpRCi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.74.239.125
country_id: 1643084
description:
Dec 17 04:38:19 host2 sshd[1584806]: Disconnected from invalid user user1 202.74.239.125 port 52074 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.40.57.41
country_id: 1269750
description:
Dec 17 04:39:53 host2 sshd[1585537]: Disconnected from invalid user bot 45.40.57.41 port 37766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.187.240
country_id: 3144096
description:
2025-12-17 04:40:05 dovecot_login authenticator failed for (cm-84.213.187.240.get.no) [84.213.187.240]:59081: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-12-17 04:40:27 dovecot_login authenticator failed for (host253.181-93-60.telecom.net.ar) [181.93.60.253]:57171: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 17 04:40:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<tMt41hlGkJk+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.140
country_id: 3077311
description:
2025-12-17 04:41:57 dovecot_login authenticator failed for (ADMIN) [212.102.39.140]:45429: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.249.61.124
country_id: 298795
description:
Dec 17 04:43:15 host2 sshd[1587536]: Disconnected from invalid user admin 92.249.61.124 port 42208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.251.80
country_id: 2921044
description:
Dec 17 04:45:14 host2 sshd[1589019]: Disconnected from invalid user profe 164.92.251.80 port 40422 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.31
country_id: 3042058
description:
2025-12-17 04:47:50 dovecot_login authenticator failed for (ADMIN) [91.90.122.31]:16360: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 04:48:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<6x6X8BlGKs4+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2025-12-17 04:48:22 dovecot_plain authenticator failed for cm-72-241-202-104.buckeyecom.net (tatules) [72.241.202.104]:55637: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-12-17 04:51:20 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (jacent) [73.144.27.228]:58142: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 04:52:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<qlSrABpGHr4+PIdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.10.47.6
country_id: 1643084
description:
Dec 17 04:53:33 host2 sshd[1594209]: Disconnected from invalid user redmine 114.10.47.6 port 19446 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.251.80
country_id: 2921044
description:
Dec 17 04:53:18 host2 sshd[1594115]: Disconnected from invalid user acct 164.92.251.80 port 45978 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 114.10.47.6
country_id: 1643084
description:
Dec 17 04:54:51 host2 sshd[1595426]: Disconnected from invalid user hadoop 114.10.47.6 port 19448 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Dec 17 04:55:34 host2 sshd[1596289]: Disconnected from invalid user group1 103.143.238.173 port 54940 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.104
country_id: 1880251
description:
Dec 17 04:55:43 host2 sshd[1596317]: Disconnected from invalid user admin 45.78.230.104 port 53436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.33.161
country_id: 3686110
description:
Dec 17 04:56:11 host2 sshd[1596951]: Disconnected from invalid user www 179.32.33.161 port 54580 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.33.161
country_id: 3686110
description:
Dec 17 04:56:49 host2 sshd[1597269]: Disconnected from invalid user flip 179.32.33.161 port 40514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Dec 17 04:57:15 host2 sshd[1597531]: Disconnected from invalid user ivan 103.143.238.173 port 36462 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 04:57:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<o12PERpGxq8+PIce>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.25.47.94
country_id: 1269750
description:
Dec 17 04:57:49 host2 sshd[1597804]: Disconnected from invalid user sandra 103.25.47.94 port 40440 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.147.238.48
country_id: 3996063
description:
Dec 17 04:59:04 host2 sshd[1598692]: Disconnected from invalid user cloud 189.147.238.48 port 59004 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 05:01:09 host2 pure-ftpd[1600293]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.186.155
country_id: 6252001
description:
Dec 17 05:03:40 host2 pure-ftpd[1601801]: (?@40.124.186.155) [INFO] New connection from 40.124.186.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.171
country_id: 2921044
description:
2025-12-17 05:04:33 dovecot_login authenticator failed for (ADMIN) [191.101.157.171]:48406: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 05:05:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=</nOvLxpGTrc+PIcf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 05:05:59 host2 sshd[1603285]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 05:06:48 host2 sshd[1603887]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 56023


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 05:05:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<Y76JMBpG0tk+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.19
country_id: 289688
description:
2025-12-17 05:07:14 dovecot_login authenticator failed for (ADMIN) [95.181.234.19]:56454: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 05:07:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<yXrQNhpGLL0+PIce>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.204.25
country_id: 6251999
description:
Dec 17 05:12:24 host2 pure-ftpd[1607654]: (?@128.203.204.25) [INFO] New connection from 128.203.204.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 05:19:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<R5y1YRpGXqg+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 05:22:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<p0/IahpG/Ok+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 05:23:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<AK9abRpGeos+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 05:24:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<eNSxchpGMM8+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 05:24:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<UhsxcxpGeMY+PIcs>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 05:25:09 host2 sshd[1616569]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.76
country_id: 1668284
description:
2025-12-17 05:24:56 dovecot_login authenticator failed for (ADMIN) [173.244.49.76]:33390: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 05:25:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<xp+BdhpGirI+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 05:25:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Zd6qdhpG3MY+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-12-17 05:25:35 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (aptaint) [68.52.119.193]:41410: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.20
country_id: 6252001
description:
2025-12-17 05:27:46 dovecot_login authenticator failed for (ADMIN) [191.96.67.20]:46824: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-17 05:27:57 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (tuley) [68.60.77.128]:38020: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 82.152.110.30
country_id: 2635167
description:
Dec 17 05:29:02 host2 sshd[1619332]: Invalid user cloudtourssrilan_travel from 82.152.110.30 port 53723


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.152.110.30
country_id: 2635167
description:
[2025-12-17 05:29:02 +0530] info [cpaneld] 82.152.110.30 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.171.79.194
country_id: 3686110
description:
Dec 17 05:33:41 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 11 secs): user=<httpssmtp.zoho.com587hr>, method=PLAIN, rip=190.171.79.194, lip=66.85.158.91, TLS, session=<wBILkxpG35G+q0/C>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.70
country_id: 690791
description:
Dec 17 05:33:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<httpssmtp.zoho.com587hr@lezzarotech.com>, method=PLAIN, rip=194.44.140.70, lip=66.85.158.91, TLS, session=<H8yjkBpG6oTCLIxG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.33.72
country_id: 798544
description:
Dec 17 05:33:28 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 2 attempts in 19 secs): user=<httpssmtp.zoho.com587hr>, method=LOGIN, rip=91.228.33.72, lip=66.85.158.91, session=<Ob3TkRpGKg5b5CFI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-17 05:33:35 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (catity) [87.103.126.54]:41584: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 05:39:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 7 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<jzBEqRpGJKc+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-12-17 05:40:53 dovecot_plain authenticator failed for (fismilly) [173.25.186.130]:63709: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-12-17 05:41:08 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:52362: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.211.86.46
country_id: 6252001
description:
2025-12-17 05:41:28 dovecot_login authenticator failed for (syn-024-211-086-046.res.spectrum.com) [24.211.86.46]:44014: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.28
country_id: 3017382
description:
2025-12-17 05:41:31 dovecot_login authenticator failed for (ADMIN) [191.101.31.28]:31836: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-12-17 05:41:56 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:44334: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 17 05:43:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<dTjotRpGQMXBHmEh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 05:44:08 host2 sshd[1630782]: Disconnected from invalid user user 2.57.121.25 port 17268 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 05:46:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<9NbHwBpGRKk+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-17 05:50:06 dovecot_plain authenticator failed for (asitivelly) [92.62.243.174]:35123: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.144
country_id: 2635167
description:
Dec 17 05:52:31 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.144, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<sW8Q1xpGbbpX7LCQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.18
country_id: 2635167
description:
Dec 17 05:52:30 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.18, lip=66.85.158.91, TLS, session=<iSL51hpGzZm594kS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.110
country_id: 2635167
description:
Dec 17 05:53:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.110, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<lhcH2xpG66a594lu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.128
country_id: 2635167
description:
Dec 17 05:53:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.128, lip=66.85.158.91, TLS handshaking: Connection closed, session=<4NYL2RpGxaBX7LCA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.52
country_id: 6251999
description:
2025-12-17 05:54:11 dovecot_login authenticator failed for (ADMIN) [212.56.49.52]:6683: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.130
country_id: 2635167
description:
Dec 17 05:54:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.130, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<Gcb93hpGk7JX7LCC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.119
country_id: 2635167
description:
Dec 17 05:54:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.119, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<MWYC3RpGIc2594l3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.127
country_id: 2635167
description:
Dec 17 05:55:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.127, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yC734BpGrYG594l/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.138
country_id: 2635167
description:
Dec 17 05:55:51 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.138, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Bm/04hpGLci594mK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 05:56:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<jjFD5BpGFLI+PIMh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.129
country_id: 2635167
description:
Dec 17 05:56:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.129, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<INTv5BpGdZ6594mB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 05:56:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<PWUP5hpGdrA+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.116
country_id: 2635167
description:
Dec 17 05:56:57 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.116, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<00bp5hpGC9VX7LB0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.114
country_id: 2635167
description:
Dec 17 05:57:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.114, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<wqPk6BpGt6BX7LBy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.193.6.184
country_id: 6251999
description:
2025-12-17 05:58:21 dovecot_login authenticator failed for (ADMIN) [91.193.6.184]:55810: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 17 05:58:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<mxYz7RpGcs4+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 05:59:00 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64706: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 05:59:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<5r8h8RpG3IM+PIdj>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 06:02:50 host2 pure-ftpd[1643678]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 06:03:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<UbCh/BpGatk+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 06:04:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<U3B7ABtGTKI+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 06:04:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<TcjwABtGyKE+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.243.106.218
country_id: 2802361
description:
2025-12-17 06:07:27 dovecot_plain authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be (exorseyl) [81.243.106.218]:50514: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 17 06:10:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<QPinGBtGpII+PIdn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-17 06:11:29 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (exprep) [71.224.169.28]:47508: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.81.170.119
country_id: 4566966
description:
2025-12-17 06:12:10 dovecot_login authenticator failed for ([208.81.170.119]) [208.81.170.119]:23973: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-12-17 06:12:45 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:33366: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.21.29
country_id: 2750405
description:
2025-12-17 06:12:52 dovecot_login authenticator failed for (ADMIN) [158.173.21.29]:31930: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.12
country_id: 2264397
description:
2025-12-17 06:13:53 dovecot_login authenticator failed for (ADMIN) [146.70.59.12]:8291: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.136.207.202
country_id: 1605651
description:
2025-12-17 06:15:42 dovecot_login authenticator failed for ([58.136.207.202]) [58.136.207.202]:45539: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-17 06:15:09 dovecot_login authenticator failed for ([84.211.12.159]) [84.211.12.159]:43107: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2025-12-17 06:15:26 dovecot_login authenticator failed for pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:58324: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2025-12-17 06:15:31 dovecot_login authenticator failed for ([27.123.114.190]) [27.123.114.190]:60124: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-17 06:16:02 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (bilia) [66.177.30.53]:35210: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 06:16:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Ny5+KxtGftE+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.151.46.98
country_id: 1861060
description:
2025-12-17 06:18:36 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [45.151.46.98]:7983: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 06:19:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<p5JCNhtGrtI+PIdf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.17
country_id: 798549
description:
Dec 17 06:19:44 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=85.217.149.17, lip=66.85.158.92, session=<mMtrOBtGnJ9V2ZUR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-12-17 06:18:58 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:35978: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.4
country_id: 2750405
description:
Dec 17 06:20:43 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=31.14.32.4, lip=66.85.158.92, session=<RAboOxtGLp4fDiAE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-12-17 06:22:03 dovecot_login authenticator failed for (syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:39262: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2025-12-17 06:22:27 dovecot_login authenticator failed for ([125.16.246.121]) [182.95.63.50]:41622: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.63.99
country_id: 6252001
description:
Dec 17 06:24:46 host2 sshd[1661381]: Disconnected from invalid user share 35.237.63.99 port 55230 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-17 06:26:13 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (natifers) [98.222.93.199]:48510: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-17 06:26:49 dovecot_plain authenticator failed for (finalty) [65.20.133.4]:35257: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.110.13.58
country_id: 2635167
description:
2025-12-17 06:27:26 dovecot_login authenticator failed for (ADMIN) [194.110.13.58]:1634: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.237.63.99
country_id: 6252001
description:
Dec 17 06:29:16 host2 sshd[1665557]: Disconnected from invalid user dev 35.237.63.99 port 37040 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Dec 17 06:29:04 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.118, lip=66.85.158.91, TLS: Connection closed, session=<bI7CWRtGOIZChJl2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.63.99
country_id: 6252001
description:
Dec 17 06:32:36 host2 sshd[1668888]: Disconnected from invalid user rootuser 35.237.63.99 port 36680 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.166
country_id: 3017382
description:
Dec 17 06:33:31 host2 pure-ftpd[1669644]: (?@91.196.152.166) [INFO] New connection from 91.196.152.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-12-17 06:35:49 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (bactic) [73.230.86.50]:44754: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 06:36:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<onDAdRtGitU+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.29
country_id: 2264397
description:
2025-12-17 06:39:50 dovecot_login authenticator failed for (ADMIN) [146.70.59.29]:13536: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 06:42:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<lEeOiRtGoJQ+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.237
country_id: 718075
description:
2025-12-17 06:45:29 dovecot_login authenticator failed for (ADMIN) [185.225.28.237]:22080: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.121
country_id: 6252001
description:
2025-12-17 06:46:35 dovecot_login authenticator failed for ([209.23.72.121]) [209.23.72.121]:57168: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 06:47:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<mEPFmxtGbsI+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.119.125
country_id: 3144096
description:
2025-12-17 06:46:56 dovecot_login authenticator failed for ([46.212.119.125]) [46.212.119.125]:45406: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-12-17 06:49:15 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:39351: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.160
country_id: 6252001
description:
2025-12-17 06:49:50 dovecot_login authenticator failed for wsip-184-191-250-160.fv.ks.cox.net [184.191.250.160]:59799: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 06:54:29 host2 sshd[1686173]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec 17 06:54:31 host2 sshd[1686199]: Disconnected from invalid user wms 179.51.153.37 port 51288 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-17 06:55:47 dovecot_plain authenticator failed for (inflobus) [65.20.153.146]:46630: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 17 06:56:53 host2 sshd[1688155]: Disconnected from invalid user test 103.172.204.220 port 40886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.27
country_id: 6252001
description:
2025-12-17 06:57:39 dovecot_login authenticator failed for (ADMIN) [181.214.165.27]:12205: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.30.100
country_id: 1269750
description:
Dec 17 06:58:39 host2 sshd[1689175]: Disconnected from invalid user mosquitto 122.160.30.100 port 11314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec 17 06:59:38 host2 sshd[1689735]: Disconnected from invalid user user 179.51.153.37 port 36326 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.160.30.100
country_id: 1269750
description:
Dec 17 06:59:55 host2 sshd[1689880]: Disconnected from invalid user robot 122.160.30.100 port 24621 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 07:01:48 host2 sshd[1691236]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.68.220.15
country_id: 6252001
description:
2025-12-17 07:01:09 dovecot_plain authenticator failed for c-73-68-220-15.hsd1.ma.comcast.net (sking) [73.68.220.15]:34858: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec 17 07:02:31 host2 sshd[1691739]: Disconnected from invalid user php 179.51.153.37 port 41918 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 07:04:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<GGHx1htGXt8+PIdf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.30.100
country_id: 1269750
description:
Dec 17 07:04:21 host2 sshd[1693854]: Disconnected from invalid user minecraft 122.160.30.100 port 60364 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 17 07:04:41 host2 sshd[1694060]: Disconnected from invalid user php 103.172.204.220 port 60828 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 07:04:42 host2 pure-ftpd[1694080]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.220
country_id: 1643084
description:
Dec 17 07:05:31 host2 sshd[1694746]: Disconnected from invalid user ubuntu 103.172.204.220 port 39168 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 07:04:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<efLj2RtGjKg+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-17 07:04:56 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (pufted) [73.176.157.57]:42020: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-17 07:10:37 dovecot_plain authenticator failed for (wrogibrics) [65.20.250.163]:53621: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-17 07:10:47 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (surlic) [76.145.10.140]:45982: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.144.20
country_id: 3996063
description:
2025-12-17 07:11:11 dovecot_login authenticator failed for ([177.236.144.20]) [177.236.144.20]:58306: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-17 07:11:13 dovecot_login authenticator failed for (45.168.140-35.smartlinkfibra.com.br) [45.168.140.35]:38827: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 07:11:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<9CS38BtGorI+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.217.74
country_id: 3996063
description:
2025-12-17 07:11:33 dovecot_login authenticator failed for (201.173.217.74-clientes-izzi.mx) [201.173.217.74]:51706: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-12-17 07:11:34 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:60724: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-17 07:12:01 dovecot_plain authenticator failed for (upfulate) [38.248.111.238]:52363: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 17 07:13:23 host2 sshd[1700144]: Disconnected from invalid user nikolay 182.253.79.194 port 5241 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Dec 17 07:13:34 host2 sshd[1700371]: Disconnected from invalid user test 45.78.200.2 port 52838 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 07:15:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<dsUQ/htG1Kg+PIdp>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 17 07:14:43 host2 sshd[1701215]: Disconnected from invalid user test 182.253.79.194 port 48531 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 17 07:15:54 host2 sshd[1702159]: Disconnected from invalid user debian 182.253.79.194 port 4200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.79.194
country_id: 1643084
description:
Dec 17 07:16:29 host2 sshd[1702563]: Disconnected from invalid user ftp_user 182.253.79.194 port 1204 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.233
country_id: 6252001
description:
Dec 17 07:17:12 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.233, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<pRflBRxG7cbN0h/p>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 07:19:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ezyADBxG2rc+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 07:20:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<1u/YEBxGsKE+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 07:21:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<kbb7ExxGhKA+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 07:22:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<Kqz4GRxGjus+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.76
country_id: 6252001
description:
2025-12-17 07:23:11 dovecot_login authenticator failed for (ADMIN) [181.41.206.76]:27976: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.200.2
country_id: 1880251
description:
Dec 17 07:24:01 host2 sshd[1707312]: Disconnected from invalid user botuser 45.78.200.2 port 48672 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 07:28:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<agW8LxxG7sI+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 07:30:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<NoOPNBxGso4+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 07:37:15 host2 sshd[1717223]: Disconnected from invalid user brooks 62.60.131.157 port 36469 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.24.12
country_id: 1880251
description:
2025-12-17 07:42:05 dovecot_login authenticator failed for (ADMIN) [138.199.24.12]:47922: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-12-17 07:43:08 dovecot_login authenticator failed for ([182.95.115.194]) [182.95.115.194]:43208: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-17 07:43:20 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:52384: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.74.211.27
country_id: 6252001
description:
2025-12-17 07:44:07 dovecot_plain authenticator failed for c-75-74-211-27.hsd1.fl.comcast.net (sostally) [75.74.211.27]:53585: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-12-17 07:49:00 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (cosite) [71.235.225.181]:34328: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 07:49:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<ne/iehxGYqI+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.10
country_id: 1227603
description:
2025-12-17 07:50:22 dovecot_login authenticator failed for (ADMIN) [95.181.239.10]:44500: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 17 07:53:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<PtO8hxxGzJ4+PIdn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 07:54:15 host2 sshd[1728923]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 07:54:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<FKkYixxGsro+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 17 07:59:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<At80nhxGwqc+PIdg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-17 07:59:44 dovecot_plain authenticator failed for (thich) [187.161.198.68]:54797: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 08:03:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0TWjqxxGiMI+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.77
country_id: 6252001
description:
Dec 17 08:04:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=162.216.149.77, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<0guMsBxGb8ei2JVN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.225.95.233
country_id: 6252001
description:
Dec 17 08:05:30 host2 sshd[1736242]: Disconnected from invalid user sammy 35.225.95.233 port 53932 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 08:05:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<7d4wsxxGvNs+PIde>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.77
country_id: 6252001
description:
Dec 17 08:05:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=162.216.149.77, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<s6gItBxGpPui2JVN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-17 08:05:57 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:52494: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Dec 17 08:06:00 host2 sshd[1736584]: Disconnected from invalid user system 175.100.24.139 port 34124 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.77
country_id: 6252001
description:
Dec 17 08:06:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.149.77, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<qOpatRxGdu2i2JVN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-17 08:06:15 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:57684: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 08:06:40 host2 pure-ftpd[1736916]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.100.24.139
country_id: 1831722
description:
Dec 17 08:07:20 host2 sshd[1737221]: Disconnected from invalid user afa 175.100.24.139 port 58414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 17 08:08:22 host2 sshd[1737719]: Disconnected from invalid user sammy 187.210.77.100 port 37528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 17 08:10:43 host2 sshd[1739187]: Disconnected from invalid user wj 68.218.72.173 port 59014 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.75.216.74
country_id: 1269750
description:
Dec 17 08:11:42 host2 sshd[1739672]: Disconnected from invalid user kafka 182.75.216.74 port 33403 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.77
country_id: 6252001
description:
Dec 17 08:11:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.77, lip=66.85.158.91, TLS, session=<YsUKyRxGDOui2JVN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 17 08:12:49 host2 sshd[1740259]: Disconnected from invalid user afa 68.218.72.173 port 37424 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.77
country_id: 6252001
description:
Dec 17 08:12:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.149.77, lip=66.85.158.91, TLS, session=<FDdEzRxGgvei2JVN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 08:14:30 host2 sshd[1741180]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.225.95.233
country_id: 6252001
description:
Dec 17 08:14:54 host2 sshd[1741481]: Disconnected from invalid user teamspeak 35.225.95.233 port 38284 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.75.216.74
country_id: 1269750
description:
Dec 17 08:14:16 host2 sshd[1741060]: Disconnected from invalid user consultor 182.75.216.74 port 31797 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.247.248.154
country_id: 3469034
description:
2025-12-17 08:16:15 dovecot_login authenticator failed for ([170.247.248.154]) [170.247.248.154]:43631: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.178
country_id: 3144096
description:
2025-12-17 08:16:35 dovecot_login authenticator failed for (cm-84.213.189.178.get.no) [84.213.189.178]:34594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.114.35
country_id: 1269750
description:
2025-12-17 08:16:37 dovecot_plain authenticator failed for (jocium) [103.69.114.35]:46725: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 08:16:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<zQES2xxGbtQ+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.178.70
country_id: 1269750
description:
2025-12-17 08:16:59 dovecot_login authenticator failed for ([182.79.95.167]) [122.185.178.70]:46792: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 08:18:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<V99p3xxGuJo+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2025-12-17 08:17:17 dovecot_login authenticator failed for 199-246-29-85.dyn.estpak.ee [85.29.246.199]:59958: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.234.124.206
country_id: 6252001
description:
Dec 17 08:18:58 host2 pure-ftpd[1744003]: (?@104.234.124.206) [INFO] New connection from 104.234.124.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.234.124.206
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.234.124.206 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 17 08:19:15 host2 sshd[1744157]: Disconnected from invalid user demo 187.210.77.100 port 60982 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-12-17 08:20:33 dovecot_plain authenticator failed for (eptioneste) [65.20.174.63]:44234: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.77.115
country_id: 1269750
description:
2025-12-17 08:21:34 dovecot_login authenticator failed for ([103.220.16.51]) [117.247.77.115]:54298: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-12-17 08:21:46 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (galanic) [71.62.34.216]:47780: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-17 08:21:52 dovecot_login authenticator failed for ([46.212.127.128]) [46.212.127.128]:46783: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 08:22:41 host2 sshd[1747047]: Disconnected from invalid user user 2.57.121.25 port 38235 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 08:23:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<HwCW8hxGcIg+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.175
country_id: 6252001
description:
Dec 17 08:24:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.175, lip=66.85.158.91, TLS, session=<nKtN9RxGGOvN0h+v>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.163
country_id: 1562822
description:
2025-12-17 08:24:42 dovecot_login authenticator failed for (ADMIN) [173.239.247.163]:5504: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 17 08:28:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<IFJgBB1GxJI+PIdr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.168
country_id: 6252001
description:
Dec 17 08:29:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.168, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<DuWuCR1GgcTN0h+o>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.216.180.11
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.216.180.11: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-17 08:31:47 dovecot_plain authenticator failed for (spiessicus) [102.53.15.180]:56488: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-17 08:31:51 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (gariummal) [81.225.30.107]:46145: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 08:39:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<jUQ2Kx1GBOo+PIcg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:40:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<+9h5Lx1GfLYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.123.230
country_id: 6252001
description:
2025-12-17 08:40:23 dovecot_login authenticator failed for (ADMIN) [151.241.123.230]:38334: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 08:43:02 host2 sshd[1759254]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:42:37 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<4t1gNx1GsqQDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.115.196
country_id: 1643084
description:
Dec 17 08:43:35 host2 sshd[1759600]: Disconnected from invalid user hw 103.174.115.196 port 37582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Dec 17 08:44:16 host2 sshd[1760153]: Disconnected from invalid user admin 103.174.115.196 port 43332 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:44:36 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<a1x/Ph1GTKEDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.241.122.109
country_id: 6252001
description:
2025-12-17 08:45:37 dovecot_login authenticator failed for (ADMIN) [151.241.122.109]:4163: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-17 08:46:21 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (pitaccing) [98.227.25.115]:34322: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:46:34 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<MuWERR1GMtwDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:46:51 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<xPuGRh1GzuoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:48:12 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<FapWSx1G5rcDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:49:06 host2 dovecot[1284858]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<9PWNTh1G0rEDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:48:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<Q9iMTR1GQJADhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 08:50:21 host2 sshd[1765827]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 17 08:50:25 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<j25EUx1GiosDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-17 08:51:24 dovecot_plain authenticator failed for (subdowist) [102.53.15.18]:51358: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-17 08:53:50 dovecot_plain authenticator failed for (naselabasm) [38.248.111.238]:50037: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 08:55:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<yVEBZR1G2ug+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 08:56:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<F7lUah1Gpsk+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 08:57:41 host2 sshd[1770577]: Disconnected from invalid user matt 37.32.10.237 port 54186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 09:01:03 host2 sshd[1772545]: Disconnected from invalid user ubuntu 37.32.10.237 port 37260 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.138
country_id: 6252001
description:
Dec 17 09:01:35 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.138, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mwoxex1GrtKTuYSK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 09:02:08 host2 sshd[1773213]: Disconnected from invalid user roman 37.32.10.237 port 38790 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 09:03:12 host2 sshd[1773949]: Received disconnect from 37.32.10.237 port 51984:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 09:03:12 host2 sshd[1773949]: Disconnected from invalid user support 37.32.10.237 port 51984 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec 17 09:03:16 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS, session=<2lI+gR1GgP1ChJmI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 17 09:03:44 host2 sshd[1774333]: Disconnected from invalid user debian 37.32.10.237 port 47570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 09:04:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<i7gMhB1G3Nc+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.39.151
country_id: 6252001
description:
2025-12-17 09:05:31 dovecot_login authenticator failed for (ADMIN) [156.146.39.151]:35025: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.111
country_id: 6251999
description:
2025-12-17 09:06:25 dovecot_login authenticator failed for (ADMIN) [212.56.52.111]:50890: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Dec 17 09:07:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.6, lip=66.85.158.91, TLS: Connection closed, session=<Qlyvjh1GPILCpGsG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-12-17 09:07:11 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (conic) [24.23.125.83]:47898: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-17 09:07:34 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (grayrated) [78.68.37.25]:49329: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 09:08:35 host2 pure-ftpd[1777545]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.221.8
country_id: 1880251
description:
Dec 17 09:12:12 host2 sshd[1779871]: Disconnected from invalid user roman 45.78.221.8 port 51668 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 09:20:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<ZEThvh1Gdsc+PIMp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 09:22:03 host2 sshd[1786071]: Disconnected from invalid user conrad 62.60.131.157 port 63007 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-17 09:22:31 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (kinonal) [196.47.172.253]:40716: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-17 09:23:15 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (distical) [85.225.19.144]:58343: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.190.55
country_id: 3144096
description:
2025-12-17 09:24:12 dovecot_login authenticator failed for (cm-84.213.190.55.get.no) [84.213.190.55]:44517: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.27
country_id: 3057568
description:
2025-12-17 09:24:15 dovecot_login authenticator failed for (ADMIN) [149.102.232.27]:2339: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2025-12-17 09:24:26 dovecot_login authenticator failed for pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:54543: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 09:27:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<yRVO1x1G2JU+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 09:28:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<yWOe2x1Ggro+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 09:30:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<xjn94R1Gxqk+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.57.68
country_id: 2921044
description:
2025-12-17 09:36:11 dovecot_login authenticator failed for (ADMIN) [212.102.57.68]:54977: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 09:39:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56355: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.248.111.238
country_id: 6252001
description:
2025-12-17 09:40:29 dovecot_plain authenticator failed for (episteep) [38.248.111.238]:35248: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-12-17 09:48:51 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:59863: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-12-17 09:53:15 dovecot_plain authenticator failed for (mostish) [65.20.250.163]:60452: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 09:55:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<oIwPPR5GWsY+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.162.7
country_id: 290557
description:
2025-12-17 09:58:11 dovecot_login authenticator failed for (ADMIN) [217.138.162.7]:33911: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.254.25.56
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.254.25.56 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.10.125
country_id: 3144096
description:
2025-12-17 09:59:19 dovecot_login authenticator failed for ([84.211.10.125]) [84.211.10.125]:44480: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 09:59:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<kNbGSR5Gzo4+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-12-17 10:00:13 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:33888: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 10:06:20 host2 sshd[1818177]: Disconnected from invalid user greyson 62.60.131.157 port 59325 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-17 10:07:36 dovecot_plain authenticator failed for (pyrress) [65.20.133.4]:44758: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 10:07:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<PtngZx5GHOI+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.132.172
country_id: 99237
description:
2025-12-17 10:10:04 dovecot_login authenticator failed for ([65.20.132.172]) [65.20.132.172]:54469: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-12-17 10:10:21 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:35278: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 10:10:21 host2 pure-ftpd[1822261]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 10:14:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<fg66fx5G3sIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 10:15:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<pjgfhR5GvtQDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.210.165
country_id: 6252001
description:
2025-12-17 10:17:01 dovecot_login authenticator failed for (ADMIN) [37.19.210.165]:44266: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.102
country_id: 2464461
description:
Dec 17 10:18:02 host2 sshd[1829787]: Disconnected from invalid user steve 197.5.145.102 port 49752 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 10:18:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HoDkjx5GeLIDhBfJ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.102
country_id: 2464461
description:
Dec 17 10:19:55 host2 sshd[1831141]: Disconnected from invalid user odoo 197.5.145.102 port 49756 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 10:20:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Rbadlh5GwMQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 10:21:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<ZfLHlx5GOMcDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.28
country_id: 2661886
description:
2025-12-17 10:21:13 dovecot_login authenticator failed for (ADMIN) [212.112.19.28]:35786: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.102
country_id: 2464461
description:
Dec 17 10:22:22 host2 sshd[1833419]: Disconnected from invalid user sammy 197.5.145.102 port 49761 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 10:22:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<hUEtnR5GdMo+PIMp>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 197.5.145.102
country_id: 2464461
description:
Dec 17 10:21:52 host2 sshd[1832985]: Received disconnect from 197.5.145.102 port 49760:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.196.202.17
country_id: 3175395
description:
2025-12-17 10:23:11 dovecot_login authenticator failed for ([2.196.202.17]) [2.196.202.17]:54260: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-17 10:23:30 dovecot_login authenticator failed for (cm-84.213.188.130.get.no) [84.213.188.130]:33739: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 10:22:57 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<cSM3nh5G4JQDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 10:22:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<uj44nh5GMuo+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-17 10:24:43 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (brigne) [71.230.228.16]:56102: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 10:24:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1wsjpR5GBJIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.68
country_id: 6252001
description:
Dec 17 10:25:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.68, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JXW9ph5GR9vN0h9E>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.187.9.8
country_id: 1880251
description:
Dec 17 10:25:22 host2 sshd[1836042]: Disconnected from invalid user ubuntu 52.187.9.8 port 33900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 10:25:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<bnTPpx5GPMo+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 10:26:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yn+Bqh5GtJ0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 10:27:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<klakrR5GXpMDhBfJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.195.33.9
country_id: 2921044
description:
[2025-12-17 10:28:42 +0530] info [cpaneld] 159.195.33.9 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 10:31:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<bCYvux5GqoI+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 17 10:31:49 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<93/EvR5GGLA+PIdq>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 10:32:03 host2 sshd[1841231]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.93
country_id: 1819730
description:
Dec 17 10:32:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.93, lip=66.85.158.92, session=<pTQewh5Gmqstjppd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 17 10:34:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<Hnilxh5GFI0+PIco>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.108.248
country_id: 1819730
description:
Dec 17 10:34:45 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=101.36.108.248, lip=66.85.158.91, TLS handshaking: Connection closed, session=<qoFhyB5GoMplJGz4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-17 10:34:57 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (makitylly) [24.1.200.187]:39252: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-12-17 10:37:02 dovecot_login authenticator failed for ([182.95.58.114]) [182.95.58.114]:48274: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-17 10:37:16 dovecot_login authenticator failed for ([178.232.126.146]) [178.232.126.146]:50480: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-12-17 10:37:32 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:57382: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 10:38:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<Z1tI1B5GNqM+PIMh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 10:39:21 host2 sshd[1847674]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 10:39:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<iKwM2B5GTN4+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.67
country_id: 390903
description:
2025-12-17 10:40:53 dovecot_login authenticator failed for (ADMIN) [79.127.181.67]:15508: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.126
country_id: 6252001
description:
2025-12-17 10:41:42 dovecot_login authenticator failed for (ADMIN) [181.41.206.126]:53590: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 10:43:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<slaL6B5GgIk+PIM0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 10:45:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<2E/t7R5GPpo+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-17 10:52:12 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (uncrially) [73.183.74.177]:33584: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.133
country_id: 2328926
description:
2025-12-17 10:56:18 dovecot_login authenticator failed for (ADMIN) [146.70.65.133]:41885: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.152
country_id: 2635167
description:
Dec 17 10:56:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=35.203.211.152, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<KwLLFh9GHN4jy9OY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.152
country_id: 2635167
description:
Dec 17 10:58:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=35.203.211.152, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<eaPhHB9GcuUjy9OY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 17 10:58:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<uKHsHB9GkJk+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.152
country_id: 2635167
description:
Dec 17 10:59:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 11 secs): user=<>, rip=35.203.211.152, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<NbZBHx9GEO8jy9OY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 17 10:59:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<IiUcIh9GnN4+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-17 11:00:17 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (kridize) [73.196.144.25]:45182: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 11:01:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<rrf+KB9G+pM+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-12-17 11:01:15 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (unforercut) [73.213.236.66]:57452: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 11:04:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<6LzlMx9GnrQ+PIdj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 17 11:03:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<AVLFMB9GfOo+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.152
country_id: 2635167
description:
Dec 17 11:05:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.152, lip=66.85.158.92, TLS, session=<U0/KNB9GguIjy9OY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2025-12-17 11:07:29 dovecot_login authenticator failed for ([125.23.125.209]) [122.187.59.26]:54238: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-17 11:07:02 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:49168: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-17 11:07:26 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (thang) [73.168.136.150]:45244: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.120.114
country_id: 719819
description:
2025-12-17 11:08:48 dovecot_login authenticator failed for (ADMIN) [146.70.120.114]:56929: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-17 11:09:07 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (fillargan) [71.230.228.16]:33790: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-17 11:09:42 dovecot_plain authenticator failed for (ingla) [5.11.141.74]:45682: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-12-17 11:09:45 dovecot_plain authenticator failed for c-73-0-191-33.hsd1.fl.comcast.net (camine) [73.0.191.33]:34398: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-17 11:10:16 dovecot_plain authenticator failed for (riplater) [64.72.74.162]:35559: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-17 11:10:19 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (oveness) [87.103.126.54]:47691: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 11:10:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<oXp2SB9GpuU+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.46
country_id: 6252001
description:
2025-12-17 11:11:45 dovecot_login authenticator failed for (ADMIN) [158.173.153.46]:63736: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 11:12:01 host2 pure-ftpd[1875650]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 17 11:13:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<UEpJUh9GPtTBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 11:13:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<vFiRVB9Gqpc+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-17 11:16:09 dovecot_plain authenticator failed for (inonpentea) [65.20.143.159]:33937: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 17 11:16:21 host2 sshd[1878598]: Disconnected from invalid user guest 88.147.30.59 port 45662 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 11:16:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<P93cXR9G0oA+PIcm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 147.182.173.108
country_id: 6252001
description:
Dec 17 11:17:07 host2 sshd[1879032]: Disconnected from invalid user devuser 147.182.173.108 port 41770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.196.237
country_id: 241170
description:
Dec 17 11:17:15 host2 sshd[1879107]: Disconnected from invalid user guest 154.83.196.237 port 50462 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Dec 17 11:16:59 host2 sshd[1878937]: Disconnected from invalid user abhi 103.210.22.105 port 39104 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2025-12-17 11:18:04 dovecot_login authenticator failed for ns3241969.ip-57-129-90.eu [57.129.90.215]:40542: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 147.182.173.108
country_id: 6252001
description:
Dec 17 11:18:05 host2 sshd[1879631]: Disconnected from invalid user rafael 147.182.173.108 port 36530 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2025-12-17 11:18:21 dovecot_login authenticator failed for ([125.23.125.209]) [122.187.59.26]:41018: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.196.237
country_id: 241170
description:
Dec 17 11:19:00 host2 sshd[1880154]: Disconnected from invalid user developer 154.83.196.237 port 36148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Dec 17 11:19:22 host2 sshd[1880403]: Disconnected from invalid user system 103.210.22.105 port 48686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 11:20:39 host2 sshd[1881520]: Disconnected from invalid user nadine 62.60.131.157 port 60144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.105
country_id: 1880251
description:
Dec 17 11:19:59 host2 sshd[1880774]: Disconnected from invalid user ubuntu 103.210.22.105 port 39840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 17 11:20:28 host2 sshd[1881343]: Disconnected from invalid user rafael 88.147.30.59 port 58174 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-17 11:21:23 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:39036: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.22.105
country_id: 1880251
description:
Dec 17 11:21:46 host2 sshd[1882442]: Disconnected from invalid user abdi 103.210.22.105 port 33368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-17 11:21:58 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3888: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 88.147.30.59
country_id: 3175395
description:
Dec 17 11:27:06 host2 sshd[1885969]: Disconnected from invalid user ubuntu 88.147.30.59 port 44718 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.147
country_id: 2328926
description:
2025-12-17 11:31:05 dovecot_login authenticator failed for (ADMIN) [146.70.65.147]:27957: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-17 11:31:38 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:55560: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 17 11:31:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<Dg95lB9GKs0+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-12-17 11:31:55 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:47450: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.206
country_id: 798549
description:
2025-12-17 11:31:59 dovecot_login authenticator failed for (ADMIN) [91.90.120.206]:39992: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-17 11:32:51 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (unexories) [87.103.126.54]:4764: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.249.122.49
country_id: 6252001
description:
2025-12-17 11:34:51 dovecot_login authenticator failed for ([24.249.122.49]) [24.249.122.49]:55724: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.191.55
country_id: 3144096
description:
2025-12-17 11:35:06 dovecot_login authenticator failed for ([84.213.191.55]) [84.213.191.55]:39085: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-17 11:35:37 dovecot_plain authenticator failed for (imoticato) [24.93.140.162]:52290: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.195.33.9
country_id: 2921044
description:
[2025-12-17 11:37:48 +0530] info [cpaneld] 159.195.33.9 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 11:40:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<n0M/sh9GLIQ+PIcl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.5
country_id: 2635167
description:
Dec 17 11:45:18 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.5, lip=66.85.158.92, TLS, session=<o4S2xB9Gg7W594kF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 11:47:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=</48/yx9GaI0+PIcd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 11:47:31 host2 sshd[1902053]: Disconnected from invalid user user 2.57.121.25 port 14070 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 11:49:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<e0uV1B9GBps+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.33
country_id: 289688
description:
2025-12-17 11:50:00 dovecot_login authenticator failed for (ADMIN) [95.181.234.33]:49940: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 11:51:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<bg+62R9GaJU+PIde>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 17 11:51:21 host2 sshd[1904979]: Disconnected from invalid user user2 64.227.176.54 port 39116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 11:51:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<FkPT2h9GEME+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.117
country_id: 99237
description:
2025-12-17 11:52:16 dovecot_login authenticator failed for ([65.20.167.117]) [65.20.167.117]:46808: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-12-17 11:52:35 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:44725: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 17 11:53:16 host2 sshd[1906373]: Disconnected from invalid user db2admin 156.241.128.48 port 44558 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.48
country_id: 6252001
description:
Dec 17 11:53:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.48, lip=66.85.158.92, TLS, session=<9M9O4R9G0OSTuYQw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 11:53:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<Cc3Q4h9G1oM+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.31.75.17
country_id: 660013
description:
2025-12-17 11:53:07 dovecot_login authenticator failed for (vm496206.hosted-by.u1host.com) [144.31.75.17]:51826: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 17 11:54:05 host2 sshd[1907208]: Disconnected from invalid user ubuntu 156.241.128.48 port 56848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.108.174.51
country_id: 1269750
description:
2025-12-17 11:55:13 dovecot_login authenticator failed for (ADMIN) [103.108.174.51]:12659: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-12-17 11:56:24 dovecot_plain authenticator failed for (lastagota) [102.53.15.17]:56365: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 17 11:57:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<n2mo7x9GvrU+PIcc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 17 11:58:23 host2 sshd[1910627]: Disconnected from invalid user prom 156.241.128.48 port 45858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 17 11:59:37 host2 sshd[1911485]: Disconnected from invalid user michael 64.227.176.54 port 58954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.241.128.48
country_id: 1819730
description:
Dec 17 11:59:47 host2 sshd[1911574]: Disconnected from invalid user mj 156.241.128.48 port 42194 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 17 12:00:45 host2 sshd[1912421]: Disconnected from invalid user deploy 64.227.176.54 port 36044 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 12:01:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<3ah5/R9GGoI+PIcr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 12:02:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<Ip+6AiBG/pY+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 12:03:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<WQEdBiBGYoc+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Dec 17 12:04:22 host2 sshd[1915221]: Disconnected from invalid user ruser 203.145.34.93 port 53682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 17 12:04:30 host2 sshd[1915268]: Disconnected from invalid user admin 199.195.254.215 port 33856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 17 12:05:23 host2 sshd[1916024]: Disconnected from invalid user cgpexpert 199.195.254.215 port 46378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 17 12:05:12 host2 sshd[1915802]: Disconnected from invalid user github 194.107.115.65 port 28504 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 17 12:06:29 host2 sshd[1916907]: Disconnected from invalid user centos 194.107.115.65 port 53418 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.55
country_id: 6252001
description:
Dec 17 12:06:49 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.55, lip=66.85.158.92, TLS, session=<i4GwESBG5P6TuYQ3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 17 12:07:02 host2 sshd[1917379]: Disconnected from invalid user hik 199.195.254.215 port 43186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.78.237
country_id: 1282988
description:
Dec 17 12:07:43 host2 sshd[1918046]: Disconnected from invalid user arjun 202.70.78.237 port 4270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Dec 17 12:08:01 host2 sshd[1918283]: Disconnected from invalid user sftp 203.145.34.93 port 58130 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.190.79
country_id: 298795
description:
2025-12-17 12:08:21 dovecot_plain authenticator failed for (marize) [5.26.190.79]:51784: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.162.6
country_id: 290557
description:
2025-12-17 12:08:23 dovecot_login authenticator failed for (ADMIN) [217.138.162.6]:61619: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.65
country_id: 1512440
description:
Dec 17 12:08:48 host2 sshd[1918838]: Disconnected from invalid user hadoop 194.107.115.65 port 46736 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 12:08:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<zVw/FiBG8s0+PIdf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.5
country_id: 6252001
description:
Dec 17 12:08:41 host2 dovecot[1284858]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.91, TLS, session=<KqVSGCBGsJ3CpGsF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Dec 17 12:09:37 host2 sshd[1919371]: Disconnected from invalid user arjun 203.145.34.93 port 45642 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.78.237
country_id: 1282988
description:
Dec 17 12:09:14 host2 sshd[1919135]: Disconnected from invalid user admin 202.70.78.237 port 61130 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.254.215
country_id: 6252001
description:
Dec 17 12:09:31 host2 sshd[1919300]: Disconnected from invalid user hello 199.195.254.215 port 52514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 17 12:09:52 host2 sshd[1919561]: Disconnected from invalid user neeraj 213.142.151.19 port 43534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.70.78.237
country_id: 1282988
description:
Dec 17 12:11:30 host2 sshd[1920963]: Disconnected from invalid user ec2-user 202.70.78.237 port 8774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 17 12:11:45 host2 sshd[1921106]: Disconnected from invalid user admin 45.78.225.21 port 44924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Dec 17 12:11:11 host2 sshd[1920750]: Disconnected from invalid user vpsuser 203.145.34.93 port 48710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.142.151.19
country_id: 298795
description:
Dec 17 12:11:16 host2 sshd[1920803]: Disconnected from invalid user runner 213.142.151.19 port 43258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Dec 17 12:11:57 host2 sshd[1921298]: Disconnected from invalid user erp 203.145.34.93 port 32830 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-17 12:11:59 dovecot_plain authenticator failed for (dulunder) [65.20.233.110]:48697: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 12:13:50 host2 pure-ftpd[1922698]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 17 12:14:14 host2 sshd[1922934]: Disconnected from invalid user sftp 45.78.225.21 port 56162 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 12:14:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<OBPGLiBG6tc+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.174
country_id: 1880251
description:
2025-12-17 12:16:40 dovecot_login authenticator failed for (ADMIN) [156.146.57.174]:60534: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Dec 17 12:17:51 host2 sshd[1925991]: Disconnected from invalid user sftp_user 179.32.207.251 port 42992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.195.46.102
country_id: 2921044
description:
Dec 17 12:18:32 host2 sshd[1926499]: Disconnected from invalid user acs 51.195.46.102 port 35474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.207.251
country_id: 3686110
description:
Dec 17 12:18:33 host2 sshd[1926511]: Disconnected from invalid user grid 179.32.207.251 port 57134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Dec 17 12:19:14 host2 sshd[1927099]: Disconnected from invalid user dayz 179.32.207.251 port 43034 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.77
country_id: 6252001
description:
Dec 17 12:19:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=195.184.76.77, lip=66.85.158.91, TLS handshaking: Connection closed, session=<I8ZZPyBGr6jDuExN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.79
country_id: 6252001
description:
Dec 17 12:19:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.79, lip=66.85.158.91, TLS: Connection closed, session=<N//3PyBGVb7DuExP>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.78
country_id: 6252001
description:
Dec 17 12:20:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.78, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<u+LjQCBGI9rDuExO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.73
country_id: 6252001
description:
Dec 17 12:20:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.73, lip=66.85.158.91, TLS: Connection closed, session=<1+kSQSBGK7HDuExJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 12:21:16 host2 sshd[1928884]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.136.125
country_id: 1168579
description:
Dec 17 12:21:28 host2 sshd[1929022]: Disconnected from invalid user issabel 116.71.136.125 port 35764 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2025-12-17 12:21:42 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:54944: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-12-17 12:22:13 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:46178: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.71.136.125
country_id: 1168579
description:
Dec 17 12:22:59 host2 sshd[1930234]: Disconnected from invalid user runner 116.71.136.125 port 48458 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.76.231
country_id: 6252001
description:
Dec 17 12:24:36 host2 sshd[1931591]: Disconnected from invalid user morgan 34.66.76.231 port 48572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-17 12:25:41 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:60355: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 12:26:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<TrmlVyBGoMU+PIM0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.225.21
country_id: 1880251
description:
Dec 17 12:26:37 host2 sshd[1933353]: Disconnected from invalid user lighthouse 45.78.225.21 port 42700 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.195.46.102
country_id: 2921044
description:
Dec 17 12:25:57 host2 sshd[1932843]: Disconnected from invalid user bodega 51.195.46.102 port 36494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-12-17 12:26:03 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:33590: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.51.208.158
country_id: 3469034
description:
Dec 17 12:27:29 host2 sshd[1934197]: Disconnected from invalid user yxsong 187.51.208.158 port 47141 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 12:28:35 host2 sshd[1935074]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 77.87.40.114
country_id: 690791
description:
Dec 17 12:28:16 host2 sshd[1934836]: Disconnected from invalid user u1 77.87.40.114 port 40930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 17 12:28:23 host2 sshd[1934940]: Disconnected from invalid user john 152.32.172.161 port 39172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 77.87.40.114
country_id: 690791
description:
Dec 17 12:29:17 host2 sshd[1935550]: Disconnected from invalid user xmr 77.87.40.114 port 36580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.148.217
country_id: 6252001
description:
Dec 17 12:30:27 host2 sshd[1936590]: Disconnected from invalid user localhost 43.130.148.217 port 46866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 17 12:31:26 host2 sshd[1937237]: Disconnected from invalid user elasticsearch 152.32.172.161 port 52604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.148.217
country_id: 6252001
description:
Dec 17 12:31:34 host2 sshd[1937392]: Disconnected from invalid user ubuntu 43.130.148.217 port 38536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 17 12:32:14 host2 sshd[1938009]: Disconnected from invalid user ts 152.32.172.161 port 41374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.109.200.147
country_id: 130758
description:
Dec 17 12:32:38 host2 sshd[1938552]: Disconnected from invalid user ubuntu 78.109.200.147 port 34938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.196.84.166
country_id: 6252001
description:
Dec 17 12:32:44 host2 sshd[1938605]: Disconnected from invalid user user1 35.196.84.166 port 59846 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.130.148.217
country_id: 6252001
description:
Dec 17 12:33:02 host2 sshd[1938928]: Disconnected from invalid user mastodon 43.130.148.217 port 57824 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 12:34:41 host2 sshd[1940649]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.109.200.147
country_id: 130758
description:
Dec 17 12:34:19 host2 sshd[1940264]: Disconnected from invalid user hack 78.109.200.147 port 39976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.172.161
country_id: 1819730
description:
Dec 17 12:34:28 host2 sshd[1940393]: Disconnected from invalid user saude 152.32.172.161 port 43786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.130.148.217
country_id: 6252001
description:
Dec 17 12:34:38 host2 sshd[1940605]: Disconnected from invalid user n 43.130.148.217 port 42208 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.196.84.166
country_id: 6252001
description:
Dec 17 12:35:06 host2 sshd[1941209]: Disconnected from invalid user postgres 35.196.84.166 port 38800 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.7
country_id: 2750405
description:
Dec 17 12:35:21 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=31.14.32.7, lip=66.85.158.92, session=<rNO2dyBGFt4fDiAH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.109.200.147
country_id: 130758
description:
Dec 17 12:36:37 host2 sshd[1942955]: Disconnected from invalid user scan 78.109.200.147 port 56106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.196.84.166
country_id: 6252001
description:
Dec 17 12:35:54 host2 sshd[1942086]: Disconnected from invalid user username 35.196.84.166 port 43690 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.188
country_id: 2635167
description:
Dec 17 12:36:16 host2 dovecot[1284858]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.188, lip=66.85.158.92, TLS, session=<X//3eiBGt6dX7LC8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-12-17 12:37:39 dovecot_plain authenticator failed for (chodies) [65.20.148.165]:36618: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.69.154.4
country_id: 1643084
description:
Dec 17 12:38:36 host2 sshd[1944995]: Disconnected from invalid user debian 36.69.154.4 port 34788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 17 12:38:51 host2 sshd[1945234]: Disconnected from invalid user test1 103.171.85.124 port 54298 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 17 12:39:45 host2 sshd[1945999]: Disconnected from invalid user ubuntu 103.171.85.124 port 42018 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 17 12:40:28 host2 sshd[1946944]: Disconnected from invalid user debian 103.171.85.124 port 40254 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 12:43:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<lgRAlCBGnLY+PIcr>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.157.144
country_id: 2921044
description:
[2025-12-17 12:43:43 +0530] info [cpaneld] 213.209.157.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.23
country_id: 6290252
description:
2025-12-17 12:43:56 dovecot_login authenticator failed for (ADMIN) [37.46.115.23]:52892: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 12:44:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<EbEZlyBGyLQ+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.129
country_id: 2661886
description:
2025-12-17 12:44:32 dovecot_login authenticator failed for (ADMIN) [46.246.8.129]:56419: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.124
country_id: 1643084
description:
Dec 17 12:45:27 host2 sshd[1952381]: Disconnected from invalid user yzx 103.171.85.124 port 43694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 12:46:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=</QCaniBG2KU+PIdm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.163.85
country_id: 1269750
description:
2025-12-17 12:50:23 dovecot_plain authenticator failed for (Z69Q27X) [49.43.163.85]:58862: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.97.79.164
country_id: 2328926
description:
2025-12-17 12:57:33 dovecot_plain authenticator failed for (CUF28CYXYG583UI9) [98.97.79.164]:26116: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 13:00:37 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<6Dzz0SBGHq8+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.240
country_id: 798544
description:
2025-12-17 12:59:58 dovecot_login authenticator failed for (ADMIN) [138.199.59.240]:34812: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 17 13:03:51 host2 sshd[1972259]: Disconnected from invalid user guest 152.32.203.205 port 42446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 17 13:03:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<HMx52iBGBtA+PIds>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 13:03:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<hXpw3CBGJoI+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 17 13:05:27 host2 sshd[1973645]: Disconnected from invalid user newuser 104.248.245.89 port 35286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.203.205
country_id: 1861060
description:
Dec 17 13:06:09 host2 sshd[1974160]: Disconnected from invalid user uftp 152.32.203.205 port 49714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 17 13:09:17 host2 sshd[1976833]: Disconnected from invalid user sammy 52.224.240.74 port 51726 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Dec 17 13:09:47 host2 sshd[1977140]: Disconnected from invalid user clock 103.118.114.22 port 42892 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-17 13:10:41 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (cruetchini) [174.161.27.82]:46094: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 17 13:10:50 host2 sshd[1978328]: Disconnected from invalid user abdi 104.248.245.89 port 51170 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.245.89
country_id: 2921044
description:
Dec 17 13:11:52 host2 sshd[1979124]: Disconnected from invalid user userm 104.248.245.89 port 54890 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.178
country_id: 2960313
description:
2025-12-17 13:11:01 dovecot_login authenticator failed for (ADMIN) [37.46.113.178]:28448: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 13:15:49 host2 pure-ftpd[1983473]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 13:16:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<jGMBCiFGTNU+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 13:19:26 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53114: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 13:22:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<KmB4HiFG3uQ+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.5
country_id: 3194884
description:
2025-12-17 13:21:19 dovecot_login authenticator failed for (ADMIN) [176.125.229.5]:12920: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 17 13:24:01 host2 sshd[1990728]: Disconnected from invalid user omm 52.224.240.74 port 44536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-17 13:24:35 dovecot_plain authenticator failed for (galanic) [102.53.15.18]:57722: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 17 13:24:54 host2 sshd[1991711]: Disconnected from invalid user clock 52.224.240.74 port 52140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.20
country_id: 174982
description:
2025-12-17 13:31:07 dovecot_login authenticator failed for (ADMIN) [185.253.160.20]:20185: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.37.131.169
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 54.37.131.169 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Dec 17 13:34:24 host2 sshd[1999217]: Disconnected from invalid user developer 177.54.62.66 port 54697 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-17 13:35:41 dovecot_login authenticator failed for ([128.185.253.122]) [128.185.253.122]:35542: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.54.62.66
country_id: 3469034
description:
Dec 17 13:35:49 host2 sshd[2000551]: Disconnected from invalid user ubuntu 177.54.62.66 port 56304 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-17 13:36:01 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:42632: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-12-17 13:35:17 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (flunsich) [78.68.37.25]:55069: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.54.62.66
country_id: 3469034
description:
Dec 17 13:36:35 host2 sshd[2001244]: Disconnected from invalid user vhserver 177.54.62.66 port 52957 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Dec 17 13:36:53 host2 sshd[2001492]: Disconnected from invalid user drcom 154.221.28.214 port 33178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.218.149
country_id: 1880251
description:
Dec 17 13:37:04 host2 sshd[2001625]: Disconnected from invalid user acct 152.32.218.149 port 43204 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.218.149
country_id: 1880251
description:
Dec 17 13:38:21 host2 sshd[2002457]: Disconnected from invalid user vboxuser 152.32.218.149 port 57348 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.105
country_id: 2661886
description:
2025-12-17 13:39:07 dovecot_login authenticator failed for (ADMIN) [46.246.8.105]:1682: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 17 13:39:47 host2 sshd[2003487]: Disconnected from invalid user pay 81.30.162.18 port 39358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.245.55.165
country_id: 1880251
description:
Dec 17 13:40:19 host2 sshd[2004001]: Disconnected from invalid user ubuntu 157.245.55.165 port 37620 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.245
country_id: 6252001
description:
Dec 17 13:41:18 host2 pure-ftpd[2004664]: (?@205.210.31.245) [INFO] New connection from 205.210.31.245


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.30.162.18
country_id: 690791
description:
Dec 17 13:41:25 host2 sshd[2004738]: Disconnected from invalid user jasper 81.30.162.18 port 57118 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.165
country_id: 1880251
description:
Dec 17 13:41:37 host2 sshd[2004977]: Disconnected from invalid user administrator 157.245.55.165 port 57592 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 17 13:43:03 host2 sshd[2005958]: Disconnected from invalid user user1 81.30.162.18 port 46650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.217.145.104
country_id: 1643084
description:
Dec 17 13:45:33 host2 sshd[2008512]: Disconnected from invalid user sunil 103.217.145.104 port 54398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-17 13:46:15 dovecot_plain authenticator failed for (shillis) [62.73.121.209]:46856: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.188.156
country_id: 99237
description:
2025-12-17 13:46:46 dovecot_plain authenticator failed for (progrifust) [65.20.188.156]:53396: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 13:47:09 host2 sshd[2009836]: Disconnected from invalid user unique 62.60.131.157 port 32247 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.217.145.104
country_id: 1643084
description:
Dec 17 13:47:17 host2 sshd[2009990]: Disconnected from invalid user dspace 103.217.145.104 port 56542 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.208
country_id: 6252001
description:
Dec 17 13:49:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.208, lip=66.85.158.92, session=<5RXugCFGMXBAPpzQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.202
country_id: 6252001
description:
Dec 17 13:49:43 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.202, lip=66.85.158.92, TLS: Connection closed, session=<qNykgSFGgKJAPpzK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-12-17 13:53:24 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:27323: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 17 13:54:03 host2 sshd[2016063]: Disconnected from invalid user monitor 103.243.27.122 port 60346 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.2
country_id: 1512440
description:
Dec 17 13:54:40 host2 sshd[2016930]: Disconnected from invalid user vivek 194.107.115.2 port 28426 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.172.47.74
country_id: 2750405
description:
Dec 17 13:56:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.172.47.74, lip=66.85.158.92, session=<gExgmiFGds2nrC9K>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.243.27.122
country_id: 1819730
description:
Dec 17 13:57:03 host2 sshd[2018651]: Disconnected from invalid user backups 103.243.27.122 port 37714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.238.252.133
country_id: 241170
description:
Dec 17 13:57:09 host2 sshd[2018720]: Disconnected from invalid user arthur 156.238.252.133 port 44926 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.238.252.133
country_id: 241170
description:
Dec 17 13:58:17 host2 sshd[2019575]: Disconnected from invalid user dspace 156.238.252.133 port 44688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.52.15.214
country_id: 1269750
description:
Dec 17 13:58:19 host2 sshd[2019578]: Disconnected from invalid user steam 152.52.15.214 port 58086 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.25
country_id: 298795
description:
2025-12-17 13:58:43 dovecot_login authenticator failed for (ADMIN) [188.213.34.25]:53327: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.52.15.214
country_id: 1269750
description:
Dec 17 13:59:41 host2 sshd[2020618]: Disconnected from invalid user test 152.52.15.214 port 26698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.210.167
country_id: 6251999
description:
Dec 17 14:01:42 host2 sshd[2022324]: Disconnected from invalid user ts3server 158.69.210.167 port 46718 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 14:02:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<8bBvrSFGLLg+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.156.63
country_id: 1269750
description:
Dec 17 14:03:16 host2 sshd[2023591]: Disconnected from invalid user app 64.227.156.63 port 41682 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 14:03:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<DahlsiFGUsY+PIdm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.210.167
country_id: 6251999
description:
Dec 17 14:03:50 host2 sshd[2024198]: Disconnected from invalid user minikube 158.69.210.167 port 54768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.156.63
country_id: 1269750
description:
Dec 17 14:05:06 host2 sshd[2025268]: Disconnected from invalid user mk 64.227.156.63 port 44386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 17 14:05:30 host2 sshd[2025575]: Disconnected from invalid user peng 96.78.175.36 port 41178 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 17 14:06:02 host2 sshd[2025951]: Disconnected from invalid user ubuntu 96.78.175.36 port 35680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 96.78.175.36
country_id: 6252001
description:
Dec 17 14:06:32 host2 sshd[2026308]: Disconnected from invalid user sybase 96.78.175.36 port 41908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 17 14:08:55 host2 sshd[2028197]: Disconnected from invalid user temp 152.32.238.146 port 56890 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec 17 14:09:30 host2 sshd[2028584]: Disconnected from invalid user ubuntu 152.32.238.146 port 50884 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 14:10:30 host2 sshd[2029439]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.121.2
country_id: 1605651
description:
Dec 17 14:11:13 host2 sshd[2029892]: Disconnected from invalid user odoo 165.154.121.2 port 52842 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 14:10:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<y2EByyFG/Ks+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.40
country_id: 798549
description:
2025-12-17 14:10:52 dovecot_login authenticator failed for (ADMIN) [143.244.52.40]:34975: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec 17 14:11:51 host2 sshd[2030283]: Disconnected from invalid user ahmed 201.249.205.94 port 55644 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 14:14:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<fFOg2CFGXrM+PIcs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 14:14:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<oOwg2iFGKtM+PIdj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.121.2
country_id: 1605651
description:
Dec 17 14:16:07 host2 sshd[2033758]: Disconnected from invalid user peng 165.154.121.2 port 45648 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.41
country_id: 2750405
description:
2025-12-17 14:16:08 dovecot_login authenticator failed for (Copy-of-VM-2022) [45.94.31.41]:28526: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 14:16:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<+TVj4SFGeLk+PIcf>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 14:17:49 host2 sshd[2035006]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 14:17:46 host2 pure-ftpd[2034962]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.222
country_id: 6252001
description:
Dec 17 14:18:25 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.222, lip=66.85.158.92, session=<0LtT6CFGDubG6xje>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-17 14:20:58 dovecot_plain authenticator failed for (sconsh) [65.20.191.12]:39819: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.42
country_id: 130758
description:
Dec 17 14:21:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.42, lip=66.85.158.91, session=<O3M+8yFGprY+PIcq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-17 14:22:32 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (uplidya) [196.47.172.253]:48209: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.35
country_id: 1814991
description:
2025-12-17 14:24:43 dovecot_login authenticator failed for (ADMIN) [188.241.80.35]:3161: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.62.239.4
country_id: 732800
description:
2025-12-17 14:25:48 dovecot_plain authenticator failed for (talkindema) [149.62.239.4]:56700: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.23
country_id: 2589581
description:
2025-12-17 14:26:54 dovecot_login authenticator failed for (ADMIN) [176.125.228.23]:1658: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-17 14:26:57 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (twineromy) [73.13.220.220]:41410: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-17 14:26:54 dovecot_plain authenticator failed for (nonress) [65.20.191.12]:57056: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.190.79
country_id: 298795
description:
2025-12-17 14:28:23 dovecot_plain authenticator failed for (rhonesight) [5.26.190.79]:41060: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-17 14:28:26 dovecot_plain authenticator failed for c-69-142-126-37.hsd1.nj.comcast.net (herehorl) [69.142.126.37]:58174: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 14:28:45 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<4ecoDSJGJrU+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.100
country_id: 3996063
description:
2025-12-17 14:29:55 dovecot_login authenticator failed for (201.173.92.100-clientes-izzi.mx) [201.173.92.100]:56592: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-12-17 14:30:14 dovecot_login authenticator failed for ([90.160.139.163]) [90.160.139.163]:50737: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.121.2
country_id: 1605651
description:
Dec 17 14:31:48 host2 sshd[2046569]: Disconnected from invalid user hz 165.154.121.2 port 47080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-12-17 14:32:25 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (morasila) [66.177.30.53]:34466: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 14:33:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<0lsUHyJGGOM+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-17 14:38:44 dovecot_plain authenticator failed for (ablen) [65.20.153.146]:56474: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-17 14:38:49 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (motherled) [196.47.172.253]:58619: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-17 14:39:35 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:59694: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.128
country_id: 6252001
description:
2025-12-17 14:39:51 dovecot_login authenticator failed for wsip-184-191-250-128.fv.ks.cox.net [184.191.250.128]:41110: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.84
country_id: 390903
description:
2025-12-17 14:43:22 dovecot_login authenticator failed for (ADMIN) [79.127.181.84]:22568: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 14:43:57 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<uz9pQyJG9NE+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.205
country_id: 2510769
description:
2025-12-17 14:48:48 dovecot_login authenticator failed for (ADMIN) [212.102.49.205]:3731: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-17 14:49:56 dovecot_plain authenticator failed for 37.150.8.174.dynamic.telecom.kz (masaghte) [37.150.8.174]:40238: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 14:52:01 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<1txSYCJGUuI+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 14:53:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<ZWvkZSJGHNU+PIdj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.42.136.22
country_id: 2750405
description:
Dec 17 14:54:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.42.136.22, lip=66.85.158.91, session=<uHj3aCJGsuuYKogW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 14:54:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<OGnpaSJGIJ8+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-12-17 14:54:58 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:45896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-17 14:55:10 dovecot_login authenticator failed for ([182.95.58.62]) [182.95.58.62]:50074: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 14:55:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<I017bSJGxLc+PIce>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 14:56:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<oA+XbyJG6o8+PIcf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.50.226
country_id: 2921044
description:
Dec 17 14:56:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=8.211.50.226, lip=66.85.158.92, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<alQBcSJGvnQI0zLi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 14:58:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<4blAdiJGeM0+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-12-17 14:58:40 dovecot_plain authenticator failed for (melcal) [102.53.15.56]:43338: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 14:59:50 host2 sshd[2070639]: Disconnected from invalid user dion 62.60.131.157 port 15997 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.3.115
country_id: 2750405
description:
2025-12-17 15:00:01 dovecot_login authenticator failed for (ADMIN) [158.173.3.115]:2751: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.235.30
country_id: 6252001
description:
2025-12-17 15:00:26 dovecot_plain authenticator failed for c-73-0-235-30.hsd1.fl.comcast.net (couped) [73.0.235.30]:41660: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 15:01:21 host2 sshd[2072007]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 15:04:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<heW/iyJGBqk+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 15:04:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<vEW1jCJG/r8+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.141.74
country_id: 298795
description:
2025-12-17 15:10:18 dovecot_plain authenticator failed for (ousapyint) [5.11.141.74]:41958: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 15:11:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<88zQpSJGHoM+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.110.189.45
country_id: 2750405
description:
2025-12-17 15:15:30 dovecot_login authenticator failed for ([193.110.189.45]) [193.110.189.45]:49923: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-12-17 15:15:42 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:13934: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-12-17 15:15:56 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:53138: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-12-17 15:16:04 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:57690: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.129.41
country_id: 617790
description:
2025-12-17 15:16:28 dovecot_login authenticator failed for ae0-3101.cr01.ch.md.as43289.net (ADMIN) [178.175.129.41]:42464: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.165
country_id: 102358
description:
2025-12-17 15:18:06 dovecot_login authenticator failed for (ADMIN) [95.181.235.165]:6587: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 15:19:49 host2 pure-ftpd[2089598]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 15:20:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<A26gxSJGerw+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-17 15:22:35 dovecot_login authenticator failed for ([182.95.138.209]) [182.95.181.62]:48164: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 15:22:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<Ofy2zSJGkKs+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-12-17 15:22:52 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:42959: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-17 15:24:05 dovecot_login authenticator failed for ([125.18.154.73]) [182.95.226.118]:46928: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.62
country_id: 1269750
description:
2025-12-17 15:24:22 dovecot_login authenticator failed for ([182.95.138.209]) [182.95.181.62]:33752: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-17 15:26:18 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (gical) [98.222.93.199]:40680: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.98
country_id: 6252001
description:
Dec 17 15:26:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.98, lip=66.85.158.91, session=<4Tzh2yJGFP3G6xhi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 17 15:29:07 host2 sshd[2098355]: Disconnected from invalid user dion 62.60.131.157 port 49265 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 15:28:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<RW6Q4iJGAug+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 15:29:46 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<C3VS5yJG2Lw+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 15:31:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<e1Zf7CJGVqs+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-17 15:30:38 dovecot_plain authenticator failed for (rellows) [65.20.133.208]:47676: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 78.100.64.148
country_id: 289688
description:
Dec 17 15:32:40 host2 sshd[2101185]: Disconnected from invalid user user14 78.100.64.148 port 56120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 17 15:36:20 host2 sshd[2104211]: Disconnected from invalid user rancher 78.100.64.148 port 7432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.100.64.148
country_id: 289688
description:
Dec 17 15:37:11 host2 sshd[2104821]: Disconnected from invalid user chin 78.100.64.148 port 10584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-17 15:38:22 dovecot_login authenticator failed for ([182.95.215.9]) [182.95.227.70]:51082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.183
country_id: 6252001
description:
Dec 17 15:38:54 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.183, lip=66.85.158.91, TLS, session=<OgAgCCNGbvaTuYS3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 15:39:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<lSxsCiNGitc+PIcl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 15:42:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<ShqZFCNGBoA+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 15:44:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<4xGuHSNGoqI+PIdj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.95.176
country_id: 6251999
description:
2025-12-17 15:45:44 dovecot_login authenticator failed for (ADMIN) [149.22.95.176]:34168: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.195.241.97
country_id: 2802361
description:
Dec 17 15:46:25 host2 pure-ftpd[2113363]: (?@35.195.241.97) [INFO] New connection from 35.195.241.97


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.14.118.150
country_id: 2802361
description:
Dec 17 15:49:19 host2 pure-ftpd[2115353]: (?@34.14.118.150) [INFO] New connection from 34.14.118.150


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 17 15:49:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<iXT/LiNG1sc+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-17 15:51:02 dovecot_plain authenticator failed for (entiotole) [65.20.133.208]:41138: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-17 15:51:04 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (copose) [174.169.224.27]:60578: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 15:51:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<oYcZNCNGrMM+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.62.56.52
country_id: 1694008
description:
2025-12-17 15:50:24 dovecot_plain authenticator failed for (6MB1PQ8V7O8RZW8) [158.62.56.52]:62483: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.167.198
country_id: 149590
description:
2025-12-17 15:50:34 dovecot_plain authenticator failed for (6MB1PQ8V7O8RZW8) [102.69.167.198]:63255: 535 Incorrect authentication data (set_id=httpsaccounts.zoho.comsigninhr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-12-17 15:50:45 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (pinsager) [73.196.144.25]:50012: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-12-17 15:51:27 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (bepter) [196.47.172.253]:34636: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-12-17 15:51:24 dovecot_plain authenticator failed for (cabomy) [81.0.54.119]:36749: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.68.82
country_id: 1210997
description:
Dec 17 15:56:49 host2 sshd[2122915]: Disconnected from invalid user andrey 182.48.68.82 port 48162 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.48.68.82
country_id: 1210997
description:
Dec 17 15:58:17 host2 sshd[2124355]: Disconnected from invalid user armen 182.48.68.82 port 54012 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 15:59:13 host2 sshd[2125177]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.19
country_id: 146669
description:
2025-12-17 15:59:52 dovecot_login authenticator failed for (ADMIN) [185.253.162.19]:10541: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 16:01:23 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<O9NiWCNGGu4+PIdp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 16:02:33 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<yqKYXCNGcsM+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-17 16:02:00 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:38750: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.143.2
country_id: 1269750
description:
2025-12-17 16:02:26 dovecot_login authenticator failed for (ws99-36-153-203.rcil.gov.in) [182.72.143.2]:52394: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.68.82
country_id: 1210997
description:
Dec 17 16:02:44 host2 sshd[2128571]: Disconnected from invalid user test 182.48.68.82 port 55920 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-17 16:02:53 dovecot_login authenticator failed for ([84.214.63.110]) [84.214.63.110]:57744: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.89.232
country_id: 3017382
description:
Dec 17 16:04:04 host2 pure-ftpd[2130560]: (?@91.231.89.232) [INFO] New connection from 91.231.89.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.225.164
country_id: 3996063
description:
2025-12-17 16:04:09 dovecot_plain authenticator failed for (unbots) [201.166.225.164]:57492: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-17 16:05:14 dovecot_login authenticator failed for ([197.156.121.38]) [213.55.85.202]:3899: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 16:06:26 host2 sshd[2132969]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-17 16:05:49 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:38225: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-17 16:05:51 dovecot_plain authenticator failed for (stosious) [102.53.15.180]:33586: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 17 16:06:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<l8Y2aiNGArU+PIdn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.179.104
country_id: 6252001
description:
Dec 17 16:09:05 host2 sshd[2136249]: Disconnected from invalid user jack 23.94.179.104 port 44196 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-12-17 16:09:13 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:53252: 535 Incorrect authentication data (set_id=lezzarotech@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.48.208.204
country_id: 3374084
description:
2025-12-17 16:10:10 dovecot_plain authenticator failed for (0SD7X7I) [65.48.208.204]:56805: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2750405
description:
[2025-12-17 16:10:32 +0530] info [cpaneld] 213.209.143.251 - agronatu "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agronatu (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-12-17 16:09:43 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:43982: 535 Incorrect authentication data (set_id=lezzarotech)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.26.84
country_id: 3175395
description:
Dec 17 16:09:53 host2 sshd[2137049]: Disconnected from invalid user rustserver 151.34.26.84 port 31075 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.94.179.104
country_id: 6252001
description:
Dec 17 16:11:16 host2 sshd[2138551]: Disconnected from invalid user jenkins 23.94.179.104 port 46612 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.152.83.202
country_id: 2264397
description:
Dec 17 16:11:05 host2 sshd[2138381]: Disconnected from invalid user jenkins 89.152.83.202 port 49750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.152.83.202
country_id: 2264397
description:
Dec 17 16:11:49 host2 sshd[2139142]: Disconnected from invalid user grace 89.152.83.202 port 33856 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.23
country_id: 614540
description:
2025-12-17 16:12:57 dovecot_login authenticator failed for (ADMIN) [95.181.236.23]:53522: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.94.179.104
country_id: 6252001
description:
Dec 17 16:13:54 host2 sshd[2141039]: Disconnected from invalid user user1 23.94.179.104 port 49038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.26.84
country_id: 3175395
description:
Dec 17 16:16:23 host2 sshd[2143351]: Disconnected from invalid user sysadmin 151.34.26.84 port 31532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.16
country_id: 102358
description:
2025-12-17 16:17:40 dovecot_login authenticator failed for (ADMIN) [95.181.235.16]:40919: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 16:21:32 host2 pure-ftpd[2148503]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 16:22:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<x320oiNGmuk+PIcf>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.143.251
country_id: 2750405
description:
[2025-12-17 16:27:38 +0530] info [cpaneld] 213.209.143.251 - ajsstarl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajsstarl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 16:33:44 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<ziL2yyNGVrA+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 16:33:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<n2y4zCNGluc+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.216.9
country_id: 1861060
description:
2025-12-17 16:34:09 dovecot_login authenticator failed for (ADMIN) [155.2.216.9]:58378: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 16:34:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<Msf/ziNGNOA+PIcs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 16:35:00 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<+9i70CNGuqcDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 16:39:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<nLoW4CNGfsk+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.176.80
country_id: 2635167
description:
2025-12-17 16:38:45 dovecot_login authenticator failed for (ADMIN) [181.215.176.80]:48548: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 16:40:37 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<hI/a5CNGIqADjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 17 16:45:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<xNWa9CNGur7BHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 16:46:06 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<ye9c+CNG6LI+PIdm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 16:46:53 host2 dovecot[1284858]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<oZBB+yNGHtMDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 17 16:50:03 host2 dovecot[1284858]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<t2ibBiRGbNQDjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.10
country_id: 241170
description:
Dec 17 16:52:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.10, lip=66.85.158.91, session=<MmsxDyRGiM3E+2YK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.19
country_id: 241170
description:
Dec 17 16:52:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.19, lip=66.85.158.91, session=<18U2DyRGJI/E+2YT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.20
country_id: 241170
description:
Dec 17 16:52:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.20, lip=66.85.158.91, session=<cpE0DyRGnuXE+2YU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.21
country_id: 241170
description:
Dec 17 16:52:30 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.21, lip=66.85.158.91, session=<T/c3DyRGDNjE+2YV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 16:51:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<EtUTDSRGnuo+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.24
country_id: 241170
description:
Dec 17 16:52:29 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.24, lip=66.85.158.91, session=<i+suDyRGGtTE+2YY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.49
country_id: 2921044
description:
2025-12-17 16:55:28 dovecot_login authenticator failed for (ADMIN) [191.101.157.49]:3961: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 16:57:04 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<smGHHyRGisw+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.211.86
country_id: 6252001
description:
2025-12-17 16:57:06 dovecot_plain authenticator failed for ([100.64.100.6]) [173.239.211.86]:58165: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 17 16:57:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<bQxxIiRGcNyLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.23
country_id: 241170
description:
Dec 17 17:04:15 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.23, lip=66.85.158.91, session=<GEY7OSRGmOvE+2YX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.102.22
country_id: 241170
description:
Dec 17 17:04:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.102.22, lip=66.85.158.91, session=<zRloOSRGgLXE+2YW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 17:04:21 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61962: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.232.94.54
country_id: 241170
description:
Dec 17 17:05:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=156.232.94.54, lip=66.85.158.91, session=<PO67PSRGUqec6F42>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 17:05:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<imP7PiRGqs4+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.217
country_id: 3175395
description:
2025-12-17 17:05:50 dovecot_login authenticator failed for (ADMIN) [156.146.41.217]:35550: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 17:08:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<t+rqSCRGtqo+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 17:11:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<bfwgUiRGhIs+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.12
country_id: 798549
description:
2025-12-17 17:11:33 dovecot_login authenticator failed for (ADMIN) [143.244.54.12]:14481: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 17:11:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<IGFzUyRGHKA+PIcf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 17:12:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<Ou2IVSRGzpc+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-17 17:12:46 dovecot_login authenticator failed for (137-161-97-62.cust.smartcall.no) [62.97.161.137]:34718: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-12-17 17:13:05 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:59663: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.125.146
country_id: 6252001
description:
Dec 17 17:15:29 host2 pure-ftpd[2193676]: (?@135.237.125.146) [INFO] New connection from 135.237.125.146


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 17:16:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<RST1YyRGpLU+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-12-17 17:22:05 dovecot_login authenticator failed for (nsg-static-193.87.72.182.airtel.in) [182.74.12.86]:42770: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.37
country_id: 6252001
description:
2025-12-17 17:22:14 dovecot_login authenticator failed for ([98.181.46.37]) [98.181.46.37]:35088: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 17:23:32 host2 pure-ftpd[2200522]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.10
country_id: 732800
description:
2025-12-17 17:24:58 dovecot_login authenticator failed for (ADMIN) [94.156.14.10]:50791: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec 17 17:25:00 host2 sshd[2201211]: Disconnected from invalid user fran 193.123.68.117 port 62465 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec 17 17:27:41 host2 sshd[2202492]: Disconnected from invalid user admin 193.123.68.117 port 53351 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.10
country_id: 732800
description:
2025-12-17 17:28:38 dovecot_login authenticator failed for (ADMIN) [94.156.14.10]:37810: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 17:30:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<MmlZlSRGtoQ+PIcl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.123.68.117
country_id: 290557
description:
Dec 17 17:30:39 host2 sshd[2204339]: Disconnected from invalid user el 193.123.68.117 port 3047 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.95.221.140
country_id: 1643084
description:
Dec 17 17:30:58 host2 sshd[2204486]: Disconnected from invalid user test 36.95.221.140 port 49676 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.97.236.140
country_id: 1269750
description:
Dec 17 17:32:47 host2 sshd[2205655]: Disconnected from invalid user admin 59.97.236.140 port 46462 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 17:33:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<9Ej7oSRGUJw+PIce>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.144
country_id: 1269750
description:
2025-12-17 17:33:43 dovecot_login authenticator failed for (nsg-corporate-144.227.187.122.airtel.in) [122.187.227.144]:46622: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 17:34:55 host2 sshd[2207206]: Disconnected from invalid user user 2.57.121.25 port 10338 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.96
country_id: 130758
description:
Dec 17 17:35:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.96, lip=66.85.158.91, session=<HWsUqSRG8Ok+PIdg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 17:36:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<yTcfrCRGlMk+PIde>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.95.221.140
country_id: 1643084
description:
Dec 17 17:36:46 host2 sshd[2208301]: Disconnected from invalid user ghost 36.95.221.140 port 41564 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 17 17:40:07 host2 sshd[2210602]: Disconnected from invalid user log 197.5.145.73 port 56387 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 17 17:42:34 host2 sshd[2211900]: Disconnected from invalid user newuser 197.5.145.73 port 56392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 17 17:43:57 host2 sshd[2212504]: Disconnected from invalid user zy 198.98.56.205 port 50188 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 17 17:44:24 host2 sshd[2212922]: Received disconnect from 197.5.145.73 port 56396:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.5.145.73
country_id: 2464461
description:
Dec 17 17:44:50 host2 sshd[2213128]: Disconnected from invalid user minecraft 197.5.145.73 port 56397 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 17 17:45:29 host2 sshd[2213881]: Disconnected from invalid user newuser 198.98.56.205 port 53768 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.103
country_id: 130758
description:
Dec 17 17:46:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 5 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.103, lip=66.85.158.91, session=<MBGAzyRGKrU+PIdn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 17:47:18 host2 sshd[2214904]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Dec 17 17:47:17 host2 sshd[2214885]: Disconnected from invalid user webadmin 219.92.8.45 port 51388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.152.174
country_id: 6252001
description:
2025-12-17 17:47:25 dovecot_login authenticator failed for (ADMIN) [102.129.152.174]:5155: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 17 17:47:32 host2 sshd[2214990]: Disconnected from invalid user postgres 198.98.56.205 port 39848 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 17:47:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<U4fB0iRG1p8+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.94.185
country_id: 2623032
description:
2025-12-17 17:48:31 dovecot_login authenticator failed for (ADMIN) [188.126.94.185]:13617: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 17 17:49:07 host2 sshd[2216097]: Received disconnect from 198.98.56.205 port 41526:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.103.234.89
country_id: 3996063
description:
Dec 17 17:49:10 host2 sshd[2216130]: Disconnected from invalid user deploy 201.103.234.89 port 47178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 219.92.8.45
country_id: 1733045
description:
Dec 17 17:48:57 host2 sshd[2215934]: Disconnected from invalid user tempuser 219.92.8.45 port 36564 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-17 17:50:34 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [136.232.73.130]:35744: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.56.205
country_id: 6252001
description:
Dec 17 17:49:42 host2 sshd[2216407]: Disconnected from invalid user cooper 198.98.56.205 port 57894 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2025-12-17 17:50:48 dovecot_login authenticator failed for ([201.219.68.189]) [201.219.68.189]:60004: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.103.234.89
country_id: 3996063
description:
Dec 17 17:52:32 host2 sshd[2218414]: Disconnected from invalid user sysuser 201.103.234.89 port 55838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.103.234.89
country_id: 3996063
description:
Dec 17 17:53:06 host2 sshd[2218705]: Disconnected from invalid user jenkins 201.103.234.89 port 51806 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 17:54:35 host2 sshd[2219672]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 18:01:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<0YHJBSVGnN0+PIcm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 17 18:03:03 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<ryOACyVGcIA+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-17 18:05:36 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:46079: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-17 18:05:48 dovecot_login authenticator failed for (cm-84.210.192.240.get.no) [84.210.192.240]:57417: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.86
country_id: 2077456
description:
2025-12-17 18:09:39 dovecot_login authenticator failed for (ADMIN) [179.61.228.86]:45797: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.11
country_id: 614540
description:
2025-12-17 18:11:39 dovecot_login authenticator failed for (ADMIN) [95.181.236.11]:17800: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 18:12:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<wIYeLSVGCuY+PIdp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.232
country_id: 6252001
description:
Dec 17 18:15:09 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.232, lip=66.85.158.92, TLS handshaking: Connection closed, session=<PNnvNiVG0ZrDuEzo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.238
country_id: 6252001
description:
Dec 17 18:15:20 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.238, lip=66.85.158.92, TLS: Connection closed, session=<pruYNyVGSYrDuEzu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.13
country_id: 6252001
description:
Dec 17 18:15:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=195.184.76.13, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<OTgIOCVGK77DuEwN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
country_id: 1819730
description:
2025-12-17 18:19:22 dovecot_login authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:56073: 535 Incorrect authentication data (set_id=lezzarotech.com@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-12-17 18:19:58 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:46880: 535 Incorrect authentication data (set_id=lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec 17 18:20:56 host2 pure-ftpd[2236285]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.164.42.102
country_id: 1643084
description:
2025-12-17 18:21:10 dovecot_login authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.164.42.102]:29446: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-17 18:21:53 dovecot_login authenticator failed for (189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:43683: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-12-17 18:23:18 dovecot_login authenticator failed for ([78.186.54.65]) [78.186.54.65]:44934: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2025-12-17 18:23:36 dovecot_login authenticator failed for ([47.247.80.227]) [14.195.19.75]:58062: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 18:25:41 host2 pure-ftpd[2238935]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Dec 17 18:27:42 host2 pure-ftpd[2239784]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-12-17 18:28:11 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:59334: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-17 18:28:48 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:49322: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.142.221
country_id: 3144096
description:
2025-12-17 18:28:57 dovecot_login authenticator failed for ([188.124.142.221]) [188.124.142.221]:33391: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.226.226
country_id: 6252001
description:
2025-12-17 18:29:15 dovecot_login authenticator failed for (ADMIN) [173.239.226.226]:32654: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 18:31:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<NqXFciVGOsI+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 18:32:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<ZhsWdSVG0Js+PIde>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.198.48
country_id: 6252001
description:
2025-12-17 18:33:32 dovecot_login authenticator failed for (ADMIN) [37.19.198.48]:41616: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Dec 17 18:35:08 host2 sshd[2244435]: Disconnected from invalid user clamav 138.68.104.233 port 56920 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.104.233
country_id: 2921044
description:
Dec 17 18:35:39 host2 sshd[2244803]: Disconnected from invalid user yash 138.68.104.233 port 42226 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 18:35:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<lQQngSVGSpE+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-12-17 18:36:23 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:52562: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.162.193
country_id: 6252001
description:
Dec 17 18:37:07 host2 pure-ftpd[2245697]: (?@165.154.162.193) [INFO] New connection from 165.154.162.193


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.31
country_id: 130758
description:
Dec 17 18:36:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.31, lip=66.85.158.91, session=<PAn/giVG4s8+PIcf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.59.221
country_id: 3144096
description:
2025-12-17 18:36:47 dovecot_login authenticator failed for ([84.215.59.221]) [84.215.59.221]:35121: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.162.193
country_id: 6252001
description:
Dec 17 18:37:26 host2 pure-ftpd[2245914]: (?@165.154.162.193) [INFO] New connection from 165.154.162.193


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 90.180.197.128
country_id: 3077311
description:
Dec 17 18:37:53 host2 sshd[2246206]: Disconnected from invalid user macro 90.180.197.128 port 51850 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.162.193
country_id: 6252001
description:
Dec 17 18:38:15 host2 pure-ftpd[2246486]: (?@165.154.162.193) [INFO] New connection from 165.154.162.193


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 90.180.197.128
country_id: 3077311
description:
Dec 17 18:39:41 host2 sshd[2247534]: Disconnected from invalid user jira 90.180.197.128 port 63887 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-12-17 18:40:49 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:33523: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-12-17 18:41:33 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:35075: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.50.151
country_id: 1168579
description:
2025-12-17 18:43:56 dovecot_login authenticator failed for ([203.124.50.151]) [203.124.50.151]:41743: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-12-17 18:44:32 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:16962: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.5
country_id: 1821275
description:
2025-12-17 18:47:49 dovecot_login authenticator failed for (ADMIN) [84.252.92.5]:57726: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-12-17 18:53:27 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:53274: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.235
country_id: 6252001
description:
Dec 17 18:54:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.235, lip=66.85.158.92, TLS: Connection closed, session=<6/MwxCVGDL1HBobr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
country_id: 1269750
description:
2025-12-17 18:54:58 dovecot_login authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:55023: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.160
country_id: 1733045
description:
2025-12-17 18:55:45 dovecot_login authenticator failed for ([49.124.154.160]) [49.124.154.160]:50160: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 18:56:26 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<V252yiVGwLw+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 18:58:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<3RZ00iVGzMA+PIdm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 19:02:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@rehanseo.online>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<0GNL3yVGOoQ+PIcd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.234.178.105
country_id: 3469034
description:
Dec 17 19:05:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=177.234.178.105, lip=66.85.158.91, TLS, session=<H++k6CVGpZOx6rJp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.150
country_id: 3865483
description:
Dec 17 19:04:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=179.0.250.150, lip=66.85.158.91, TLS, session=<dc9B5yVGE8qzAPqW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.26.147
country_id: 798544
description:
Dec 17 19:04:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=178.216.26.147, lip=66.85.158.91, TLS, session=<3FaF5yVGA4Ky2BqT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.107.86.63
country_id: 732800
description:
Dec 17 19:05:07 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers>, method=PLAIN, rip=109.107.86.63, lip=66.85.158.91, TLS, session=<bKed6CVGjelta1Y/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.202.110.50
country_id: 798544
description:
Dec 17 19:04:38 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=85.202.110.50, lip=66.85.158.91, TLS, session=<Rebk5iVGyKZVym4y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.25.219
country_id: 690791
description:
Dec 17 19:04:48 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<careers@v-deploy.com>, method=PLAIN, rip=176.103.25.219, lip=66.85.158.91, TLS, session=<1z+E5yVGlZ2wZxnb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.245.219.224
country_id: 6290252
description:
Dec 17 19:04:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=109.245.219.224, lip=66.85.158.91, TLS, session=<sof+5yVGEY5t9dvg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.223
country_id: 3175395
description:
Dec 17 19:05:06 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<careers>, method=PLAIN, rip=185.15.169.223, lip=66.85.158.91, TLS, session=<845+6CVGed65D6nf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-17 19:06:00 dovecot_login authenticator failed for (cm-46.212.118.138.get.no) [46.212.118.138]:51721: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-12-17 19:06:23 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:40302: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 19:08:14 host2 sshd[2269885]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 17 19:08:50 host2 sshd[2270121]: Disconnected from invalid user user 2.57.121.25 port 44577 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.153.124
country_id: 6252001
description:
2025-12-17 19:09:00 dovecot_login authenticator failed for (ADMIN) [102.129.153.124]:46337: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.73.171.250
country_id: 149590
description:
Dec 17 19:10:45 host2 sshd[2271469]: Disconnected from invalid user student2 154.73.171.250 port 22942 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.73.171.250
country_id: 149590
description:
Dec 17 19:11:35 host2 sshd[2272378]: Disconnected from invalid user sftp_user 154.73.171.250 port 62037 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 17 19:13:09 host2 sshd[2273231]: Disconnected from invalid user chris 12.156.67.18 port 37178 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Dec 17 19:13:53 host2 sshd[2273659]: Disconnected from invalid user runner 12.156.67.18 port 47082 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 17 19:14:32 host2 sshd[2273961]: Disconnected from invalid user builder 49.204.74.149 port 36570 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.182.132.154
country_id: 1269750
description:
Dec 17 19:15:33 host2 sshd[2274631]: Disconnected from invalid user runner 103.182.132.154 port 35316 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.2.146.184
country_id: 3865483
description:
Dec 17 19:15:43 host2 sshd[2274700]: Disconnected from invalid user gemini 181.2.146.184 port 36356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 17 19:17:07 host2 sshd[2275476]: Disconnected from invalid user teamspeak3 49.204.74.149 port 57498 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 17 19:18:24 host2 sshd[2276182]: Disconnected from invalid user zhenshan 49.204.74.149 port 53846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.26
country_id: 3703430
description:
2025-12-17 19:25:23 dovecot_login authenticator failed for (ADMIN) [91.90.126.26]:58548: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 19:26:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<2pRGNCZGdJ8+PIdm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.201.208
country_id: 1880251
description:
Dec 17 19:26:26 host2 sshd[2280851]: Disconnected from invalid user vivek 45.78.201.208 port 56570 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.32
country_id: 3625428
description:
2025-12-17 19:26:26 dovecot_login authenticator failed for (ADMIN) [95.181.237.32]:53218: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 19:29:27 host2 pure-ftpd[2282681]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 19:30:31 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<a7JbRCZGgrI+PIcg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 19:35:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<SG3UViZG+OY+PIMp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 19:36:25 host2 sshd[2287016]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.56
country_id: 6252001
description:
Dec 17 19:38:37 host2 pure-ftpd[2288346]: (?@167.94.146.56) [INFO] New connection from 167.94.146.56


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 19:42:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<b5xkbiZGItI+PIcm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 19:43:46 host2 sshd[2292241]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.148
country_id: 6252001
description:
2025-12-17 19:44:28 dovecot_login authenticator failed for (ADMIN) [191.96.37.148]:47509: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-12-17 19:45:20 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:43699: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-12-17 19:45:31 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:54523: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.138
country_id: 660013
description:
2025-12-17 19:49:23 dovecot_login authenticator failed for (ADMIN) [188.126.89.138]:52374: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 17 19:53:27 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.140, lip=66.85.158.91, TLS: Connection closed, session=<+JV7liZG6C5ChJmM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-12-17 19:53:52 dovecot_login authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:52535: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-12-17 19:54:13 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:53731: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 19:56:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<6u+zoSZGZI4+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.116
country_id: 1819730
description:
Dec 17 19:57:54 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.116, lip=66.85.158.92, TLS handshaking: Connection closed, session=<dyZlpiZG2Ictjpp0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 19:57:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<1FJFpCZGiOk+PIMh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 19:57:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<9YdHpCZGxt4+PIMp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 19:59:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<LWm0qiZG5IE+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-12-17 20:00:08 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:60236: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-12-17 20:00:24 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:52985: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 17 20:04:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<R8otvSZGKO0+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.34
country_id: 3625428
description:
2025-12-17 20:05:57 dovecot_login authenticator failed for (ADMIN) [95.181.237.34]:32862: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 20:06:27 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@venee.lk>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<uT/bxCZGztE+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 20:08:00 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<4XtnyiZGGow+PIcg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2025-12-17 20:11:07 dovecot_login authenticator failed for (177-174-0-3.user.vivozap.com.br) [177.174.0.3]:48458: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-17 20:10:52 dovecot_login authenticator failed for (cm-178.232.138.184.get.no) [178.232.138.184]:54711: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.44
country_id: 130758
description:
Dec 17 20:13:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.44, lip=66.85.158.91, session=<qN2y3SZGEqw+PIcs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.37.148.184
country_id: 286963
description:
2025-12-17 20:13:51 dovecot_plain authenticator failed for (JKJEX) [5.37.148.184]:2829: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.40
country_id: 130758
description:
Dec 17 20:14:53 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.40, lip=66.85.158.91, session=<swz64iZGMOQ+PIco>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.202
country_id: 3077311
description:
2025-12-17 20:15:42 dovecot_login authenticator failed for (ADMIN) [212.102.39.202]:1797: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.229
country_id: 3996063
description:
2025-12-17 20:18:09 dovecot_login authenticator failed for (201.173.92.229-clientes-izzi.mx) [201.173.92.229]:60565: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-12-17 20:18:21 dovecot_login authenticator failed for ([90.161.217.228]) [90.161.217.228]:52130: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 17 20:18:56 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<UwuA8SZGsKA+PIdq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.73
country_id: 3144096
description:
2025-12-17 20:19:03 dovecot_login authenticator failed for (73-161-97-62.cust.smartcall.no) [62.97.161.73]:46827: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.89.158
country_id: 1269750
description:
2025-12-17 20:19:25 dovecot_login authenticator failed for ([203.147.89.38]) [203.147.89.158]:57514: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.43
country_id: 2542007
description:
2025-12-17 20:20:00 dovecot_login authenticator failed for ([105.73.203.43]) [105.73.203.43]:53511: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-17 20:22:47 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:42184: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.228.23.212
country_id: 6252001
description:
2025-12-17 20:22:46 dovecot_plain authenticator failed for ec2-34-228-23-212.compute-1.amazonaws.com (EC2AMAZ-RT2IK6U.ec2.internal) [34.228.23.212]:58460: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-12-17 20:23:11 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:41384: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-12-17 20:23:26 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:60680: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-12-17 20:24:05 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:42650: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 20:24:08 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<s9cMBCdGaOk+PIdf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.153.24
country_id: 783754
description:
2025-12-17 20:24:13 dovecot_login authenticator failed for (ADMIN) [31.171.153.24]:12661: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.102
country_id: 1733045
description:
2025-12-17 20:24:43 dovecot_login authenticator failed for ([49.124.147.102]) [49.124.147.102]:60268: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2025-12-17 20:28:55 dovecot_plain authenticator failed for (zinalle) [31.141.216.143]:54374: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 20:31:41 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@mathsmotorcysle.xyz>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<CCURHydGZLE+PIM0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 20:33:21 host2 pure-ftpd[2324993]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.37
country_id: 3042225
description:
2025-12-17 20:34:53 dovecot_login authenticator failed for (ADMIN) [91.90.124.37]:57994: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:35:13 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<593bKydGksIDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.30
country_id: 130758
description:
Dec 17 20:35:19 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.135.30, lip=66.85.158.91, session=<Xk0WLCdGKoc+PIce>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:37:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<I35VMydGPuIDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.99
country_id: 130758
description:
Dec 17 20:37:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.99, lip=66.85.158.91, session=<cNd2NCdGVLc+PIdj>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 20:38:29 host2 sshd[2328790]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.73.148.20
country_id: 798549
description:
Dec 17 20:40:08 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=212.73.148.20, lip=66.85.158.92, session=<RtNnPSdGRsLUSZQU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:39:18 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<tBZ5OidGkswDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-12-17 20:40:52 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:42710: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 17 20:41:07 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<QL/TQCdGZOA+PIdo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:40:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<76sWPidGRo8DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 17 20:40:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<TTFKPidGEI4+PIdi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.241.4
country_id: 290557
description:
2025-12-17 20:41:21 dovecot_login authenticator failed for ([98.98.241.4]) [98.98.241.4]:33875: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:41:24 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<eZn6QSdGGLcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:42:25 host2 dovecot[1284858]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<ftGYRSdGnMADhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.95.160
country_id: 6251999
description:
2025-12-17 20:43:40 dovecot_login authenticator failed for (ADMIN) [149.22.95.160]:36852: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:43:43 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Z09BSidGwNkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 17 20:44:50 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<n+9ATidGyIYDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.126
country_id: 1819730
description:
Dec 17 20:45:22 host2 sshd[2333249]: Disconnected from invalid user test 123.58.213.126 port 43262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.104
country_id: 130758
description:
Dec 17 20:46:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.104, lip=66.85.158.91, session=<PyGrUydG0Mw+PIdo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 20:47:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<rc/UVidGVoo+PIcm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.51
country_id: 294640
description:
2025-12-17 20:47:59 dovecot_login authenticator failed for ([2.55.88.51]) [2.55.88.51]:45306: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 17 20:48:38 host2 sshd[2335605]: Disconnected from invalid user debian 36.66.16.233 port 41830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 17 20:49:21 host2 sshd[2336100]: Disconnected from invalid user vbox 36.66.16.233 port 54016 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 17 20:50:01 host2 sshd[2336396]: Disconnected from invalid user production 36.66.16.233 port 37964 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.87
country_id: 6252001
description:
Dec 17 20:52:04 host2 pure-ftpd[2337861]: (?@147.185.132.87) [INFO] New connection from 147.185.132.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-17 20:53:54 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49476: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.15
country_id: 2658434
description:
2025-12-17 20:57:04 dovecot_login authenticator failed for (ADMIN) [158.173.152.15]:2432: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.66.16.233
country_id: 1643084
description:
Dec 17 20:56:14 host2 sshd[2340867]: Disconnected from invalid user alba 36.66.16.233 port 34710 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 20:59:39 host2 sshd[2342236]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 17 21:01:17 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS: Connection closed, session=<AtcViSdGJtZChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.52
country_id: 6252001
description:
Dec 17 21:02:10 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.52, lip=66.85.158.91, TLS: Connection closed, session=<WFE6jCdGCDinXpI0>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.126
country_id: 1819730
description:
Dec 17 21:05:59 host2 sshd[2348801]: Disconnected from invalid user tes 123.58.213.126 port 46904 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.52.110
country_id: 6251999
description:
2025-12-17 21:06:01 dovecot_login authenticator failed for (ADMIN) [212.56.52.110]:36711: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 21:06:24 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<Y1o1mydGLsY+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:09:32 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Zt+MpidGttADgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.149.139
country_id: 2750405
description:
Dec 17 21:10:15 host2 sshd[2352100]: Disconnected from invalid user postgres 51.158.149.139 port 58172 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.98
country_id: 130758
description:
Dec 17 21:10:18 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.98, lip=66.85.158.91, session=<C70oqSdGDsY+PIdi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.149.139
country_id: 2750405
description:
Dec 17 21:11:35 host2 sshd[2353024]: Disconnected from invalid user lab 51.158.149.139 port 55492 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:12:09 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<67furydGNNUDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.94
country_id: 130758
description:
Dec 17 21:12:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=62.60.135.94, lip=66.85.158.91, session=<v4NfsSdGENE+PIde>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 21:13:05 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@lankaherbalsolutions.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<bMoqsydG/rI+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:13:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9DEVtCdGnLYDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.9
country_id: 1605651
description:
Dec 17 21:13:37 host2 sshd[2354482]: Disconnected from invalid user sam 122.155.223.9 port 37333 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 17 21:13:51 host2 sshd[2354701]: Disconnected from invalid user test6 23.95.128.167 port 49548 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:14:26 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<bo0buCdG/MkDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.20.157
country_id: 2750405
description:
2025-12-17 21:14:40 dovecot_login authenticator failed for (ADMIN) [158.173.20.157]:39736: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 21:14:47 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@essenceceylontea.com>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<+KAluSdGHLg+PIcd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.55.87.153
country_id: 6252001
description:
Dec 17 21:15:20 host2 sshd[2356033]: Disconnected from invalid user peter 45.55.87.153 port 33742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.159.149
country_id: 6252001
description:
Dec 17 21:15:35 host2 sshd[2356223]: Disconnected from invalid user beehive 192.3.159.149 port 35116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 17 21:16:08 host2 sshd[2356692]: Disconnected from invalid user mark 103.82.240.194 port 36972 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:16:40 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<up0QwCdGDpEDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 21:17:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<zdMxxCdGcqw+PIcl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:17:19 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<iEJswidGANIDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.159.149
country_id: 6252001
description:
Dec 17 21:17:33 host2 sshd[2358072]: Disconnected from invalid user azureuser 192.3.159.149 port 38828 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 17 21:17:49 host2 sshd[2358285]: Disconnected from invalid user user1 103.82.240.194 port 36672 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Dec 17 21:18:32 host2 sshd[2358909]: Disconnected from invalid user azureuser 103.82.240.194 port 51138 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:18:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<6L1RyCdGDJ0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:19:20 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5AaaySdGkNEDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 17 21:19:24 host2 sshd[2359600]: Disconnected from invalid user ccserver 23.95.128.167 port 59576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-12-17 21:19:34 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:32948: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.159.149
country_id: 6252001
description:
Dec 17 21:19:36 host2 sshd[2359724]: Disconnected from invalid user ftpUser 192.3.159.149 port 60192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.122.89.119
country_id: 1733045
description:
Dec 17 21:20:28 host2 sshd[2360774]: Disconnected from invalid user azureuser 121.122.89.119 port 65358 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 23.95.128.167
country_id: 6252001
description:
Dec 17 21:21:06 host2 sshd[2361447]: Disconnected from invalid user test10 23.95.128.167 port 54388 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.76.135.162
country_id: 6252001
description:
2025-12-17 21:20:12 dovecot_login authenticator failed for 149-76-135-162.fidnet.com [149.76.135.162]:55926: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.155.223.9
country_id: 1605651
description:
Dec 17 21:20:26 host2 sshd[2360719]: Disconnected from invalid user wekan 122.155.223.9 port 9216 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:21:11 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<+p450CdGGOQDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.97.44.51
country_id: 3175395
description:
Dec 17 21:22:17 host2 sshd[2362637]: Disconnected from invalid user tomcatuser 62.97.44.51 port 42890 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:22:30 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<1Pbq1CdGTIsDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.212.34.237
country_id: 3895114
description:
Dec 17 21:22:46 host2 sshd[2363016]: Disconnected from invalid user g 181.212.34.237 port 18576 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 21:22:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<ng2C1idGNL0+PIM0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 17 21:24:46 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=</g4S3SdG0rQDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 21:25:33 host2 sshd[2365636]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.40
country_id: 2635167
description:
Dec 17 21:25:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.211.40, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<yoJH4CdGM8Qjy9Mo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.122.89.119
country_id: 1733045
description:
Dec 17 21:25:59 host2 sshd[2365942]: Disconnected from invalid user steam 121.122.89.119 port 22860 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:26:30 host2 pure-ftpd[2366575]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.40
country_id: 2635167
description:
Dec 17 21:26:39 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=35.203.211.40, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<dlzN4ydGcPEjy9Mo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.40
country_id: 2635167
description:
Dec 17 21:27:11 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 25 secs): user=<>, rip=35.203.211.40, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<72Cy5SdGduQjy9Mo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:27:36 host2 pure-ftpd[2367837]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:27:39 host2 pure-ftpd[2367877]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:28:08 host2 pure-ftpd[2368532]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:28:08 host2 pure-ftpd[2368528]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.29
country_id: 3042058
description:
2025-12-17 21:28:32 dovecot_login authenticator failed for (ADMIN) [91.90.122.29]:25642: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:29:08 host2 pure-ftpd[2369821]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:29:09 host2 pure-ftpd[2369845]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 21:29:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@ceylondigest.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<8ZPP7CdG6K0+PIdf>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:30:09 host2 pure-ftpd[2371074]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:30:08 host2 pure-ftpd[2371059]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:31:10 host2 pure-ftpd[2372135]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.38
country_id: 130758
description:
Dec 17 21:31:55 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.38, lip=66.85.158.91, session=<AQeC9idG5IY+PIcm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.40
country_id: 2635167
description:
Dec 17 21:31:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.211.40, lip=66.85.158.91, TLS, session=<ch/F9idGjOwjy9Mo>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:31:08 host2 pure-ftpd[2372110]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 21:32:54 host2 sshd[2373781]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:32:08 host2 pure-ftpd[2373238]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 190.171.108.25
country_id: 3624060
description:
Dec 17 21:32:08 host2 pure-ftpd[2373251]: (?@190.171.108.25) [INFO] New connection from 190.171.108.25


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.140.141.211
country_id: 2542007
description:
2025-12-17 21:32:15 dovecot_plain authenticator failed for ([192.168.1.111]) [41.140.141.211]:22530: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 21:34:07 host2 pure-ftpd[2374389]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-17 21:34:32 dovecot_login authenticator failed for ([46.212.127.128]) [46.212.127.128]:54368: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.105
country_id: 130758
description:
Dec 17 21:34:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.135.105, lip=66.85.158.91, session=<tltpAShGnpg+PIdp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2025-12-17 21:34:15 dovecot_login authenticator failed for ([101.168.17.20]) [101.168.17.20]:47236: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-17 21:35:51 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:58809: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.210.91
country_id: 2750405
description:
2025-12-17 21:36:37 H=([158.94.210.91]) [158.94.210.91]:57122 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<info@a05techhub.com> rejected RCPT <accounts@bostonlanka.com>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-17 21:37:53 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:54384: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-12-17 21:38:06 dovecot_login authenticator failed for ([213.230.64.246]) [213.230.64.246]:42692: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 21:37:51 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<2q+8CyhG8LY+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.159.132
country_id: 3865483
description:
2025-12-17 21:39:10 dovecot_login authenticator failed for ([190.185.159.132]) [190.185.159.132]:44523: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-12-17 21:39:20 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:37711: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.28
country_id: 130758
description:
Dec 17 21:40:32 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.28, lip=66.85.158.91, session=<6ipJFShG/rw+PIcc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.174.234
country_id: 1269750
description:
2025-12-17 21:41:59 dovecot_login authenticator failed for ([103.165.174.234]) [103.165.174.234]:58187: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.197.74.150
country_id: 1269750
description:
2025-12-17 21:41:17 dovecot_plain authenticator failed for (GXA8DC) [103.197.74.150]:22073: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.37
country_id: 130758
description:
Dec 17 21:41:28 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.37, lip=66.85.158.91, session=<BjqfGChGhr0+PIcl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.26
country_id: 6252001
description:
2025-12-17 21:42:09 dovecot_login authenticator failed for ([70.174.168.26]) [70.174.168.26]:53163: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.52
country_id: 130758
description:
Dec 17 21:45:59 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=62.60.131.52, lip=66.85.158.91, session=<HIHKKChGvOg+PIM0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.24
country_id: 6290252
description:
2025-12-17 21:46:11 dovecot_login authenticator failed for (ADMIN) [37.46.115.24]:45404: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.107
country_id: 6252001
description:
2025-12-17 21:46:49 dovecot_login authenticator failed for (ADMIN) [158.173.153.107]:47697: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Dec 17 21:51:44 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8Ux7PShGypRBMQHK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.202
country_id: 6252001
description:
Dec 17 21:52:17 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.202, lip=66.85.158.92, TLS: Connection closed, session=<32N0PyhG8hNBMQHK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-12-17 21:52:29 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:53502: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-17 21:53:14 dovecot_login authenticator failed for ([152.52.224.26]) [152.52.224.26]:38866: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.41
country_id: 130758
description:
Dec 17 21:56:02 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.131.41, lip=66.85.158.91, session=<Bp3CTChGRtc+PIMp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.242.243
country_id: 6252001
description:
2025-12-17 22:03:34 dovecot_login authenticator failed for wsip-184-191-242-243.fv.ks.cox.net [184.191.242.243]:59476: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.38
country_id: 2542007
description:
2025-12-17 22:03:46 dovecot_login authenticator failed for (ADMIN) [95.181.232.38]:6704: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.205.76
country_id: 1605651
description:
2025-12-17 22:03:48 dovecot_login authenticator failed for ([103.206.205.76]) [103.206.205.76]:52976: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.4
country_id: 2635167
description:
Dec 17 22:04:12 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.211.4, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<nbcXaihGfMwjy9ME>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.4
country_id: 2635167
description:
Dec 17 22:05:13 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.211.4, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<aWy1bShGuuEjy9ME>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.125.162.32
country_id: 718075
description:
Dec 17 22:08:41 host2 sshd[2410885]: Disconnected from invalid user proxyuser 79.125.162.32 port 55428 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.42.104.13
country_id: 6252001
description:
Dec 17 22:08:59 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.42.104.13, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<iY4teyhG3tUUKmgN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 17 22:09:10 host2 sshd[2411191]: Disconnected from invalid user dasusr1 125.20.16.22 port 45562 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 17 22:10:40 host2 sshd[2412407]: Disconnected from invalid user summer 125.20.16.22 port 36826 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.50
country_id: 6252001
description:
Dec 17 22:11:01 host2 pure-ftpd[2412669]: (?@205.210.31.50) [INFO] New connection from 205.210.31.50


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.35.119.129
country_id: 3175395
description:
Dec 17 22:10:29 host2 sshd[2412315]: Disconnected from invalid user ftp_user 151.35.119.129 port 22409 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.125.162.32
country_id: 718075
description:
Dec 17 22:10:31 host2 sshd[2412331]: Disconnected from invalid user smp 79.125.162.32 port 56876 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.102
country_id: 130758
description:
Dec 17 22:10:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.102, lip=66.85.158.91, session=<Yly6gChGAqs+PIdm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.4
country_id: 2635167
description:
Dec 17 22:11:42 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.4, lip=66.85.158.92, TLS, session=<M7bjhChGDPgjy9ME>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Dec 17 22:14:22 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, session=<L3VsjihGYv64aYtG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.20.16.22
country_id: 1269750
description:
Dec 17 22:14:46 host2 sshd[2415454]: Disconnected from invalid user ubuntu 125.20.16.22 port 28550 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.155
country_id: 6251999
description:
2025-12-17 22:17:00 dovecot_login authenticator failed for (ADMIN) [66.56.80.155]:16420: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 17 22:17:40 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<7bEYmihG0tzBHmEh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.35.119.129
country_id: 3175395
description:
Dec 17 22:18:50 host2 sshd[2418358]: Disconnected from invalid user user2 151.35.119.129 port 22779 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.33
country_id: 130758
description:
Dec 17 22:18:36 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@kiriaswanu.com>, method=PLAIN, rip=62.60.131.33, lip=66.85.158.91, session=<7dF4nShGBMk+PIMh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-12-17 22:19:23 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:43904: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-17 22:19:51 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:57451: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
country_id: 294640
description:
2025-12-17 22:20:02 dovecot_login authenticator failed for ([185.246.255.183]) [185.246.255.183]:37291: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.92.234
country_id: 3996063
description:
2025-12-17 22:20:19 dovecot_login authenticator failed for (201.173.92.234-clientes-izzi.mx) [201.173.92.234]:35862: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.43
country_id: 130758
description:
Dec 17 22:20:34 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.43, lip=66.85.158.91, session=<e2B+pChG+sI+PIcr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-17 22:23:05 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:33732: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.243.234.23
country_id: 6252001
description:
2025-12-17 22:22:52 dovecot_login authenticator failed for c-73-243-234-23.hsd1.co.comcast.net [73.243.234.23]:39840: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.37
country_id: 3703430
description:
2025-12-17 22:24:00 dovecot_login authenticator failed for (ADMIN) [91.90.126.37]:59566: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.202.231.158
country_id: 6252001
description:
Dec 17 22:24:25 host2 pure-ftpd[2422510]: (?@44.202.231.158) [INFO] New connection from 44.202.231.158


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.35.119.129
country_id: 3175395
description:
Dec 17 22:25:33 host2 sshd[2423523]: Disconnected from invalid user wikijs 151.35.119.129 port 22377 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2025-12-17 22:28:44 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:57172: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-12-17 22:28:58 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:55195: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.35.119.129
country_id: 3175395
description:
Dec 17 22:29:15 host2 sshd[2425963]: Disconnected from invalid user bkp 151.35.119.129 port 22496 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.32
country_id: 130758
description:
Dec 17 22:29:50 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@nsteeleng.com>, method=PLAIN, rip=62.60.135.32, lip=66.85.158.91, session=<lDWBxShGMos+PIcg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 17 22:31:12 host2 sshd[2427728]: Disconnected from invalid user ts3 103.56.30.33 port 59510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 17 22:36:33 host2 sshd[2431874]: Disconnected from invalid user stats 103.56.30.33 port 54314 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 17 22:36:47 host2 pure-ftpd[2432059]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.199
country_id: 798544
description:
2025-12-17 22:36:51 dovecot_login authenticator failed for (ADMIN) [138.199.59.199]:46388: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.145
country_id: 3017382
description:
Dec 17 22:37:38 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 17 secs): user=<>, rip=91.196.152.145, lip=66.85.158.91, TLS: Connection closed, session=<uu2j4ShGbeVbxJiR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.164
country_id: 3017382
description:
Dec 17 22:37:48 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.164, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<DwdA4ihGoetbxJik>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.149
country_id: 3017382
description:
Dec 17 22:37:52 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.149, lip=66.85.158.91, TLS: Connection closed, session=<81N64ihGYZVbxJiV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 17 22:37:13 host2 sshd[2432324]: Disconnected from invalid user admin 103.56.30.33 port 56924 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.163
country_id: 3017382
description:
Dec 17 22:37:21 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.196.152.163, lip=66.85.158.91, TLS handshaking: Connection closed, session=<7+ih4ChGYYlbxJij>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2025-12-17 22:38:16 dovecot_login authenticator failed for (nsg-corporate-50.101.185.122.airtel.in) [122.185.101.50]:55222: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2025-12-17 22:38:35 dovecot_login authenticator failed for (200-168-190-81.jandaia.com) [200.159.14.187]:37548: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Dec 17 22:38:38 host2 sshd[2433190]: Disconnected from invalid user myuser 103.56.30.33 port 43258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.123.118
country_id: 1269750
description:
2025-12-17 22:40:38 dovecot_login authenticator failed for ([122.184.123.118]) [122.184.123.118]:41732: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-12-17 22:40:55 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:58710: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.95
country_id: 130758
description:
Dec 17 22:41:25 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@seyawin.com>, method=PLAIN, rip=62.60.135.95, lip=66.85.158.91, session=<6OoO7yhGGpk+PIdf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.29
country_id: 130758
description:
Dec 17 22:44:14 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@dataesite.lk>, method=PLAIN, rip=62.60.135.29, lip=66.85.158.91, session=<FZkV+ShG9MI+PIcd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.102.9
country_id: 290557
description:
2025-12-17 22:46:39 dovecot_login authenticator failed for (ADMIN) [146.70.102.9]:65182: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.108
country_id: 130758
description:
Dec 17 22:46:58 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=62.60.135.108, lip=66.85.158.91, session=<T4XbAilG4Mg+PIds>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.206.51
country_id: 3144096
description:
2025-12-17 22:49:05 dovecot_login authenticator failed for (cm-178.232.206.51.get.no) [178.232.206.51]:40205: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2025-12-17 22:49:29 dovecot_login authenticator failed for ([37.25.36.197]) [37.25.36.197]:34936: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 22:51:41 host2 sshd[2444207]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-12-17 22:53:47 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:43744: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-17 22:53:21 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:44804: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Dec 17 22:54:48 host2 sshd[2446833]: Disconnected from invalid user dss 103.28.57.98 port 30945 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.106
country_id: 130758
description:
Dec 17 22:56:22 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@sivagnanamfoundation.com>, method=PLAIN, rip=62.60.135.106, lip=66.85.158.91, session=<HmN4JClGDuo+PIdq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.28.57.98
country_id: 1643084
description:
Dec 17 22:57:07 host2 sshd[2449097]: Disconnected from invalid user dls 103.28.57.98 port 45465 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 17 22:58:53 host2 sshd[2450377]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.28.57.98
country_id: 1643084
description:
Dec 17 22:58:20 host2 sshd[2450042]: Disconnected from invalid user alex 103.28.57.98 port 57258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 17 22:58:48 host2 sshd[2450333]: Disconnected from invalid user dev 58.98.199.45 port 59038 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.91.246.101
country_id: 1269750
description:
Dec 17 23:00:15 host2 sshd[2451443]: Disconnected from invalid user ftpuser 103.91.246.101 port 33012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.135
country_id: 1562822
description:
2025-12-17 23:01:10 dovecot_login authenticator failed for (ADMIN) [173.239.247.135]:13686: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Dec 17 23:02:57 host2 sshd[2453881]: Disconnected from invalid user sabina 107.150.104.184 port 45752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 17 23:04:05 host2 sshd[2455405]: Disconnected from invalid user runner 58.98.199.45 port 47722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.52.86
country_id: 6252001
description:
Dec 17 23:03:31 host2 sshd[2454764]: Disconnected from invalid user debianuser 107.174.52.86 port 41596 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.208.253.156
country_id: 130758
description:
Dec 17 23:03:49 host2 sshd[2455175]: Disconnected from invalid user vbox 85.208.253.156 port 39764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.156
country_id: 130758
description:
Dec 17 23:04:22 host2 sshd[2455624]: Disconnected from invalid user alex 85.208.253.156 port 36542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec 17 23:06:33 host2 sshd[2457539]: Disconnected from invalid user dd 45.78.224.109 port 40566 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.67
country_id: 6252001
description:
Dec 17 23:06:54 host2 pure-ftpd[2457750]: (?@184.105.139.67) [INFO] New connection from 184.105.139.67


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 17 23:08:15 host2 sshd[2458615]: Disconnected from invalid user tauro 58.98.199.45 port 58922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Dec 17 23:08:31 host2 sshd[2458793]: Disconnected from invalid user ftpuser 107.150.104.184 port 60372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Dec 17 23:08:45 host2 sshd[2458928]: Disconnected from invalid user akash 186.233.204.9 port 48734 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.229.24
country_id: 3194884
description:
2025-12-17 23:08:49 dovecot_login authenticator failed for (ADMIN) [176.125.229.24]:12425: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec 17 23:10:02 host2 sshd[2459742]: Disconnected from invalid user sftpuser 45.78.224.109 port 43092 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.233.204.9
country_id: 3469034
description:
Dec 17 23:10:04 host2 sshd[2459944]: Disconnected from invalid user sa 186.233.204.9 port 60250 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Dec 17 23:09:24 host2 sshd[2459370]: Disconnected from invalid user bitrix 186.233.204.9 port 37232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.98.199.45
country_id: 1861060
description:
Dec 17 23:09:40 host2 sshd[2459555]: Disconnected from invalid user test 58.98.199.45 port 55886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.52.86
country_id: 6252001
description:
Dec 17 23:11:37 host2 sshd[2461142]: Disconnected from invalid user administrator 107.174.52.86 port 59356 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.73
country_id: 6252001
description:
Dec 17 23:14:16 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.73, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8hauZClGQ39BMQFJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Dec 17 23:14:35 host2 dovecot[1284858]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.66, lip=66.85.158.92, TLS handshaking: Connection closed, session=<t1jEZSlGJO5BMQFC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.203.233
country_id: 6251999
description:
Dec 17 23:14:58 host2 dovecot[1284858]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.203.233, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<X80uZylGeKaAy8vp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.233.204.9
country_id: 3469034
description:
Dec 17 23:14:12 host2 sshd[2463431]: Disconnected from invalid user gandalf 186.233.204.9 port 40502 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2025-12-17 23:15:17 dovecot_login authenticator failed for (nsg-corporate-50.101.185.122.airtel.in) [122.185.101.50]:34790: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.174.52.86
country_id: 6252001
description:
Dec 17 23:15:18 host2 sshd[2464674]: Disconnected from invalid user sftpuser 107.174.52.86 port 56610 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.164.251.182
country_id: 6252001
description:
2025-12-17 23:15:41 dovecot_login authenticator failed for 216-164-251-182.s9140.c3-0.eas-cbr4.atw-eas.pa.cable.rcncustomer.com [216.164.251.182]:59974: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.109
country_id: 1880251
description:
Dec 17 23:23:31 host2 sshd[2470962]: Disconnected from invalid user debianuser 45.78.224.109 port 37950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.220
country_id: 2658434
description:
2025-12-17 23:24:55 dovecot_login authenticator failed for (ADMIN) [158.173.152.220]:17287: 535 Incorrect authentication data (set_id=info@colperlab.com)


