# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.234
country_id: 6252001
description:
Dec 21 00:00:40 host2 sshd[1571320]: Disconnected from invalid user cloud 216.133.148.234 port 45084 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.133.148.234
country_id: 6252001
description:
Dec 21 00:01:44 host2 sshd[1572055]: Disconnected from invalid user django 216.133.148.234 port 37844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.133.148.234
country_id: 6252001
description:
Dec 21 00:02:51 host2 sshd[1572719]: Disconnected from invalid user larry 216.133.148.234 port 47772 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 216.133.148.234
country_id: 6252001
description:
Dec 21 00:03:23 host2 sshd[1573141]: Disconnected from invalid user indra 216.133.148.234 port 52852 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 00:06:42 host2 sshd[1575615]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2025-12-21 00:09:32 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [128.185.220.90]:59740: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.120.148.19
country_id: 1733045
description:
2025-12-21 00:10:00 dovecot_login authenticator failed for H=([121.120.148.19]) [121.120.148.19]:47298: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 00:14:19 host2 pure-ftpd[1581095]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.46.226.34
country_id: 6252001
description:
Dec 21 00:15:24 host2 dovecot[1321837]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.46.226.34, lip=66.85.158.92, TLS, session=<zdjLmGZGMO4ULuIi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-12-21 00:22:38 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:54960: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 00:21:52 host2 sshd[1586315]: Disconnected from invalid user admin 2.57.121.112 port 30516 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.211.157
country_id: 357994
description:
2025-12-21 00:23:21 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.211.157]:41630: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.215.132
country_id: 3144096
description:
2025-12-21 00:24:16 dovecot_login authenticator failed for H=([127.0.0.1]) [84.210.215.132]:39898: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.76
country_id: 2186224
description:
2025-12-21 00:24:38 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.168.76]:43810: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-21 00:32:33 dovecot_plain authenticator failed for H=c-73-197-194-98.hsd1.nj.comcast.net (ranicte) [73.197.194.98]:52946: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 35.90.49.98
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 35.90.49.98: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.197.167
country_id: 6252001
description:
Dec 21 00:40:35 host2 pure-ftpd[1598051]: (?@64.62.197.167) [INFO] New connection from 64.62.197.167


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 00:47:04 host2 sshd[1600861]: Disconnected from invalid user  2.57.121.25 port 23757 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.170
country_id: 6252001
description:
Dec 21 00:49:59 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.170, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MZKBFGdGjLgUQcGq>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.123.85.122
country_id: 1269750
description:
[2025-12-21 00:51:18 +0530] info [webmaild] 27.123.85.122 - info@ajsstarlog.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.175.151.48
country_id: 130758
description:
Dec 21 00:54:20 host2 sshd[1605644]: Disconnected from invalid user u1 79.175.151.48 port 41004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.175.151.48
country_id: 130758
description:
Dec 21 00:53:45 host2 sshd[1604962]: Disconnected from invalid user hadoop 79.175.151.48 port 33438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.63.103
country_id: 3144096
description:
2025-12-21 00:56:06 dovecot_login authenticator failed for H=([127.0.0.1]) [84.215.63.103]:46924: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.165.30.206
country_id: 1269750
description:
2025-12-21 00:56:14 dovecot_login authenticator failed for H=([127.0.0.1]) [103.165.30.206]:12855: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.205.37
country_id: 1168579
description:
2025-12-21 00:57:03 dovecot_login authenticator failed for H=([113.203.205.37]) [113.203.205.37]:53573: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-21 00:57:38 dovecot_login authenticator failed for H=(1522312565.colombiatel.co) [152.231.25.64]:37432: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 00:57:49 host2 sshd[1608555]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2025-12-21 01:00:22 dovecot_login authenticator failed for H=([101.168.17.20]) [101.168.17.20]:43612: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-12-21 01:00:36 dovecot_login authenticator failed for H=([61.12.86.92]) [61.12.86.90]:55514: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.8.174
country_id: 1522867
description:
2025-12-21 01:01:30 dovecot_plain authenticator failed for H=37.150.8.174.dynamic.telecom.kz (chiricon) [37.150.8.174]:39708: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.227.137.48
country_id: 2921044
description:
Dec 21 01:01:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.227.137.48, lip=66.85.158.91, session=<rF3yPWdGG7Sl44kw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Dec 21 01:01:35 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.107, lip=66.85.158.92, session=<W3P4PWdG7J9APsVr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.82.30
country_id: 2921044
description:
Dec 21 01:01:36 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.82.30, lip=66.85.158.91, TLS, session=<qNYDPmdGACmGelIe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.171.132
country_id: 2921044
description:
Dec 21 01:01:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.171.132, lip=66.85.158.91, session=<amT/PWdGXkWkXKuE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.82.30
country_id: 2921044
description:
Dec 21 01:01:37 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=134.122.82.30, lip=66.85.158.91, session=<AEcYPmdGCimGelIe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.107
country_id: 6252001
description:
Dec 21 01:01:49 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.197.107, lip=66.85.158.92, TLS: Connection closed, session=<YvvGPmdGhjZAPsVr>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 01:16:39 host2 pure-ftpd[1620392]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 3.137.193.222
country_id: 6252001
description:
[2025-12-21 01:19:18 +0530] info [cpaneld] 3.137.193.222 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 21 01:18:56 host2 sshd[1622004]: Disconnected from invalid user user 167.71.204.253 port 57218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 21 01:20:17 host2 sshd[1623164]: Disconnected from invalid user hduser 167.71.204.253 port 50582 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 21 01:21:00 host2 sshd[1623588]: Disconnected from invalid user alex 167.71.204.253 port 52548 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.204.253
country_id: 1880251
description:
Dec 21 01:22:14 host2 sshd[1624356]: Disconnected from invalid user linuxuser 167.71.204.253 port 56272 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-21 01:24:07 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:42704: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 01:25:51 host2 sshd[1626728]: Disconnected from invalid user  2.57.121.25 port 31176 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 21 01:27:27 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<4zZammdGnL0+PIdr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-21 01:29:34 dovecot_plain authenticator failed for H=c-76-16-7-82.hsd1.il.comcast.net (pleanviad) [76.16.7.82]:49590: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.105.51
country_id: 6252001
description:
Dec 21 01:30:29 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.169.105.51, lip=66.85.158.91, TLS handshaking: Connection closed, session=</XJNpWdGissUqWkz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.231
country_id: 6252001
description:
Dec 21 01:36:15 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.231, lip=66.85.158.91, TLS, session=<nlL2uWdGRvmTuYTn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.2
country_id: 6252001
description:
Dec 21 01:37:53 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 3 secs): user=<>, rip=198.235.24.2, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<HELEv2dGGN3G6xgC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2025-12-21 01:44:17 dovecot_login authenticator failed for H=([196.188.187.205]) [196.188.187.205]:49654: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2025-12-21 01:44:40 dovecot_login authenticator failed for H=([149.54.62.22]) [149.54.62.22]:52887: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-12-21 01:45:07 dovecot_plain authenticator failed for H=(orine) [24.187.213.29]:46882: 535 Incorrect authentication data (set_id=simple-engineering@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Dec 21 01:47:13 host2 sshd[1640852]: Disconnected from invalid user ec2-user 181.123.136.11 port 35706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Dec 21 01:50:41 host2 sshd[1643225]: Disconnected from invalid user umar 201.217.12.57 port 53112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.46.61
country_id: 1269750
description:
Dec 21 01:51:17 host2 sshd[1643592]: Disconnected from invalid user ali 122.160.46.61 port 58384 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.217.12.57
country_id: 3437598
description:
Dec 21 01:51:31 host2 sshd[1643716]: Disconnected from invalid user steam 201.217.12.57 port 52680 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.82.208.178
country_id: 2245662
description:
Dec 21 01:52:14 host2 sshd[1644105]: Disconnected from invalid user pivpn 41.82.208.178 port 56780 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Dec 21 01:52:45 host2 sshd[1644393]: Disconnected from invalid user vyos 51.83.46.40 port 58680 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.82
country_id: 6252001
description:
Dec 21 01:52:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.82, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<iUMY9WdGVNnG6xhS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.82.208.178
country_id: 2245662
description:
Dec 21 01:53:05 host2 sshd[1644619]: Disconnected from invalid user guest 41.82.208.178 port 6709 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.83.46.40
country_id: 3017382
description:
Dec 21 01:53:44 host2 sshd[1645064]: Disconnected from invalid user ton 51.83.46.40 port 41098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 21 01:53:57 host2 sshd[1645185]: Disconnected from invalid user testuser 162.240.156.34 port 54242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.83.46.40
country_id: 3017382
description:
Dec 21 01:54:38 host2 sshd[1646062]: Disconnected from invalid user bobo 51.83.46.40 port 49644 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.156.34
country_id: 6252001
description:
Dec 21 01:55:06 host2 sshd[1646542]: Disconnected from invalid user linuxadmin 162.240.156.34 port 53998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.160.46.61
country_id: 1269750
description:
Dec 21 01:55:19 host2 sshd[1646718]: Disconnected from invalid user ton 122.160.46.61 port 51046 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 01:55:41 host2 sshd[1647061]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 21 01:55:52 host2 sshd[1647144]: Disconnected from invalid user emmalee 62.60.131.157 port 39158 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 142.93.27.16
country_id: 6252001
description:
Dec 21 01:56:09 host2 sshd[1647326]: Disconnected from invalid user developer 142.93.27.16 port 34116 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 142.93.27.16
country_id: 6252001
description:
Dec 21 01:55:39 host2 sshd[1647030]: Disconnected from invalid user centos 142.93.27.16 port 39530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 01:57:59 host2 sshd[1648314]: Disconnected from invalid user admin 2.57.121.25 port 11229 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.217.12.57
country_id: 3437598
description:
Dec 21 02:00:10 host2 sshd[1650129]: Disconnected from invalid user code 201.217.12.57 port 37652 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.120.182
country_id: 3144096
description:
2025-12-21 02:02:22 dovecot_login authenticator failed for H=(cm-178.232.120.182.get.no) [178.232.120.182]:59206: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2025-12-21 02:02:35 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:49792: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.123.136.11
country_id: 3437598
description:
Dec 21 02:02:43 host2 sshd[1652168]: Disconnected from invalid user test 181.123.136.11 port 54912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-21 02:04:24 dovecot_login authenticator failed for H=bl14-230-132.dsl.telepac.pt [85.247.230.132]:44062: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.173
country_id: 1643084
description:
Dec 21 02:07:12 host2 sshd[1656169]: Disconnected from invalid user usman 182.253.156.173 port 45652 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 182.253.156.173
country_id: 1643084
description:
Dec 21 02:07:43 host2 sshd[1656502]: Received disconnect from 182.253.156.173 port 46534:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-21 02:07:55 dovecot_login authenticator failed for H=([128.185.231.6]) [128.185.231.6]:37972: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-21 02:08:18 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:37207: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.19
country_id: 1880251
description:
Dec 21 02:17:56 host2 sshd[1665534]: Disconnected from invalid user victor 45.78.224.19 port 39020 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 02:18:55 host2 pure-ftpd[1666695]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2025-12-21 02:26:25 dovecot_login authenticator failed for H=([85.159.165.216]) [85.159.165.216]:45073: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.219
country_id: 1733045
description:
2025-12-21 02:26:02 dovecot_login authenticator failed for H=([49.124.152.219]) [49.124.152.219]:46148: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 21 02:44:21 host2 sshd[1686439]: Disconnected from invalid user reza 192.3.105.24 port 49424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 21 02:44:56 host2 sshd[1686862]: Disconnected from invalid user deleteme 192.3.105.24 port 49488 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 02:46:30 host2 sshd[1688418]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.3.105.24
country_id: 6252001
description:
Dec 21 02:46:00 host2 sshd[1688091]: Disconnected from invalid user aa 192.3.105.24 port 49616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 21 02:46:18 host2 sshd[1688296]: Disconnected from invalid user username 172.200.228.35 port 52022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Dec 21 02:46:49 host2 sshd[1688563]: Disconnected from invalid user pp 45.202.211.6 port 49338 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.202.211.6
country_id: 1819730
description:
Dec 21 02:48:23 host2 sshd[1689417]: Disconnected from invalid user ankit 45.202.211.6 port 44774 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 21 02:48:26 host2 sshd[1689484]: Disconnected from invalid user ubuntu 172.200.228.35 port 39452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.59.156.47
country_id: 6252001
description:
Dec 21 02:48:01 host2 sshd[1689255]: Disconnected from invalid user reza 34.59.156.47 port 42502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.59.156.47
country_id: 6252001
description:
Dec 21 02:49:24 host2 sshd[1690183]: Disconnected from invalid user sysadmin 34.59.156.47 port 34708 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.200.228.35
country_id: 6252001
description:
Dec 21 02:51:50 host2 sshd[1692056]: Disconnected from invalid user casa 172.200.228.35 port 43694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.202.211.6
country_id: 1819730
description:
Dec 21 02:51:51 host2 sshd[1692050]: Disconnected from invalid user ubuntu 45.202.211.6 port 46978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.59.156.47
country_id: 6252001
description:
Dec 21 02:52:12 host2 sshd[1692269]: Disconnected from invalid user testuser 34.59.156.47 port 49030 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.59.156.47
country_id: 6252001
description:
Dec 21 02:54:09 host2 sshd[1693680]: Disconnected from invalid user elk 34.59.156.47 port 34854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Dec 21 02:55:47 host2 sshd[1694966]: Disconnected from invalid user mike 59.98.148.5 port 40330 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-21 02:58:07 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (rases) [174.161.27.82]:59387: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-21 03:00:19 dovecot_login authenticator failed for H=([180.94.75.102]) [180.94.75.102]:41205: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-12-21 03:00:36 dovecot_login authenticator failed for H=([190.67.106.221]) [190.67.106.221]:44720: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.230
country_id: 6252001
description:
Dec 21 03:01:08 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.230, lip=66.85.158.91, TLS, session=<RVSA6WhGWrtHBobm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-12-21 03:11:04 dovecot_plain authenticator failed for H=c-67-173-58-47.hsd1.il.comcast.net (chenon) [67.173.58.47]:40062: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.181.61.83
country_id: 1269750
description:
Dec 21 03:13:36 host2 sshd[1706262]: Disconnected from invalid user esuser 223.181.61.83 port 30763 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-21 03:14:37 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (obiablitus) [71.224.169.28]:33696: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 21 03:15:23 host2 sshd[1707485]: Disconnected from invalid user drcomadmin 158.178.141.16 port 39706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-21 03:17:23 dovecot_login authenticator failed for H=([182.78.240.94]) [182.78.240.94]:43038: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.202.82.102
country_id: 1861060
description:
2025-12-21 03:17:42 dovecot_login authenticator failed for H=fp5cca5266.gifg408.ap.nuro.jp [92.202.82.102]:34982: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 223.181.61.83
country_id: 1269750
description:
Dec 21 03:18:39 host2 sshd[1709752]: Disconnected from invalid user admin 223.181.61.83 port 25598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 21 03:18:44 host2 sshd[1709814]: Disconnected from invalid user ubuntu 158.178.141.16 port 11696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.142.151.19
country_id: 298795
description:
Dec 21 03:18:57 host2 sshd[1709938]: Disconnected from invalid user respaldo 213.142.151.19 port 34972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 21 03:19:28 host2 sshd[1710230]: Disconnected from invalid user tomcat 158.178.141.16 port 28976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.181.61.83
country_id: 1269750
description:
Dec 21 03:19:35 host2 sshd[1710291]: Disconnected from invalid user ftptest 223.181.61.83 port 23531 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.121.43
country_id: 3144096
description:
2025-12-21 03:19:44 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.121.43]:38895: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.121.43
country_id: 3144096
description:
2025-12-21 03:19:54 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.121.43]:38972: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.36.82
country_id: 1210997
description:
2025-12-21 03:20:05 dovecot_login authenticator failed for H=([127.0.0.1]) [49.0.36.82]:53476: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 03:20:34 host2 sshd[1711105]: Disconnected from invalid user admin 2.57.121.25 port 55089 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.213.195.144
country_id: 1269750
description:
Dec 21 03:20:44 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.213.195.144, lip=66.85.158.91, TLS, session=<SalXLmlGloNn1cOQ>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.178.141.16
country_id: 2077456
description:
Dec 21 03:20:06 host2 sshd[1710745]: Disconnected from invalid user upload 158.178.141.16 port 16142 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.229
country_id: 6252001
description:
Dec 21 03:20:22 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.229, lip=66.85.158.92, session=<MhlPLmlGVv+s7OTl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 223.181.61.83
country_id: 1269750
description:
Dec 21 03:20:25 host2 sshd[1711028]: Disconnected from invalid user test01 223.181.61.83 port 31884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.253
country_id: 3469034
description:
Dec 21 03:21:04 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=191.53.128.253, lip=66.85.158.91, TLS, session=<p6i2L2lG/ty/NYD9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 03:21:11 host2 pure-ftpd[1711632]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-21 03:21:32 dovecot_login authenticator failed for H=(201.173.86.13-clientes-izzi.mx) [201.173.86.13]:42186: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-21 03:20:54 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:51739: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.80.243
country_id: 6252001
description:
Dec 21 03:21:59 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.33.80.243, lip=66.85.158.92, session=<l54PNGlGbPItIVDz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.107
country_id: 3144096
description:
2025-12-21 03:25:04 dovecot_login authenticator failed for H=([84.211.12.107]) [84.211.12.107]:55663: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-12-21 03:25:20 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [65.191.211.33]:57332: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.104
country_id: 3996063
description:
2025-12-21 03:25:41 dovecot_login authenticator failed for H=(201.173.216.104-clientes-izzi.mx) [201.173.216.104]:44183: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2025-12-21 03:27:55 dovecot_login authenticator failed for H=(fGR0Yt9ai) [45.92.33.82]:53514: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 45.92.33.82
country_id: 390903
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[45.92.33.82] [Authentication Database]=[mail] [Username]=[info@ceylondigest.com] (5/5 failures) (blocked until [Sat Dec 20 22:13:36 2025 UTC/Sun Dec 21 03:43:36 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-21 03:30:11 dovecot_login authenticator failed for H=([128.185.223.36]) [182.95.178.122]:42770: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-21 03:30:31 dovecot_login authenticator failed for H=(cm-84.213.189.159.get.no) [84.213.189.159]:58895: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.104
country_id: 3865483
description:
Dec 21 03:40:10 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=45.238.107.104, lip=66.85.158.91, TLS, session=<VZ3Zc2lGaLct7mto>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.126
country_id: 226074
description:
Dec 21 03:40:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 35 secs): user=<gihan>, method=PLAIN, rip=196.0.10.126, lip=66.85.158.91, TLS, session=<vN+MdWlGfLPEAAp+>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.199
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.199: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 03:43:55 host2 sshd[1726253]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-12-21 03:47:17 dovecot_login authenticator failed for H=([125.20.231.225]) [128.185.231.6]:49766: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-12-21 03:48:22 dovecot_login authenticator failed for H=(nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:51167: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 03:58:25 host2 sshd[1739318]: Disconnected from invalid user admin 2.57.121.25 port 46071 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-21 04:01:33 dovecot_login authenticator failed for H=(cm-178.232.138.184.get.no) [178.232.138.184]:47365: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.55.55
country_id: 6252001
description:
[2025-12-21 04:01:41 +0530] info [cpaneld] 157.230.55.55 - info@cloudtourssrilanka.com "POST /login HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.55.55
country_id: 6252001
description:
[2025-12-21 04:01:52 +0530] info [webmaild] 157.230.55.55 - info@cloudtourssrilanka.com "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-12-21 04:01:55 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com [34.41.211.48]:46682: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.55.198
country_id: 6252001
description:
2025-12-21 04:01:58 dovecot_plain authenticator failed for H=([178.16.55.198]) [178.16.55.198]:49291: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 21 04:10:38 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=176.32.195.85, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sccS4mlGdeqwIMNV>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 149.102.232.115
country_id: 3057568
description:
Dec 21 04:15:59 host2 pure-ftpd[1756496]: (?@149.102.232.115) [INFO] New connection from 149.102.232.115


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec 21 04:17:31 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS: Connection closed, session=<ccqr+mlGHtxChJl6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.28.108.165
country_id: 953987
description:
Dec 21 04:22:17 host2 sshd[1763704]: Disconnected from invalid user www 105.28.108.165 port 57674 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 04:23:29 host2 pure-ftpd[1764780]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.28.108.165
country_id: 953987
description:
Dec 21 04:24:45 host2 sshd[1765580]: Disconnected from invalid user postgres 105.28.108.165 port 39016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 21 04:25:28 host2 sshd[1766266]: Disconnected from invalid user ftp1 118.194.231.208 port 33806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.28.108.165
country_id: 953987
description:
Dec 21 04:25:33 host2 sshd[1766328]: Disconnected from invalid user simone 105.28.108.165 port 52882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 21 04:27:21 host2 sshd[1767619]: Disconnected from invalid user backupuser 118.194.231.208 port 33888 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 21 04:28:02 host2 sshd[1768011]: Disconnected from invalid user devops 118.194.231.208 port 33954 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.194.231.208
country_id: 1861060
description:
Dec 21 04:28:37 host2 sshd[1768459]: Disconnected from invalid user www 118.194.231.208 port 34014 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.178
country_id: 1269750
description:
2025-12-21 04:30:12 dovecot_login authenticator failed for H=([128.185.197.178]) [128.185.197.178]:40850: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.202
country_id: 1149361
description:
2025-12-21 04:30:32 dovecot_login authenticator failed for H=([180.94.75.202]) [180.94.75.202]:41702: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 04:30:38 host2 sshd[1770556]: Disconnected from invalid user  2.57.121.25 port 10358 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.31.197.108
country_id: 6252001
description:
2025-12-21 04:30:57 dovecot_login authenticator failed for H=(173-31-197-108.client.mchsi.com) [173.31.197.108]:48224: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2025-12-21 04:32:03 dovecot_login authenticator failed for H=([188.126.240.80]) [188.126.240.80]:35574: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-12-21 04:32:15 dovecot_login authenticator failed for H=(126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:46262: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 04:34:38 host2 sshd[1773058]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.213
country_id: 6252001
description:
Dec 21 04:34:27 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.213, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<1GdAN2pGn8yTuYTV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 04:37:09 host2 sshd[1774831]: Disconnected from invalid user admin 2.57.121.25 port 21924 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.114.64
country_id: 2921044
description:
Dec 21 04:39:04 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=159.65.114.64, lip=66.85.158.91, session=<cdnCR2pGkyGfQXJA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.252.2
country_id: 2921044
description:
Dec 21 04:39:05 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=164.92.252.2, lip=66.85.158.91, session=<JgrNR2pG6BWkXPwC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.111.143.93
country_id: 6252001
description:
[2025-12-21 04:40:55 +0530] info [webmaild] 192.111.143.93 - info@neotechlk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.241.189.22
country_id: 1861060
description:
2025-12-21 04:42:22 dovecot_login authenticator failed for H=202.241.189.22.ap.gmobb-fix.jp [202.241.189.22]:53217: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-12-21 04:43:16 dovecot_login authenticator failed for H=([128.185.223.219]) [27.123.111.114]:35946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.27.184
country_id: 6252001
description:
Dec 21 04:43:33 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.83.27.184, lip=66.85.158.92, TLS handshaking: Connection closed, session=<7f3EV2pGHKYUUxu4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.148.87
country_id: 1605651
description:
2025-12-21 04:46:10 dovecot_login authenticator failed for H=([110.77.148.87]) [110.77.148.87]:60996: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-21 04:46:26 dovecot_login authenticator failed for H=(cm-178.232.185.189.get.no) [178.232.185.189]:50314: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.6.111
country_id: 690791
description:
Dec 21 04:48:06 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=176.103.6.111, lip=66.85.158.91, TLS, session=<OEDuZmpGrO2wZwZv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.163
country_id: 3175395
description:
Dec 21 04:48:26 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=185.15.171.163, lip=66.85.158.91, TLS, session=<P2VGaGpGvZi5D6uj>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.245
country_id: 2635167
description:
Dec 21 04:48:49 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 9 secs): user=<>, rip=185.247.137.245, lip=66.85.158.91, TLS, session=<S5OkampGS9e594n1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-21 04:53:15 dovecot_login authenticator failed for H=(cm-178.232.30.170.get.no) [178.232.30.170]:59820: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.93
country_id: 99237
description:
2025-12-21 04:54:02 dovecot_login authenticator failed for H=([65.20.250.93]) [65.20.250.93]:37593: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.185.81
country_id: 6252001
description:
Dec 21 05:01:39 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.83.185.81, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<hsuAmGpGdMIUU7lR>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.4.138.132
country_id: 3608932
description:
[2025-12-21 05:02:22 +0530] info [cpaneld] 45.4.138.132 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.253.19.17
country_id: 3686110
description:
[2025-12-21 05:02:24 +0530] info [cpaneld] 190.253.19.17 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.66.122.221
country_id: 6252001
description:
[2025-12-21 05:02:25 +0530] info [cpaneld] 75.66.122.221 - host2 "GET /login/?login_only=1&user=host2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.8.209.239
country_id: 6252001
description:
[2025-12-21 05:02:32 +0530] info [cpaneld] 172.8.209.239 - host "GET /login/?login_only=1&user=host&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.69.163.191
country_id: 290291
description:
[2025-12-21 05:02:30 +0530] info [cpaneld] 77.69.163.191 - host2phenomhostcom "GET /login/?login_only=1&user=host2phenomhostcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user host2phenomhostcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.77.198.212
country_id: 3617476
description:
[2025-12-21 05:02:36 +0530] info [cpaneld] 186.77.198.212 - ho "GET /login/?login_only=1&user=ho&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.8.224.226
country_id: 3895114
description:
[2025-12-21 05:02:35 +0530] info [cpaneld] 179.8.224.226 - hos "GET /login/?login_only=1&user=hos&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user hos (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.134.2.213
country_id: 1168579
description:
[2025-12-21 05:02:28 +0530] info [whostmgrd] 103.134.2.213 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.19.183.202
country_id: 1269750
description:
[2025-12-21 05:05:03 +0530] info [webmaild] 125.19.183.202 - info@ayuzonelanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.85.104.2
country_id: 6252001
description:
2025-12-21 05:07:10 dovecot_plain authenticator failed for H=(hyshic) [96.85.104.2]:56652: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec 21 05:06:55 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: Connection closed, session=<bBBZq2pG1ilChJly>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 05:08:27 host2 sshd[1794668]: Disconnected from invalid user  2.57.121.25 port 43929 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-12-21 05:12:23 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:53306: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 21 05:11:46 host2 sshd[1797254]: Disconnected from invalid user nami 187.210.77.100 port 56310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.207.18.113
country_id: 1861060
description:
Dec 21 05:12:14 host2 sshd[1797521]: Disconnected from invalid user alex 172.207.18.113 port 59454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.2
country_id: 1149361
description:
2025-12-21 05:12:45 dovecot_login authenticator failed for H=([149.54.62.2]) [149.54.62.2]:50355: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.207.18.113
country_id: 1861060
description:
Dec 21 05:12:52 host2 sshd[1797925]: Disconnected from invalid user nami 172.207.18.113 port 32920 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Dec 21 05:12:54 host2 sshd[1797947]: Disconnected from invalid user user 185.158.22.150 port 11568 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-12-21 05:12:56 dovecot_login authenticator failed for H=([65.20.175.75]) [65.20.175.75]:46843: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.79.92
country_id: 2921044
description:
Dec 21 05:13:14 host2 sshd[1798237]: Disconnected from invalid user alicia 68.183.79.92 port 49192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.154.90.114
country_id: 3686110
description:
Dec 21 05:13:15 host2 sshd[1798242]: Disconnected from invalid user rahul 186.154.90.114 port 58094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Dec 21 05:14:17 host2 sshd[1798881]: Disconnected from invalid user s 35.199.95.142 port 56160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 1819730
description:
Dec 21 05:14:25 host2 sshd[1798974]: Disconnected from invalid user no-reply 156.245.239.180 port 52466 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-21 05:13:40 dovecot_login authenticator failed for H=([189.57.81.137]) [186.201.54.90]:35092: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-12-21 05:13:59 dovecot_login authenticator failed for H=32.104.29.34.bc.googleusercontent.com [34.29.104.32]:48970: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.12.159
country_id: 3144096
description:
2025-12-21 05:14:41 dovecot_login authenticator failed for H=(cm-84.211.12.159.get.no) [84.211.12.159]:36949: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.154.90.114
country_id: 3686110
description:
Dec 21 05:14:52 host2 sshd[1799485]: Disconnected from invalid user user 186.154.90.114 port 51320 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Dec 21 05:14:38 host2 sshd[1799126]: Disconnected from invalid user admin 117.216.143.31 port 37550 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 67.10.185.103
country_id: 6252001
description:
Dec 21 05:14:45 host2 sshd[1799337]: Disconnected from invalid user myappuser 67.10.185.103 port 52930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.255.75.252
country_id: 1269750
description:
Dec 21 05:15:21 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.255.75.252, lip=66.85.158.91, TLS, session=<AsRpyGpGcI1n/0v8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.245
country_id: 3469034
description:
Dec 21 05:15:42 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.53.128.245, lip=66.85.158.91, TLS, session=<j2CjyWpGQN+/NYD1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.79.92
country_id: 2921044
description:
Dec 21 05:15:52 host2 sshd[1800496]: Disconnected from invalid user tester 68.183.79.92 port 48306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 21 05:16:00 host2 sshd[1800579]: Disconnected from invalid user informix 36.37.122.175 port 53230 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-12-21 05:16:25 dovecot_login authenticator failed for H=([152.52.92.105]) [152.52.192.74]:44618: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.199.95.142
country_id: 3469034
description:
Dec 21 05:15:33 host2 sshd[1800342]: Disconnected from invalid user peter 35.199.95.142 port 51782 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.118
country_id: 1733045
description:
2025-12-21 05:16:51 dovecot_login authenticator failed for H=([49.124.147.118]) [49.124.147.118]:40106: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 21 05:17:23 host2 sshd[1801399]: Disconnected from invalid user alex 36.37.122.175 port 58208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 21 05:16:43 host2 sshd[1801013]: Disconnected from invalid user kube 36.37.122.175 port 60056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.154.90.114
country_id: 3686110
description:
Dec 21 05:16:49 host2 sshd[1801088]: Disconnected from invalid user admin 186.154.90.114 port 47546 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.199.223
country_id: 3144096
description:
2025-12-21 05:17:09 dovecot_login authenticator failed for H=(cm-178.232.199.223.get.no) [178.232.199.223]:51439: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 21 05:17:23 host2 pure-ftpd[1801408]: (?@176.32.195.85) [INFO] New connection from 176.32.195.85


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 1819730
description:
Dec 21 05:17:52 host2 sshd[1801684]: Disconnected from invalid user mamad 156.245.239.180 port 56498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.37.122.175
country_id: 1643084
description:
Dec 21 05:18:04 host2 sshd[1801819]: Disconnected from invalid user rocky 36.37.122.175 port 45230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Dec 21 05:18:11 host2 sshd[1801874]: Disconnected from invalid user kube 117.216.143.31 port 48184 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.127
country_id: 6252001
description:
Dec 21 05:17:49 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.127, lip=66.85.158.91, TLS: Connection closed, session=<pGFO0mpGtL3HLZp/>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 21 05:18:14 host2 pure-ftpd[1801922]: (?@176.32.195.85) [INFO] New connection from 176.32.195.85


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.154.90.114
country_id: 3686110
description:
Dec 21 05:18:46 host2 sshd[1802194]: Disconnected from invalid user resource 186.154.90.114 port 43768 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.62.124
country_id: 6252001
description:
Dec 21 05:19:16 host2 sshd[1802468]: Disconnected from invalid user administrator 209.141.62.124 port 49264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 21 05:18:27 host2 sshd[1802011]: Disconnected from invalid user kube 103.186.1.120 port 60512 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.22.150
country_id: 99237
description:
Dec 21 05:18:41 host2 sshd[1802154]: Disconnected from invalid user alexa 185.158.22.150 port 2086 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 21 05:19:08 host2 sshd[1802403]: Disconnected from invalid user ftp_user 187.210.77.100 port 58796 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.22.150
country_id: 99237
description:
Dec 21 05:19:47 host2 sshd[1802743]: Disconnected from invalid user immc 185.158.22.150 port 24988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.62.124
country_id: 6252001
description:
Dec 21 05:20:11 host2 sshd[1803228]: Disconnected from invalid user deployment 209.141.62.124 port 33092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.154.90.114
country_id: 3686110
description:
Dec 21 05:20:38 host2 sshd[1803712]: Disconnected from invalid user admin1 186.154.90.114 port 39980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 1819730
description:
Dec 21 05:20:40 host2 sshd[1803735]: Disconnected from invalid user william 156.245.239.180 port 54782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 21 05:20:27 host2 sshd[1803464]: Disconnected from invalid user prince 103.186.1.120 port 54728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-12-21 05:21:38 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:49408: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-12-21 05:21:52 dovecot_login authenticator failed for H=([182.95.178.158]) [182.95.178.158]:57756: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.210.77.100
country_id: 3996063
description:
Dec 21 05:23:07 host2 sshd[1805828]: Disconnected from invalid user rocky 187.210.77.100 port 50726 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 21 05:23:29 host2 sshd[1806002]: Disconnected from invalid user odoo 45.78.223.75 port 45724 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.75
country_id: 1880251
description:
Dec 21 05:24:39 host2 sshd[1806852]: Disconnected from invalid user pentest 45.78.223.75 port 42374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 21 05:25:12 host2 sshd[1807359]: Disconnected from invalid user nami 103.186.1.120 port 38122 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.134
country_id: 3469034
description:
Dec 21 05:25:37 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=177.44.71.134, lip=66.85.158.91, TLS, session=<lTEL7WpGSKixLEeG>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 05:25:42 host2 pure-ftpd[1807945]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec 21 05:25:52 host2 sshd[1808028]: Disconnected from invalid user rocky 103.186.1.120 port 44516 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.123.186
country_id: 690791
description:
Dec 21 05:25:58 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=91.228.123.186, lip=66.85.158.91, TLS, session=<e8Rc7mpGLYJb5Hu6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.216.143.31
country_id: 1269750
description:
Dec 21 05:26:54 host2 sshd[1808607]: Disconnected from invalid user ionguest 117.216.143.31 port 60976 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 05:32:02 host2 sshd[1812242]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Dec 21 05:35:38 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=167.94.146.63, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<o+UFEmtGtFenXpI/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 05:36:27 host2 sshd[1816272]: Disconnected from invalid user admin 2.57.121.112 port 58912 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.112.128.12
country_id: 2017370
description:
[2025-12-21 05:37:53 +0530] info [webmaild] 37.112.128.12 - info@tradeceylon.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.183
country_id: 6252001
description:
Dec 21 05:40:22 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.183, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<nur+ImtGTszG6xi3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.183
country_id: 3144096
description:
2025-12-21 05:43:35 dovecot_login authenticator failed for H=(cm-84.213.189.183.get.no) [84.213.189.183]:59997: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2025-12-21 05:43:53 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se [155.4.31.215]:45434: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 05:45:56 host2 sshd[1824853]: Disconnected from invalid user  2.57.121.25 port 14568 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-12-21 05:46:33 dovecot_login authenticator failed for H=115.150.48.116.static.netvigator.com [116.48.150.115]:59189: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.47
country_id: 2186224
description:
2025-12-21 05:48:59 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.163.47]:34424: 535 Incorrect authentication data (set_id=inf@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.102.42.179
country_id: 390903
description:
2025-12-21 05:49:06 dovecot_login authenticator failed for H=([127.0.0.1]) [147.102.42.179]:40510: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-21 05:52:15 dovecot_login authenticator failed for H=217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:52139: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-12-21 05:52:28 dovecot_login authenticator failed for H=(29.92.zcomnetworks.com.pk) [103.148.92.29]:39718: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.252.18
country_id: 1269750
description:
2025-12-21 05:56:05 dovecot_login authenticator failed for H=([61.95.203.89]) [125.20.252.18]:51292: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.80.9
country_id: 3144096
description:
2025-12-21 05:56:26 dovecot_login authenticator failed for H=([178.232.80.9]) [178.232.80.9]:56526: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-12-21 06:00:50 dovecot_login authenticator failed for H=([182.78.240.94]) [182.78.240.94]:39282: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.103.80.92
country_id: 1210997
description:
[2025-12-21 06:06:14 +0530] info [cpaneld] 117.103.80.92 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 06:16:53 host2 sshd[1849127]: Disconnected from invalid user admin 2.57.121.112 port 41044 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.36.34.200
country_id: 6252001
description:
[2025-12-21 06:20:47 +0530] info [whostmgrd] 73.36.34.200 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 06:22:38 host2 sshd[1853562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.25
country_id: 798549
description:
Dec 21 06:23:19 host2 sshd[1854019]: Disconnected from invalid user admin 2.57.121.25 port 33659 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.23.68
country_id: 3144096
description:
2025-12-21 06:23:52 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.23.68]:44181: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.51.185
country_id: 3144096
description:
2025-12-21 06:23:35 dovecot_login authenticator failed for H=([127.0.0.1]) [84.215.51.185]:47763: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 06:27:52 host2 pure-ftpd[1857461]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-12-21 06:28:36 dovecot_login authenticator failed for H=([192.34.164.13]) [192.34.164.13]:7319: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.98.103.162
country_id: 6290252
description:
[2025-12-21 06:29:10 +0530] info [webmaild] 141.98.103.162 - hr@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.61.4.185
country_id: 1269750
description:
2025-12-21 06:30:19 dovecot_login authenticator failed for H=([127.0.0.1]) [171.61.4.185]:46794: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-12-21 06:29:27 dovecot_login authenticator failed for H=([125.19.175.152]) [182.78.241.102]:38058: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 21 06:29:25 host2 sshd[1858864]: Disconnected from invalid user maxim 103.139.59.214 port 35378 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 21 06:32:26 host2 sshd[1861158]: Disconnected from invalid user chris 103.139.59.214 port 47214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.132.245.209
country_id: 953987
description:
Dec 21 06:31:30 host2 sshd[1860439]: Disconnected from invalid user fan 102.132.245.209 port 43608 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 21 06:31:50 host2 sshd[1860679]: Disconnected from invalid user appadmin 103.139.59.214 port 36312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.51.214.98
country_id: 1643084
description:
Dec 21 06:33:51 host2 sshd[1862374]: Disconnected from invalid user chris 202.51.214.98 port 34212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.132.245.209
country_id: 953987
description:
Dec 21 06:33:30 host2 sshd[1862036]: Disconnected from invalid user install 102.132.245.209 port 53366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.59.214
country_id: 1269750
description:
Dec 21 06:33:37 host2 sshd[1862135]: Disconnected from invalid user kim 103.139.59.214 port 40856 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.98
country_id: 1643084
description:
Dec 21 06:34:33 host2 sshd[1863191]: Disconnected from invalid user flora 202.51.214.98 port 47972 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 21 06:35:33 host2 sshd[1864368]: Disconnected from invalid user appadmin 34.66.72.251 port 33608 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 21 06:36:10 host2 sshd[1864952]: Disconnected from invalid user marcus 34.66.72.251 port 47384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Dec 21 06:36:35 host2 sshd[1865305]: Disconnected from invalid user jean 34.66.72.251 port 53450 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.69.9.148
country_id: 1269750
description:
Dec 21 06:38:27 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.69.9.148, lip=66.85.158.91, TLS, session=<iTyU8WtGDMdnRQmU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.126
country_id: 3865483
description:
Dec 21 06:38:53 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info>, method=PLAIN, rip=179.0.250.126, lip=66.85.158.91, TLS, session=<8Fvf8mtG4rKzAPp+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-12-21 06:39:07 dovecot_plain authenticator failed for H=c-73-129-57-71.hsd1.md.comcast.net (fideminke) [73.129.57.71]:56608: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.214.212
country_id: 3144096
description:
2025-12-21 06:41:04 dovecot_login authenticator failed for H=([127.0.0.1]) [84.210.214.212]:57390: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.218.47
country_id: 3144096
description:
2025-12-21 06:40:58 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.218.47]:51270: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2025-12-21 06:54:25 dovecot_plain authenticator failed for H=(magmeisted) [75.97.190.237]:52075: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.63.103
country_id: 3144096
description:
2025-12-21 06:59:52 dovecot_login authenticator failed for H=([127.0.0.1]) [84.215.63.103]:42416: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.127.153
country_id: 3144096
description:
2025-12-21 07:00:12 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.127.153]:38256: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-12-21 07:01:51 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (sentrily) [73.0.191.33]:51364: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.57
country_id: 6252001
description:
Dec 21 07:07:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.57, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<wiHoW2xGFNvN0h85>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-12-21 07:14:26 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [90.173.78.90]:60161: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-12-21 07:15:21 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:45106: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-21 07:17:48 dovecot_login authenticator failed for H=([125.16.31.25]) [152.52.236.122]:39500: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 2.136.115.209
country_id: 2510769
description:
Dec 21 07:21:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=2.136.115.209, lip=66.85.158.91, TLS, session=<5BDliWxGCL4CiHPR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 143.244.175.50
country_id: 6252001
description:
Dec 21 07:20:42 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=143.244.175.50, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<8sLFiWxG2t6P9K8y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.192.205.23
country_id: 798544
description:
Dec 21 07:20:42 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.192.205.23, lip=66.85.158.91, TLS, session=</GHPiGxGBahbwM0X>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 208.109.235.18
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 208.109.235.18: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Dec 21 07:22:10 host2 sshd[1904560]: Disconnected from invalid user gustavo 89.116.31.97 port 60584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Dec 21 07:26:25 host2 sshd[1907690]: Disconnected from invalid user server 89.116.31.97 port 46726 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-12-21 07:28:58 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.86]:41158: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.116.31.97
country_id: 3017382
description:
Dec 21 07:28:20 host2 sshd[1909057]: Disconnected from invalid user comercial 89.116.31.97 port 40628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.42.225.40
country_id: 2510769
description:
2025-12-21 07:28:28 dovecot_login authenticator failed for H=40.red-81-42-225.staticip.rima-tde.net [81.42.225.40]:37160: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.219.138.28
country_id: 3996063
description:
2025-12-21 07:30:02 dovecot_login authenticator failed for H=(189.219.138.28-clientes-izzi.mx) [189.219.138.28]:41662: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-21 07:29:43 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:40867: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 07:30:15 host2 pure-ftpd[1910636]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.31.97
country_id: 3017382
description:
Dec 21 07:32:15 host2 sshd[1912031]: Disconnected from invalid user novinhost 89.116.31.97 port 44962 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.67
country_id: 6252001
description:
Dec 21 07:38:50 host2 pure-ftpd[1916855]: (?@205.210.31.67) [INFO] New connection from 205.210.31.67


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Dec 21 07:39:07 host2 sshd[1917163]: Disconnected from invalid user ts3server 212.154.234.9 port 63141 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.154.234.9
country_id: 1522867
description:
Dec 21 07:39:45 host2 sshd[1917730]: Disconnected from invalid user yann 212.154.234.9 port 38737 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.154.234.9
country_id: 1522867
description:
Dec 21 07:40:21 host2 sshd[1918434]: Disconnected from invalid user sentry 212.154.234.9 port 20419 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2025-12-21 07:41:36 dovecot_login authenticator failed for H=([184.151.88.27]) [184.151.88.27]:42621: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-12-21 07:41:15 dovecot_login authenticator failed for H=mail.sotus.co.th [171.100.156.38]:46701: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.110.96
country_id: 3144096
description:
2025-12-21 07:42:14 dovecot_login authenticator failed for H=(cm-84.215.110.96.get.no) [84.215.110.96]:37904: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.116.247.31
country_id: 1522867
description:
2025-12-21 07:42:58 dovecot_login authenticator failed for H=([212.116.247.31]) [212.116.247.31]:39756: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-21 07:44:54 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (rebenouned) [68.46.148.180]:43298: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-12-21 07:50:42 dovecot_login authenticator failed for H=([85.133.161.162]) [85.133.161.162]:36902: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-12-21 07:51:03 dovecot_login authenticator failed for H=(57.92.zcomnetworks.com.pk) [103.148.92.57]:41834: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-21 07:58:29 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:39994: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.177
country_id: 1733045
description:
2025-12-21 07:59:01 dovecot_login authenticator failed for H=([49.124.155.177]) [49.124.155.177]:36052: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 21 07:59:22 host2 sshd[1932205]: Disconnected from invalid user ftpuser 103.117.57.134 port 53012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.221.74.234
country_id: 226074
description:
Dec 21 08:02:23 host2 sshd[1934416]: Disconnected from invalid user ubnt 45.221.74.234 port 56260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 21 08:04:17 host2 sshd[1935821]: Disconnected from invalid user hadoop 103.117.57.134 port 51618 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 21 08:04:57 host2 sshd[1936150]: Disconnected from invalid user linuxtest 103.117.57.134 port 33122 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.221.74.234
country_id: 226074
description:
Dec 21 08:05:20 host2 sshd[1936661]: Disconnected from invalid user ubuntu 45.221.74.234 port 36988 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 21 08:05:36 host2 sshd[1936821]: Disconnected from invalid user esearch 103.117.57.134 port 46134 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.221.74.234
country_id: 226074
description:
Dec 21 08:06:47 host2 sshd[1937439]: Disconnected from invalid user brijesh 45.221.74.234 port 33880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.117.57.134
country_id: 1643084
description:
Dec 21 08:06:15 host2 sshd[1937163]: Disconnected from invalid user dev 103.117.57.134 port 57438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-21 08:06:34 dovecot_login authenticator failed for H=(syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:52704: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.153.135.104
country_id: 6252001
description:
[2025-12-21 08:09:01 +0530] info [whostmgrd] 76.153.135.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-21 08:12:37 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:50584: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.211.157
country_id: 357994
description:
2025-12-21 08:12:52 dovecot_login authenticator failed for H=([41.65.118.172]) [154.177.211.157]:34910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 149.102.232.115
country_id: 3057568
description:
Dec 21 08:26:23 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=149.102.232.115, lip=66.85.158.91, TLS handshaking: Connection closed, session=<mnK4dG1G6q+VZuhz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.134.213.171
country_id: 2510769
description:
Dec 21 08:26:23 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.134.213.171, lip=66.85.158.91, TLS, session=<hEi4dG1G9q8thtWr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.112.19.69
country_id: 660013
description:
Dec 21 08:26:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=212.112.19.69, lip=66.85.158.91, TLS handshaking: Connection closed, session=<fxm5dG1GQsHUcBNF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 173.239.201.11
country_id: 1605651
description:
Dec 21 08:26:23 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=173.239.201.11, lip=66.85.158.91, session=<fHC5dG1Ggr6t78kL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.238.173
country_id: 6252001
description:
Dec 21 08:26:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=95.181.238.173, lip=66.85.158.91, session=<Gly3dG1GGuZfte6t>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.232.16
country_id: 2542007
description:
Dec 21 08:26:23 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=95.181.232.16, lip=66.85.158.91, session=<6Cm1dG1GJOZftegQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 37.19.223.98
country_id: 2782113
description:
Dec 21 08:26:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=37.19.223.98, lip=66.85.158.91, TLS, session=<Mf24dG1GSsElE99i>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.84.102.23
country_id: 3439705
description:
Dec 21 08:26:24 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=45.84.102.23, lip=66.85.158.91, session=<5C+9dG1GfL4tVGYX>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 77.81.142.147
country_id: 3996063
description:
Dec 21 08:26:20 host2 pure-ftpd[1955817]: (?@77.81.142.147) [INFO] New connection from 77.81.142.147


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.102
country_id: 6252001
description:
Dec 21 08:28:33 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.102, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JtJxfG1GltbN0h9m>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.139
country_id: 6252001
description:
Dec 21 08:28:43 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.139, lip=66.85.158.91, TLS: Connection closed, session=<qDEGfW1G2qBChJmL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.39.11.5
country_id: 690791
description:
Dec 21 08:30:05 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=176.39.11.5, lip=66.85.158.91, TLS, session=<7Y7rgG1Gk7mwJwsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.87.105.191
country_id: 1269750
description:
Dec 21 08:30:26 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.87.105.191, lip=66.85.158.91, TLS, session=<jR8Ygm1GjMZnV2m/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2025-12-21 08:31:57 dovecot_login authenticator failed for H=(bb151-192-57-118.singnet.com.sg) [151.192.57.118]:52779: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-21 08:32:18 dovecot_login authenticator failed for H=([65.20.153.146]) [65.20.153.146]:33955: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 08:32:34 host2 pure-ftpd[1960428]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.97
country_id: 3175395
description:
Dec 21 08:34:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.171.97, lip=66.85.158.91, TLS, session=<6tnskW1G+d25D6th>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-21 08:34:53 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (yarborcts) [174.169.224.27]:38382: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.49.122
country_id: 2963597
description:
Dec 21 08:35:09 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=37.203.49.122, lip=66.85.158.91, TLS, session=<6h8Uk21GSK4lyzF6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.223.240.239
country_id: 49518
description:
2025-12-21 08:36:55 dovecot_login authenticator failed for H=([196.223.240.239]) [196.223.240.239]:60964: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.51
country_id: 6252001
description:
Dec 21 08:47:37 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.149.51, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RR+pwG1Gksyi2JUz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.51
country_id: 6252001
description:
Dec 21 08:48:38 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=162.216.149.51, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<z2ZBxG1GROii2JUz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec 21 08:50:06 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<1sWHyW1Ghs6LonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.51
country_id: 6252001
description:
Dec 21 08:55:18 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.51, lip=66.85.158.92, TLS, session=<Hegd3G1GcvKi2JUz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-12-21 08:56:35 dovecot_login authenticator failed for H=([182.79.31.107]) [152.52.199.126]:46946: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.116
country_id: 294640
description:
2025-12-21 08:56:42 dovecot_login authenticator failed for H=([195.133.156.116]) [195.133.156.116]:39400: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.85
country_id: 2635167
description:
Dec 21 09:01:11 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.85, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<mVsg8W1Gl6BX7LBV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.84
country_id: 6252001
description:
Dec 21 09:00:59 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.84, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Z7Zq8G1GycnN0h9U>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.44
country_id: 2635167
description:
Dec 21 09:01:05 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.44, lip=66.85.158.91, TLS, session=<hdLI8G1GebdX7LAs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.93
country_id: 2635167
description:
Dec 21 09:01:44 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.93, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<pXAf821G4e2594ld>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.117
country_id: 6252001
description:
Dec 21 09:01:50 host2 pure-ftpd[1981624]: (?@66.132.153.117) [INFO] New connection from 66.132.153.117


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 176.32.195.85
country_id: 174982
description:
Dec 21 09:02:16 host2 pure-ftpd[1982023]: (?@176.32.195.85) [INFO] New connection from 176.32.195.85


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.106
country_id: 2635167
description:
Dec 21 09:02:18 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.106, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<Wasf9W1GQ8BX7LBq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.94
country_id: 2635167
description:
Dec 21 09:02:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.94, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Zd8w921GYaa594le>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.94.56
country_id: 3865483
description:
Dec 21 09:04:06 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=190.181.94.56, lip=66.85.158.91, TLS, session=<QVZ8+m1GhLG+tV44>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.80
country_id: 2635167
description:
Dec 21 09:03:27 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sHM8+W1GIetX7LBQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2025-12-21 09:03:59 dovecot_login authenticator failed for H=(18980204017.user.veloxzone.com.br) [189.80.146.46]:50589: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.99
country_id: 2635167
description:
Dec 21 09:04:00 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.99, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8x84+21Gz49X7LBj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.185.189
country_id: 3144096
description:
2025-12-21 09:04:12 dovecot_login authenticator failed for H=(cm-178.232.185.189.get.no) [178.232.185.189]:60164: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.111
country_id: 3469034
description:
Dec 21 09:04:28 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=187.120.72.111, lip=66.85.158.91, TLS, session=<19K1+21GJpG7eEhv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.85
country_id: 2635167
description:
Dec 21 09:04:34 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.85, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<x8Y7/W1GzbpX7LBV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.78
country_id: 2635167
description:
Dec 21 09:05:10 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.78, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<U31q/21Gq7lX7LBO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.98
country_id: 2635167
description:
Dec 21 09:05:44 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.98, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<prllAW5GHaG594li>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.103
country_id: 2635167
description:
Dec 21 09:06:17 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.103, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<v5JlA25GBdFX7LBn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 09:11:29 host2 sshd[1988542]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-21 09:15:09 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:26866: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.109.194
country_id: 1269750
description:
2025-12-21 09:15:32 dovecot_login authenticator failed for H=([103.111.109.194]) [103.111.109.194]:55770: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:17:58 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wzwyLW5GZL8DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:18:18 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<AU9dLm5GzOoDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-21 09:20:50 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:33552: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:21:05 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6NpKOG5G5pwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:21:25 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<aNWGOW5GJtMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:22:57 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<qE75Pm5GsO0DhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:23:58 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<sqGcQm5GiIIDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:25:33 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<c19LSG5GzrcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:26:17 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<05foSm5G6uQDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:27:28 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<YpQnT25GTpMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:29:03 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<vs/TVG5GoLUDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:29:46 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<z01eV25GzpcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Dec 21 09:30:38 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<sAp2Wm5GHKkDhBfJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 09:34:52 host2 pure-ftpd[2007112]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.78
country_id: 6252001
description:
Dec 21 09:36:31 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.78, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<5yCFb25G2tzG6xhO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 21 09:37:08 host2 sshd[2008752]: Disconnected from invalid user den 51.38.224.114 port 48910 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 21 09:38:14 host2 sshd[2009638]: Received disconnect from 51.38.224.114 port 36538:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.40
country_id: 2186224
description:
2025-12-21 09:41:29 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.163.40]:49704: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.74.112.161
country_id: 2963597
description:
2025-12-21 09:41:36 dovecot_login authenticator failed for H=([127.0.0.1]) [13.74.112.161]:53000: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 21 09:43:33 host2 sshd[2014027]: Received disconnect from 51.38.224.114 port 34640:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 21 09:43:33 host2 sshd[2014027]: Disconnected from invalid user khan 51.38.224.114 port 34640 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.38.224.114
country_id: 3017382
description:
Dec 21 09:44:40 host2 sshd[2015098]: Disconnected from invalid user user 51.38.224.114 port 40818 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.126
country_id: 690791
description:
Dec 21 09:45:19 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.17.124.126, lip=66.85.158.91, TLS, session=<iwyIjW5GeL+5EXx+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.25.120
country_id: 933860
description:
Dec 21 09:45:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan>, method=PLAIN, rip=83.143.25.120, lip=66.85.158.91, TLS, session=<BwbEj25G6NlTjxl4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 21 09:47:30 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<nZWulm5GENbBHmEh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.94
country_id: 2635167
description:
Dec 21 09:49:42 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.94, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<etCwnm5GH4VX7LBe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.160.35.76
country_id: 2300660
description:
2025-12-21 09:49:44 dovecot_login authenticator failed for H=([154.160.35.76]) [154.160.35.76]:33826: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.230
country_id: 2635167
description:
Dec 21 09:49:40 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.230, lip=66.85.158.92, TLS, session=<gvmQnm5GP5JX7LDm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 09:50:46 host2 sshd[2020795]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.109
country_id: 2635167
description:
Dec 21 09:50:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.109, lip=66.85.158.92, TLS handshaking: Connection closed, session=<JHDSom5G2YNX7LBt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.76
country_id: 2635167
description:
Dec 21 09:50:17 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.76, lip=66.85.158.92, TLS handshaking: Connection closed, session=<M8vBoG5GX4a594lM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.82
country_id: 2635167
description:
Dec 21 09:51:25 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.82, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<UQvRpG5Gh4O594lS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.93
country_id: 2635167
description:
Dec 21 09:51:59 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.93, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<ebLQpm5G15K594ld>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.76
country_id: 2635167
description:
Dec 21 09:52:32 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.76, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<20rMqG5GN8xX7LBM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.104
country_id: 2635167
description:
Dec 21 09:53:06 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.104, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<GvrPqm5Gq+VX7LBo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.99
country_id: 2635167
description:
Dec 21 09:53:41 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.99, lip=66.85.158.92, TLS handshaking: Connection closed, session=<HK3urG5GXdhX7LBj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.81
country_id: 2635167
description:
Dec 21 09:54:16 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.81, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<Jdr5rm5GX9W594lR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.92
country_id: 2635167
description:
Dec 21 09:54:49 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.92, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<+Fb5sG5Gu46594lc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.110
country_id: 1149361
description:
2025-12-21 09:56:54 dovecot_login authenticator failed for H=([180.94.75.110]) [180.94.75.110]:46647: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-12-21 09:57:14 dovecot_login authenticator failed for H=([41.75.122.7]) [41.75.122.7]:53873: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.184.60
country_id: 6252001
description:
2025-12-21 09:59:02 dovecot_login authenticator failed for H=24-72-184-24-72-184-60.cpe.sparklight.net [24.72.184.60]:54510: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-21 10:01:31 dovecot_plain authenticator failed for H=c-98-193-112-85.hsd1.il.comcast.net (repsital) [98.193.112.85]:39180: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 10:01:51 host2 sshd[2029294]: Disconnected from invalid user admin 2.57.121.112 port 12599 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.124
country_id: 6252001
description:
Dec 21 10:09:58 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.149.124, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<PLAc525Ga8Si2JV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.124
country_id: 6252001
description:
Dec 21 10:11:09 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=162.216.149.124, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<ACZa625G+OSi2JV8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Dec 21 10:10:52 host2 sshd[2036395]: Disconnected from invalid user admin 152.32.250.188 port 58850 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.124
country_id: 6252001
description:
Dec 21 10:11:13 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.149.124, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<ss6Y625Gqu2i2JV8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.250.188
country_id: 1562822
description:
Dec 21 10:12:13 host2 sshd[2037533]: Disconnected from invalid user user 152.32.250.188 port 41908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 21 10:12:47 host2 sshd[2038011]: Disconnected from invalid user ftpUser 152.32.215.203 port 52966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 21 10:13:22 host2 sshd[2038484]: Disconnected from invalid user user 152.32.215.203 port 52342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.250.188
country_id: 1562822
description:
Dec 21 10:13:34 host2 sshd[2038595]: Disconnected from invalid user admin 152.32.250.188 port 53226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.215.203
country_id: 1819730
description:
Dec 21 10:14:01 host2 sshd[2038914]: Disconnected from invalid user user 152.32.215.203 port 33274 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.20
country_id: 2635167
description:
Dec 21 10:14:02 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.20, lip=66.85.158.92, TLS, session=<ndC19W5G64y594kU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.70
country_id: 2635167
description:
Dec 21 10:14:04 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.70, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<olfQ9W5Gp4+594lG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.58
country_id: 2635167
description:
Dec 21 10:14:38 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.58, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<0gnV925GnZlX7LA6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.39
country_id: 6252001
description:
Dec 21 10:14:31 host2 pure-ftpd[2039461]: (?@147.185.132.39) [INFO] New connection from 147.185.132.39


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.94
country_id: 1269750
description:
2025-12-21 10:15:23 dovecot_login authenticator failed for H=(nsg-corporate-177.174.185.122.airtel.in) [152.52.246.94]:37742: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-12-21 10:15:42 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:55056: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.58
country_id: 2635167
description:
Dec 21 10:15:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.58, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<e6fu+25GRcNX7LA6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.64
country_id: 2635167
description:
Dec 21 10:15:13 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.64, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<l+Tj+W5G5edX7LBA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 10:16:25 host2 sshd[2041136]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.72
country_id: 2635167
description:
Dec 21 10:16:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.72, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0zfu/W5GD52594lI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.46
country_id: 2635167
description:
Dec 21 10:16:54 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.46, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<otDp/25GS+BX7LAu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.69
country_id: 2635167
description:
Dec 21 10:17:28 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<5gf9AW9GOaJX7LBF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-21 10:17:48 dovecot_login authenticator failed for H=(cm-84.214.63.110.get.no) [84.214.63.110]:56180: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.124
country_id: 6252001
description:
Dec 21 10:17:59 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.124, lip=66.85.158.91, TLS, session=<oxTRA29GoOKi2JV8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.60
country_id: 2635167
description:
Dec 21 10:18:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.60, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<lrb8A29G3Yy594k8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.203.96
country_id: 2542007
description:
2025-12-21 10:18:22 dovecot_login authenticator failed for H=([105.73.203.96]) [105.73.203.96]:60504: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.73
country_id: 2635167
description:
Dec 21 10:18:36 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 1 secs): user=<>, rip=87.236.176.73, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<kAgDBm9GEclX7LBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.44
country_id: 2635167
description:
Dec 21 10:19:09 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.44, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<9IICCG9GK7+594ks>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 21 10:26:01 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<UIuQIG9GRrWLonHU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.250
country_id: 3865483
description:
Dec 21 10:25:21 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.249.250, lip=66.85.158.91, TLS, session=<YiDrHG9Gs+CzAPn6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.159.85.31
country_id: 3469034
description:
Dec 21 10:25:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=201.159.85.31, lip=66.85.158.91, TLS, session=<jGw/Hm9GVpnJn1Uf>


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - admin@venee.lk [12/21/2025:04:57:49 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: admin@venee.lk


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-21 10:28:25 dovecot_login authenticator failed for H=(19.135.150.178.triolan.net) [178.150.135.19]:32267: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-12-21 10:28:51 dovecot_login authenticator failed for H=([177.27.76.210]) [177.27.76.210]:41027: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.142.126.37
country_id: 6252001
description:
2025-12-21 10:30:06 dovecot_plain authenticator failed for H=c-69-142-126-37.hsd1.nj.comcast.net (curan) [69.142.126.37]:32860: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-21 10:34:32 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:57928: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.56.28
country_id: 3996063
description:
2025-12-21 10:35:06 dovecot_login authenticator failed for H=(201.173.56.28-clientes-izzi.mx) [201.173.56.28]:38607: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 10:35:56 host2 sshd[2057622]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.95.46.186
country_id: 1269750
description:
[2025-12-21 10:35:45 +0530] info [webmaild] 182.95.46.186 - info@stanthonys.biz "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.173.35
country_id: 6252001
description:
Dec 21 10:37:58 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.173.35, lip=66.85.158.91, session=<AtNBS29G7MSlmq0j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.173.35
country_id: 6252001
description:
Dec 21 10:37:58 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=165.154.173.35, lip=66.85.158.91, TLS, session=<vM9DS29GCMalmq0j>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 10:37:10 host2 pure-ftpd[2058623]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec 21 10:40:35 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.80, lip=66.85.158.91, session=<sGqnVG9GXKZAPpxQ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.124
country_id: 3017382
description:
Dec 21 10:45:43 host2 pure-ftpd[2067397]: (?@91.196.152.124) [INFO] New connection from 91.196.152.124


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 115.133.68.171
country_id: 1733045
description:
Dec 21 10:45:52 host2 sshd[2067480]: Disconnected from invalid user vnc 115.133.68.171 port 37013 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.126
country_id: 3017382
description:
Dec 21 10:45:43 host2 pure-ftpd[2067400]: (?@91.196.152.126) [INFO] New connection from 91.196.152.126


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.133.68.171
country_id: 1733045
description:
Dec 21 10:46:32 host2 sshd[2067928]: Disconnected from invalid user user 115.133.68.171 port 43227 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-12-21 10:47:09 dovecot_login authenticator failed for H=ool-45701cb5.dyn.optonline.net [69.112.28.181]:49739: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.133.68.171
country_id: 1733045
description:
Dec 21 10:47:10 host2 sshd[2068374]: Disconnected from invalid user ubuntu 115.133.68.171 port 49439 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-12-21 10:50:49 dovecot_login authenticator failed for H=([128.185.208.42]) [128.185.208.42]:48506: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2025-12-21 10:51:05 dovecot_login authenticator failed for H=([89.218.247.234]) [89.218.247.234]:43552: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2025-12-21 10:50:33 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [125.23.203.138]:57840: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.112
country_id: 6252001
description:
Dec 21 10:52:53 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.112, lip=66.85.158.91, TLS: Connection closed, session=<EqGggG9GQDhChJlw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.234.202.64
country_id: 953987
description:
Dec 21 10:55:01 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=197.234.202.64, lip=66.85.158.91, TLS, session=<2zQJh29GJNnF6spA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.221.254.177
country_id: 798544
description:
Dec 21 10:55:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=85.221.254.177, lip=66.85.158.91, TLS, session=<Dso5h29GxLBV3f6x>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.93.165.176
country_id: 3469034
description:
Dec 21 10:55:21 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact>, method=PLAIN, rip=177.93.165.176, lip=66.85.158.91, TLS, session=<MLliiG9G8ruxXaWw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.115
country_id: 3469034
description:
Dec 21 10:55:39 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 30 secs): user=<contact>, method=PLAIN, rip=187.120.72.115, lip=66.85.158.91, TLS, session=<WPbAiG9GBaa7eEhz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 21 10:59:43 host2 sshd[2078228]: Disconnected from invalid user belen 62.60.131.157 port 56351 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 11:00:14 host2 sshd[2078806]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.198
country_id: 3175395
description:
Dec 21 11:02:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.15.171.198, lip=66.85.158.91, TLS, session=<ytIioG9G1I25D6vG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.90.20
country_id: 3865483
description:
Dec 21 11:02:22 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.181.90.20, lip=66.85.158.91, TLS, session=<P1tuoW9GnIK+tVoU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Dec 21 11:03:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS: Connection closed, session=<dXGypm9GHrVChJmG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-12-21 11:14:41 dovecot_login authenticator failed for H=(187.161.136.18-clientes-izzi.mx) [187.161.136.18]:40344: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-12-21 11:15:13 dovecot_login authenticator failed for H=([101.127.101.225]) [101.127.101.225]:51754: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.81
country_id: 6252001
description:
Dec 21 11:15:25 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.81, lip=66.85.158.91, session=<p5000W9Gbclb5qhR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.86
country_id: 6252001
description:
Dec 21 11:15:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.230.168.86, lip=66.85.158.91, session=<V57P0W9GB9Fb5qhW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.82
country_id: 6252001
description:
Dec 21 11:15:42 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.230.168.82, lip=66.85.158.91, session=<B9cx0m9GId9b5qhS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.181
country_id: 6252001
description:
Dec 21 11:15:45 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.181, lip=66.85.158.91, session=<2OBg0m9G555b5qi1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.243.171
country_id: 1562822
description:
2025-12-21 11:21:21 dovecot_login authenticator failed for H=(K0XWxvPQ) [103.77.243.171]:50008: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Dec 21 11:21:37 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.91, TLS: Connection closed, session=<Gndj529GuJkiemm2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.243.171
country_id: 1562822
description:
2025-12-21 11:22:38 dovecot_login authenticator failed for H=(EmP3JOp) [103.77.243.171]:64719: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 103.77.243.171
country_id: 1562822
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[103.77.243.171] [Authentication Database]=[mail] [Username]=[ajith@simple-engineering.lk] (5/5 failures) (blocked until [Sun Dec 21 06:09:01 2025 UTC/Sun Dec 21 11:39:01 2025 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-12-21 11:24:08 dovecot_login authenticator failed for H=([45.118.49.18]) [45.118.49.18]:54862: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.243.171
country_id: 1562822
description:
2025-12-21 11:23:21 dovecot_login authenticator failed for H=(PD2aJuVn3m) [103.77.243.171]:55663: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-12-21 11:23:29 dovecot_login authenticator failed for H=([103.140.18.186]) [103.140.18.186]:43622: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.21.17.225
country_id: 6252001
description:
2025-12-21 11:24:26 dovecot_login authenticator failed for H=h225.17.21.98.static.ip.windstream.net [98.21.17.225]:56784: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.189
country_id: 2635167
description:
Dec 21 11:24:44 host2 pure-ftpd[2097410]: (?@87.236.176.189) [INFO] New connection from 87.236.176.189


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 21 11:32:37 host2 sshd[2103308]: Disconnected from invalid user jana 62.60.131.157 port 21241 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:32:22 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<kubLDXBGdqMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:34:25 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<400mFXBG8tsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:36:25 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<DtNJHHBGgN4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:37:47 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<k3grIXBGRNwDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:38:45 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<6tWqJHBGVtoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.57
country_id: 6252001
description:
Dec 21 11:38:48 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.57, lip=66.85.158.92, TLS: Connection closed, session=<3E7TJHBGhlGnXpI5>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 11:39:33 host2 sshd[2108195]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 21 11:39:31 host2 sshd[2108157]: Disconnecting authenticating user root 82.67.140.251 port 38514: Too many authentication failures [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 21 11:39:47 host2 sshd[2108415]: Disconnecting invalid user admin 82.67.140.251 port 40429: Too many authentication failures [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 11:39:29 host2 pure-ftpd[2108152]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 82.67.140.251
country_id: 3017382
description:
Dec 21 11:39:31 host2 sshd[2108157]: error: maximum authentication attempts exceeded for root from 82.67.140.251 port 38514 ssh2 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:40:40 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<0RaJK3BGeO0DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Dec 21 11:41:26 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<yP9ELnBGrJIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.62
country_id: 2264397
description:
Dec 21 11:43:59 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 1 secs): user=<>, rip=45.156.128.62, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<Q+JYN3BGa9ktnIA+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.62
country_id: 2264397
description:
Dec 21 11:43:58 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.62, lip=66.85.158.91, TLS, session=<iYRSN3BGgZctnIA+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.63
country_id: 2264397
description:
Dec 21 11:43:53 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.63, lip=66.85.158.91, session=<w4EHN3BGvastnIA/>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.64
country_id: 2264397
description:
Dec 21 11:43:54 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=45.156.128.64, lip=66.85.158.91, TLS, session=</PkSN3BGg4QtnIBA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.63
country_id: 2264397
description:
Dec 21 11:43:55 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=45.156.128.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<fuocN3BGv+otnIA/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.61
country_id: 2264397
description:
Dec 21 11:43:57 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.156.128.61, lip=66.85.158.91, session=<mBg8N3BGfM8tnIA9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 11:51:00 host2 sshd[2117698]: Disconnected from invalid user admin 2.57.121.112 port 19376 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.202.101
country_id: 6252001
description:
2025-12-21 11:58:59 dovecot_login authenticator failed for H=([165.154.202.101]) [165.154.202.101]:26738: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.252.243
country_id: 3865483
description:
Dec 21 12:02:26 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=179.0.252.243, lip=66.85.158.91, TLS, session=<vAMieHBGOaCzAPzz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.66
country_id: 298795
description:
Dec 21 12:02:48 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=95.0.32.66, lip=66.85.158.91, TLS, session=<5ih7eXBG/pBfACBC>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.101.33.246
country_id: 6252001
description:
[2025-12-21 12:04:55 +0530] info [cpaneld] 76.101.33.246 - tradeceyl "GET /login/?login_only=1&user=tradeceyl&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyl (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.32.42.93
country_id: 6252001
description:
[2025-12-21 12:04:56 +0530] info [cpaneld] 76.32.42.93 - tradecey "GET /login/?login_only=1&user=tradecey&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradecey (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.198.92.20
country_id: 6252001
description:
[2025-12-21 12:05:01 +0530] info [cpaneld] 47.198.92.20 - trade "GET /login/?login_only=1&user=trade&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trade (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.158.46.229
country_id: 6252001
description:
[2025-12-21 12:04:36 +0530] info [cpaneld] 73.158.46.229 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.167.170.61
country_id: 6252001
description:
[2025-12-21 12:04:53 +0530] info [cpaneld] 67.167.170.61 - tradeceylo "GET /login/?login_only=1&user=tradeceylo&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceylo (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.242.5.144
country_id: 6252001
description:
[2025-12-21 12:04:52 +0530] info [cpaneld] 23.242.5.144 - tradeceyloncom "GET /login/?login_only=1&user=tradeceyloncom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradeceyloncom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 198.210.84.161
country_id: 6252001
description:
[2025-12-21 12:05:02 +0530] info [cpaneld] 198.210.84.161 - trad "GET /login/?login_only=1&user=trad&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user trad (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.32.12.186
country_id: 6252001
description:
[2025-12-21 12:05:05 +0530] info [cpaneld] 66.32.12.186 - tra "GET /login/?login_only=1&user=tra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.99.51.9
country_id: 6252001
description:
[2025-12-21 12:04:48 +0530] info [whostmgrd] 184.99.51.9 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.175.229.232
country_id: 6252001
description:
[2025-12-21 12:04:59 +0530] info [cpaneld] 104.175.229.232 - tradec "GET /login/?login_only=1&user=tradec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.47.236.28
country_id: 6252001
description:
[2025-12-21 12:04:38 +0530] info [cpaneld] 24.47.236.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.33.172.134
country_id: 6252001
description:
[2025-12-21 12:04:45 +0530] info [cpaneld] 136.33.172.134 - tradeceylon "GET /login/?login_only=1&user=tradeceylon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.208.25.115
country_id: 6252001
description:
[2025-12-21 12:04:58 +0530] info [cpaneld] 108.208.25.115 - tradece "GET /login/?login_only=1&user=tradece&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.3.191.141
country_id: 6252001
description:
[2025-12-21 12:05:19 +0530] info [cpaneld] 160.3.191.141 - tr "GET /login/?login_only=1&user=tr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.125.93.65
country_id: 6252001
description:
[2025-12-21 12:05:22 +0530] info [cpaneld] 24.125.93.65 - tradece2 "GET /login/?login_only=1&user=tradece2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.127.231.72
country_id: 6252001
description:
[2025-12-21 12:05:20 +0530] info [cpaneld] 99.127.231.72 - tradece1 "GET /login/?login_only=1&user=tradece1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user tradece1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.143.92.177
country_id: 2510769
description:
Dec 21 12:07:06 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.143.92.177, lip=66.85.158.91, TLS, session=<BS0NiXBGrNi5j1yx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.243.38.183
country_id: 3469034
description:
Dec 21 12:07:26 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=191.243.38.183, lip=66.85.158.91, TLS, session=<Jb4oinBGZr6/8ya3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.6
country_id: 798549
description:
Dec 21 12:08:54 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.140.6, lip=66.85.158.91, session=<Hqd/kHBGtoNV2YwG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-12-21 12:09:03 dovecot_login authenticator failed for H=([103.68.52.210]) [103.68.52.210]:38626: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-12-21 12:08:42 dovecot_login authenticator failed for H=(aes-static-025.20.22.125.airtel.in) [128.185.192.166]:48176: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-12-21 12:12:52 dovecot_login authenticator failed for H=89-67-38-27.dynamic.play.pl [89.67.38.27]:48257: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-12-21 12:13:22 dovecot_login authenticator failed for H=([182.95.22.208]) [125.23.228.86]:46052: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.173.2
country_id: 3996063
description:
2025-12-21 12:14:42 dovecot_login authenticator failed for H=(187.161.173.2-clientes-izzi.mx) [187.161.173.2]:39354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-12-21 12:14:57 dovecot_login authenticator failed for H=(14.204.bol-online.com) [122.144.14.204]:53833: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-21 12:16:14 dovecot_login authenticator failed for H=50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:63702: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-12-21 12:16:31 dovecot_login authenticator failed for H=([125.23.112.209]) [182.95.51.166]:45558: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.11
country_id: 2186224
description:
2025-12-21 12:30:13 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.168.11]:51724: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.217
country_id: 6252001
description:
Dec 21 12:29:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.217, lip=66.85.158.91, session=<eOBL2nBGtPjN0h/Z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.128.180.14
country_id: 3437598
description:
2025-12-21 12:30:41 dovecot_login authenticator failed for H=([127.0.0.1]) [190.128.180.14]:39195: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.127.24.165
country_id: 6252001
description:
2025-12-21 12:35:47 dovecot_login authenticator failed for H=99-127-24-165.lightspeed.chrlnc.sbcglobal.net [99.127.24.165]:41594: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-12-21 12:36:33 dovecot_login authenticator failed for H=([191.59.187.13]) [191.59.187.13]:38580: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.129
country_id: 6252001
description:
Dec 21 12:36:38 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.129, lip=66.85.158.92, TLS, session=<xI2w83BGiOiTuYSB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.135.107
country_id: 130758
description:
Dec 21 12:38:01 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=62.60.135.107, lip=66.85.158.91, session=<WkV/+HBGMrs+PIdr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 21 12:38:05 host2 sshd[2155517]: Disconnected from invalid user saige 62.60.131.157 port 6976 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 12:41:57 host2 pure-ftpd[2158703]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 12:49:13 host2 sshd[2164919]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Dec 21 12:53:40 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<2AKTMHFG3qdHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Dec 21 12:53:42 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.91, session=<Ty20MHFGzqtHBpKC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Dec 21 12:54:25 host2 sshd[2169390]: Disconnected from invalid user brandon 89.126.208.241 port 43048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.170.105
country_id: 3996063
description:
Dec 21 12:55:11 host2 sshd[2170175]: Disconnected from invalid user victor 132.248.170.105 port 60905 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 21 12:55:27 host2 sshd[2170417]: Disconnected from invalid user solar 81.30.162.18 port 60703 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2025-12-21 12:56:10 dovecot_login authenticator failed for H=([50.123.92.130]) [50.123.92.130]:57071: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 194.107.115.199
country_id: 1512440
description:
Dec 21 12:56:24 host2 sshd[2171402]: Disconnected from invalid user m 194.107.115.199 port 53078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.198.68
country_id: 3996063
description:
2025-12-21 12:56:25 dovecot_login authenticator failed for H=(187.161.198.68-clientes-izzi.mx) [187.161.198.68]:33940: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 21 12:58:15 host2 sshd[2173586]: Disconnected from invalid user vinay 81.30.162.18 port 37739 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Dec 21 12:57:36 host2 sshd[2172756]: Disconnected from invalid user danny 194.107.115.199 port 65037 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.109.120
country_id: 2921044
description:
Dec 21 12:57:42 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=142.93.109.120, lip=66.85.158.91, TLS, session=<DRz7PnFG0tmOXW14>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.126.208.241
country_id: 1512440
description:
Dec 21 12:57:52 host2 sshd[2173108]: Disconnected from invalid user ubuntu 89.126.208.241 port 58146 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 132.248.170.105
country_id: 3996063
description:
Dec 21 12:58:56 host2 sshd[2174178]: Received disconnect from 132.248.170.105 port 47141:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.202.82.102
country_id: 1861060
description:
2025-12-21 12:59:02 dovecot_login authenticator failed for H=fp5cca5266.gifg408.ap.nuro.jp [92.202.82.102]:60336: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.100.148
country_id: 2921044
description:
Dec 21 12:59:11 host2 sshd[2174359]: Disconnected from invalid user mehdi 64.226.100.148 port 43784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec 21 12:59:18 host2 sshd[2174418]: Disconnected from invalid user danny 121.52.147.5 port 38992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 21 12:59:56 host2 sshd[2174950]: Disconnected from invalid user reza 81.30.162.18 port 57841 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-12-21 12:59:31 dovecot_login authenticator failed for H=([46.8.246.27]) [46.8.246.27]:51814: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-21 13:00:07 dovecot_login authenticator failed for H=(nsg-static-193.122.75.182-airtel.com) [125.19.154.158]:51212: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2025-12-21 13:00:38 dovecot_login authenticator failed for H=cable-84-43-254-214.mnet.bg [84.43.254.214]:44457: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.226.100.148
country_id: 2921044
description:
Dec 21 13:01:04 host2 sshd[2176180]: Disconnected from invalid user vinay 64.226.100.148 port 41424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Dec 21 13:01:36 host2 sshd[2176669]: Disconnected from invalid user mehdi 81.30.162.18 port 49707 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 21 13:02:17 host2 sshd[2177224]: Disconnected from invalid user alin 68.218.72.173 port 48160 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.125.4.14
country_id: 798544
description:
Dec 21 13:02:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.125.4.14, lip=66.85.158.91, TLS, session=<wZWbTnFGW7e5fQQO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.232.60.66
country_id: 3469034
description:
Dec 21 13:02:41 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=168.232.60.66, lip=66.85.158.91, TLS, session=<0m+0T3FGU9Co6DxC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-12-21 13:02:43 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:37544: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 21 13:03:00 host2 sshd[2177767]: Disconnected from invalid user ubuntu 68.218.72.173 port 38418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.224.26
country_id: 1269750
description:
2025-12-21 13:03:28 dovecot_login authenticator failed for H=([152.52.224.26]) [152.52.224.26]:38764: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec 21 13:03:33 host2 sshd[2178465]: Disconnected from invalid user usertest 121.52.147.5 port 47946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.218.72.173
country_id: 2077456
description:
Dec 21 13:04:25 host2 sshd[2179267]: Disconnected from invalid user insight 68.218.72.173 port 34236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 21 13:04:37 host2 sshd[2179428]: Disconnected from invalid user jahan 190.181.27.22 port 53788 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 21 13:06:13 host2 sshd[2180899]: Disconnected from invalid user victor 190.181.27.22 port 54900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 21 13:05:27 host2 sshd[2180247]: Disconnected from invalid user user01 190.181.27.22 port 51824 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec 21 13:05:42 host2 sshd[2180428]: Disconnected from invalid user victor 121.52.147.5 port 37304 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.252.2
country_id: 2921044
description:
Dec 21 13:05:43 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=164.92.252.2, lip=66.85.158.91, TLS, session=<UoKpW3FGnFOkXPwC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.221.134.65
country_id: 6290252
description:
Dec 21 13:07:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.221.134.65, lip=66.85.158.91, TLS, session=<8qZsX3FGHY5b3YZB>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 21 13:07:51 host2 sshd[2182677]: Disconnected from invalid user core 190.181.27.22 port 50434 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.5.96
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.5.96: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.21
country_id: 3175395
description:
Dec 21 13:07:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=185.15.171.21, lip=66.85.158.91, TLS, session=<6Tp6YHFGcoK5D6sV>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 18.97.5.96
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 18.97.5.96: 434 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Dec 21 13:11:04 host2 sshd[2186436]: Disconnected from invalid user m 190.181.27.22 port 37716 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.10.138
country_id: 1168579
description:
2025-12-21 13:14:41 dovecot_login authenticator failed for H=(203-128-10-138.braintel.net.pk) [203.128.10.138]:58312: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-12-21 13:15:17 dovecot_login authenticator failed for H=([106.0.166.123]) [106.0.166.123]:55149: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Dec 21 13:17:06 host2 sshd[2193407]: Disconnected from invalid user ali 106.51.1.63 port 42822 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-12-21 13:17:55 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg [121.6.81.59]:43386: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-12-21 13:17:23 dovecot_login authenticator failed for H=(201.173.216.16-clientes-izzi.mx) [201.173.216.16]:46751: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 106.51.1.63
country_id: 1269750
description:
Dec 21 13:19:05 host2 sshd[2195517]: Disconnected from invalid user deploy 106.51.1.63 port 51584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-12-21 13:19:17 dovecot_login authenticator failed for H=(cm-178.232.116.165.get.no) [178.232.116.165]:35731: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2025-12-21 13:19:32 dovecot_login authenticator failed for H=(netcomafrica.com) [41.219.149.74]:63903: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.237.114.190
country_id: 1880251
description:
Dec 21 13:21:12 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=47.237.114.190, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<xr4Fk3FGolUv7XK+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.153.110.189
country_id: 1210997
description:
Dec 21 13:21:22 host2 sshd[2198325]: Disconnected from invalid user viper 103.153.110.189 port 38392 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.237.114.190
country_id: 1880251
description:
Dec 21 13:21:42 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=47.237.114.190, lip=66.85.158.91, TLS, session=<OH3SlHFGslUv7XK+>


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 12.189.234.27
country_id: 6252001
description:
Dec 21 13:22:21 host2 sshd[2199373]: Received disconnect from 12.189.234.27 port 50799:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 21 13:22:34 host2 sshd[2199549]: Disconnected from invalid user matt 200.118.99.170 port 33450 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.153.110.189
country_id: 1210997
description:
Dec 21 13:22:38 host2 sshd[2199593]: Disconnected from invalid user qiyuesuo 103.153.110.189 port 58494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 106.51.1.63
country_id: 1269750
description:
Dec 21 13:22:48 host2 sshd[2199779]: Disconnected from invalid user matt 106.51.1.63 port 40816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.189.234.27
country_id: 6252001
description:
Dec 21 13:24:56 host2 sshd[2201841]: Disconnected from invalid user ali 12.189.234.27 port 53313 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Dec 21 13:25:23 host2 sshd[2202416]: Disconnected from invalid user pzuser 200.118.99.170 port 38474 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.248
country_id: 6252001
description:
Dec 21 13:26:21 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.248, lip=66.85.158.92, TLS, session=<YJ1vpXFGBv/G6xj4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 13:28:40 host2 sshd[2205705]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.1
country_id: 6252001
description:
Dec 21 13:33:42 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.171.8.1, lip=66.85.158.91, session=<ygy6v3FGEp0UqwgB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.152
country_id: 6252001
description:
Dec 21 13:39:46 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.152, lip=66.85.158.92, session=<XzRr1XFGwFhAPpyY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-21 13:40:35 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:34886: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.79
country_id: 2300660
description:
2025-12-21 13:41:19 dovecot_login authenticator failed for H=([197.251.249.79]) [197.251.249.79]:43970: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 13:44:30 host2 pure-ftpd[2217388]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.20.59.210
country_id: 2510769
description:
2025-12-21 13:52:39 dovecot_login authenticator failed for H=210.red-88-20-59.staticip.rima-tde.net [88.20.59.210]:40528: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2025-12-21 13:53:01 dovecot_login authenticator failed for H=([193.95.21.147]) [193.95.24.117]:40062: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-21 13:55:18 dovecot_login authenticator failed for H=(ADMIN) [178.131.84.55]:58217: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 220.247.223.56
country_id: 1227603
description:
Dec 21 14:00:48 host2 sshd[2229889]: Disconnected from invalid user erpnext 220.247.223.56 port 55044 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 220.247.223.56
country_id: 1227603
description:
Dec 21 14:01:28 host2 sshd[2230460]: Disconnected from invalid user arthur 220.247.223.56 port 38592 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.63.132.43
country_id: 3175395
description:
Dec 21 14:02:27 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.63.132.43, lip=66.85.158.91, TLS, session=<ZymQJXJGGMa5P4Qr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.123.53
country_id: 690791
description:
Dec 21 14:02:48 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.228.123.53, lip=66.85.158.91, TLS, session=<SNrKJnJGEdFb5Hs1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 220.247.223.56
country_id: 1227603
description:
Dec 21 14:05:15 host2 sshd[2233782]: Disconnected from invalid user monitor 220.247.223.56 port 52728 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.51.216.210
country_id: 1269750
description:
Dec 21 14:04:50 host2 sshd[2233280]: Disconnected from invalid user erpnext 103.51.216.210 port 41010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 220.247.223.56
country_id: 1227603
description:
Dec 21 14:05:54 host2 sshd[2234257]: Disconnected from invalid user dspace 220.247.223.56 port 36272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.145.43.133
country_id: 2510769
description:
Dec 21 14:07:16 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.145.43.133, lip=66.85.158.91, TLS, session=<E/q4NnJGo4S5kSuF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.202.96.161
country_id: 3865483
description:
Dec 21 14:07:36 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=143.202.96.161, lip=66.85.158.91, TLS, session=<3LXnN3JGEI+PymCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 130.131.163.217
country_id: 6252001
description:
Dec 21 14:08:42 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=130.131.163.217, lip=66.85.158.92, session=<jEryPHJGKueCg6PZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.63.110
country_id: 3144096
description:
2025-12-21 14:13:56 dovecot_login authenticator failed for H=(cm-84.214.63.110.get.no) [84.214.63.110]:34117: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.242
country_id: 3996063
description:
2025-12-21 14:14:12 dovecot_login authenticator failed for H=([177.236.146.242]) [177.236.146.242]:33737: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 21 14:16:23 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<F9RdWHJGfM8DlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-12-21 14:17:08 dovecot_login authenticator failed for H=([125.19.154.158]) [125.19.154.158]:54592: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-12-21 14:16:18 dovecot_login authenticator failed for H=([154.127.90.34]) [154.127.90.34]:57261: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 21 14:18:27 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<b/zNX3JG/IgDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 21 14:20:10 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<6hP0ZXJGVKQDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 21 14:20:38 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<CaSaZ3JG0KgDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 21 14:21:59 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<h2hpbHJGdIMDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 21 14:22:12 host2 dovecot[1601669]: imap-login: Disconnected: Input buffer full (no auth attempts in 1 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<cVorbXJGZMEDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 21 14:22:25 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<VlvzbXJGOK4DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 21 14:23:56 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<WKlrc3JGmN8DlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 21 14:24:27 host2 dovecot[1601669]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<PTNEdXJGHMADlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Dec 21 14:26:07 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<VYQze3JG+JADlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-12-21 14:30:10 dovecot_login authenticator failed for H=(cm-46.212.127.128.get.no) [46.212.127.128]:36247: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-12-21 14:30:59 dovecot_login authenticator failed for H=([103.233.92.123]) [103.233.92.123]:35756: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-12-21 14:30:44 dovecot_login authenticator failed for H=(201.173.86.13-clientes-izzi.mx) [201.173.86.13]:39256: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.59.71.231
country_id: 1269750
description:
Dec 21 14:37:42 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=139.59.71.231, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WCOapHJG7seLO0fn>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 14:38:48 host2 sshd[2262195]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.22.7.112
country_id: 1605651
description:
2025-12-21 14:45:12 dovecot_login authenticator failed for H=([127.0.0.1]) [184.22.7.112]:59812: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.170
country_id: 1269750
description:
2025-12-21 14:44:51 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.185.170]:48046: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.135
country_id: 6252001
description:
Dec 21 14:46:54 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.135, lip=66.85.158.92, session=<c8+NxXJG6P6TuYSH>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 14:46:57 host2 pure-ftpd[2269991]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.70
country_id: 6252001
description:
Dec 21 14:47:04 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=18.97.5.70, lip=66.85.158.92, session=<3rgdxnJG/IsSYQVG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 21 14:47:46 host2 sshd[2270743]: Disconnected from invalid user annabel 62.60.131.157 port 8993 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec 21 14:50:30 host2 sshd[2273434]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 50081


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec 21 14:54:19 host2 pure-ftpd[2276923]: (?@66.132.153.124) [INFO] New connection from 66.132.153.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.132.2.176
country_id: 2635167
description:
2025-12-21 15:02:12 dovecot_login authenticator failed for H=31-132-2-176.as42831.net ([127.0.0.1]) [31.132.2.176]:43529: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.22.61
country_id: 6251999
description:
2025-12-21 15:02:20 dovecot_login authenticator failed for H=static24-72-22-61.r.rev.accesscomm.ca ([127.0.0.1]) [24.72.22.61]:41235: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.203
country_id: 6252001
description:
Dec 21 15:06:07 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.203, lip=66.85.158.91, TLS, session=<TLk7CnNGXvvN0h/L>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.185
country_id: 3865483
description:
Dec 21 15:07:34 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=45.238.106.185, lip=66.85.158.91, TLS, session=<tYtRDnNGYoAt7mq5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-21 15:07:47 dovecot_plain authenticator failed for H=c-68-46-148-180.hsd1.mi.comcast.net (nolly) [68.46.148.180]:49648: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.246.131
country_id: 1269750
description:
Dec 21 15:07:57 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan>, method=PLAIN, rip=103.164.246.131, lip=66.85.158.91, TLS, session=<taWVD3NGl8NnpPaD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-21 15:11:06 dovecot_login authenticator failed for H=([182.79.136.105]) [122.187.60.126]:45652: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-12-21 15:11:30 dovecot_login authenticator failed for H=([189.57.81.137]) [186.201.54.90]:50015: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-21 15:11:39 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:52596: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-12-21 15:12:00 dovecot_login authenticator failed for H=(49.206.201.253.actcorp.in) [49.206.201.253]:34732: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 15:18:20 host2 sshd[2301370]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 21 15:19:58 host2 sshd[2303450]: Disconnected from invalid user scarlett 62.60.131.157 port 42358 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.126.147.92
country_id: 798544
description:
2025-12-21 15:20:43 dovecot_login authenticator failed for H=([127.0.0.1]) [164.126.147.92]:49098: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.255.158.241
country_id: 1643084
description:
2025-12-21 15:20:51 dovecot_login authenticator failed for H=([127.0.0.1]) [101.255.158.241]:40456: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec 21 15:21:49 host2 sshd[2305798]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 61257


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 21 15:21:55 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<QNecQnNG7oTBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2025-12-21 15:24:40 dovecot_login authenticator failed for H=([149.54.15.90]) [149.54.15.90]:36639: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.189
country_id: 6252001
description:
2025-12-21 15:25:01 dovecot_login authenticator failed for H=([209.23.72.189]) [209.23.72.189]:52502: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 92.55.226.249
country_id: 798544
description:
Dec 21 15:25:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=92.55.226.249, lip=66.85.158.91, TLS, session=<lh3bT3NGHNpcN+L5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.95.189
country_id: 3865483
description:
Dec 21 15:25:33 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=190.181.95.189, lip=66.85.158.91, TLS, session=<eUutTnNGVOC+tV+9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.55.16
country_id: 3144096
description:
2025-12-21 15:29:25 dovecot_login authenticator failed for H=([178.232.55.16]) [178.232.55.16]:32966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2025-12-21 15:29:47 dovecot_login authenticator failed for H=([46.8.240.44]) [46.8.240.44]:42600: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2025-12-21 15:34:10 dovecot_login authenticator failed for H=([50.123.92.130]) [50.123.92.130]:51107: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-21 15:34:40 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:45519: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-12-21 15:34:46 dovecot_login authenticator failed for H=(120-194-136-45.ddns.movitel.tv) [45.136.194.120]:54596: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2025-12-21 15:34:57 dovecot_login authenticator failed for H=([103.120.116.162]) [103.120.116.162]:49774: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.96
country_id: 3996063
description:
2025-12-21 15:36:23 dovecot_login authenticator failed for H=(201.173.216.96-clientes-izzi.mx) [201.173.216.96]:43229: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-21 15:37:06 dovecot_login authenticator failed for H=([182.95.226.118]) [182.95.226.118]:58740: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec 21 15:37:57 host2 sshd[2325393]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 54753


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.185.164.76
country_id: 2077456
description:
2025-12-21 15:38:03 dovecot_login authenticator failed for H=(cpe-101-185-164-76.wb06.wa.asp.telstra.net) [101.185.164.76]:41482: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.153
country_id: 2186224
description:
2025-12-21 15:38:44 dovecot_login authenticator failed for H=([121.73.169.153]) [121.73.169.153]:43706: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-12-21 15:39:24 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br [187.40.215.162]:59468: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-12-21 15:40:08 dovecot_login authenticator failed for H=(cm-84.210.192.240.get.no) [84.210.192.240]:40764: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-12-21 15:40:21 dovecot_login authenticator failed for H=(187.161.136.18-clientes-izzi.mx) [187.161.136.18]:35158: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-12-21 15:43:10 dovecot_login authenticator failed for H=c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:34794: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-12-21 15:43:33 dovecot_login authenticator failed for H=(165-169-82-194.zeop.re) [165.169.82.194]:60233: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.20.234
country_id: 1831722
description:
2025-12-21 15:45:12 dovecot_login authenticator failed for H=([150.129.20.234]) [150.129.20.234]:56341: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.112.204
country_id: 3017382
description:
2025-12-21 15:45:32 dovecot_login authenticator failed for H=217-128-112-204.ftth.fr.orangecustomers.net [217.128.112.204]:55726: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 15:49:19 host2 pure-ftpd[2337522]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.237.56.33
country_id: 1269750
description:
Dec 21 15:54:34 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=103.237.56.33, lip=66.85.158.91, TLS, session=<8mVUtnNGEcNn7Tgh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.145.43.2
country_id: 2510769
description:
Dec 21 15:54:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=185.145.43.2, lip=66.85.158.91, TLS, session=<35+at3NG3Mq5kSsC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 16:01:18 host2 sshd[2349446]: Disconnected from invalid user admin 2.57.121.112 port 10486 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-12-21 16:02:38 dovecot_login authenticator failed for H=([65.20.153.146]) [65.20.153.146]:41497: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
country_id: 6252001
description:
2025-12-21 16:02:58 dovecot_login authenticator failed for H=syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:57374: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec 21 16:07:57 host2 sshd[2356052]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 56425


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.75
country_id: 3865483
description:
Dec 21 16:10:12 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=179.0.249.75, lip=66.85.158.91, TLS, session=<5AdG7nNG9JmzAPlL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.66
country_id: 3175395
description:
Dec 21 16:10:31 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt>, method=PLAIN, rip=185.15.171.66, lip=66.85.158.91, TLS, session=<KJ2J73NGRMe5D6tC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Dec 21 16:10:52 host2 sshd[2359203]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 57691


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-12-21 16:13:46 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.177.146.85
country_id: 2542007
description:
[2025-12-21 16:15:13 +0530] info [cpaneld] 160.177.146.85 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.177.146.85
country_id: 2542007
description:
[2025-12-21 16:15:40 +0530] info [cpaneld] 160.177.146.85 - info@cloudtourssrilanka.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 160.177.146.85
country_id: 2542007
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[66.85.158.91] [Local Port]=[2083] [Remote IP Address]=[160.177.146.85] [Remote Port]=[49153] [Authentication Database]=[system] [Username]=[info] (5/5 failures) (blocked until [Sun Dec 21 11:00:41 2025 UTC/Sun Dec 21 16:30:41 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.36.123
country_id: 3175395
description:
Dec 21 16:19:14 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=178.239.36.123, lip=66.85.158.91, TLS, session=<9ArGDnRG5tWy7yR7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.131
country_id: 933860
description:
Dec 21 16:19:35 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.216.213.131, lip=66.85.158.91, TLS, session=<MjXmD3RGxZ4p2NWD>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 16:23:23 host2 sshd[2369578]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 16:28:21 host2 sshd[2374473]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.111
country_id: 2186224
description:
2025-12-21 16:28:40 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.169.111]:51616: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.155.28.36
country_id: 2750405
description:
2025-12-21 16:28:47 dovecot_login authenticator failed for H=([127.0.0.1]) [213.155.28.36]:54016: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.237.107
country_id: 3144096
description:
2025-12-21 16:29:26 dovecot_login authenticator failed for H=(cm-178.232.237.107.get.no) [178.232.237.107]:41369: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-21 16:29:38 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:47430: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Dec 21 16:37:48 host2 sshd[2382956]: Disconnected from invalid user admin 179.32.207.251 port 42108 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Dec 21 16:38:55 host2 sshd[2383809]: Disconnected from invalid user postgres 179.32.207.251 port 59714 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.32.207.251
country_id: 3686110
description:
Dec 21 16:39:37 host2 sshd[2384539]: Disconnected from invalid user tsuser 179.32.207.251 port 45372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.32.207.251
country_id: 3686110
description:
Dec 21 16:40:56 host2 sshd[2386101]: Disconnected from invalid user uftp 179.32.207.251 port 44912 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 21 16:43:33 host2 pure-ftpd[2388762]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Dec 21 16:43:36 host2 pure-ftpd[2388815]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.67
country_id: 6252001
description:
Dec 21 16:43:51 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<E+PEZ3RGbHi4aYtD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-12-21 16:47:34 dovecot_login authenticator failed for H=([125.16.32.137]) [125.20.228.146]:34724: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-12-21 16:47:51 dovecot_login authenticator failed for H=([103.174.145.35]) [103.174.145.35]:44474: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-21 16:49:54 dovecot_plain authenticator failed for H=(cadal) [154.146.240.123]:46646: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 16:51:43 host2 pure-ftpd[2396257]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-12-21 16:59:28 dovecot_login authenticator failed for H=([27.123.114.126]) [27.123.114.126]:38656: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.30.137
country_id: 290557
description:
2025-12-21 17:00:34 dovecot_login authenticator failed for H=([94.207.30.137]) [94.207.30.137]:57596: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 21 17:05:50 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<XkVrtnRGCLsDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 21 17:07:12 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<ywBIu3RGQK4DjyE/>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 17:07:58 host2 sshd[2410348]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 21 17:07:31 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<4LxtvHRGzsQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 21 17:08:35 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<2n44wHRG2q0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 21 17:09:54 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vdv2xHRGcKwDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 21 17:10:45 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<NlP7x3RGsu0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 21 17:12:06 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<lg/SzHRG4u0DjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 17:11:36 host2 sshd[2413899]: Disconnected from invalid user admin 2.57.121.112 port 39818 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.158
country_id: 2635167
description:
Dec 21 17:11:56 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.158, lip=66.85.158.91, TLS, session=<X6g2zHRGKeO594me>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 21 17:13:12 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<io+30HRGVIYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 21 17:13:31 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<PPXk0XRGmugDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec 21 17:14:32 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<yo6E1XRGAIcDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-12-21 17:15:51 dovecot_login authenticator failed for H=([128.185.23.89]) [125.19.160.206]:58338: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.193.137
country_id: 6252001
description:
Dec 21 17:15:54 host2 sshd[2417180]: Disconnected from invalid user ubuntu 50.6.193.137 port 40468 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.232.11.10
country_id: 1269750
description:
Dec 21 17:16:20 host2 sshd[2417493]: Disconnected from invalid user saas 136.232.11.10 port 11525 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.94.234.151
country_id: 6252001
description:
Dec 21 17:16:39 host2 sshd[2417711]: Disconnected from invalid user satisfactory 74.94.234.151 port 54886 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.231.111
country_id: 6252001
description:
Dec 21 17:18:16 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=172.234.231.111, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<6Izf4nRG9lKs6udv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.170.248.221
country_id: 2661886
description:
Dec 21 17:18:27 host2 sshd[2418960]: Disconnected from invalid user usuario2 81.170.248.221 port 58794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.94.234.151
country_id: 6252001
description:
Dec 21 17:18:33 host2 sshd[2419048]: Disconnected from invalid user debian 74.94.234.151 port 52674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.108.79.187
country_id: 3686110
description:
Dec 21 17:18:38 host2 sshd[2419115]: Disconnected from invalid user tobias 190.108.79.187 port 45773 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.94.234.151
country_id: 6252001
description:
Dec 21 17:19:12 host2 sshd[2419536]: Disconnected from invalid user robert 74.94.234.151 port 36774 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.231.111
country_id: 6252001
description:
Dec 21 17:19:42 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=172.234.231.111, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<PAEC6HRGfGms6udv>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.123.68.117
country_id: 290557
description:
Dec 21 17:21:13 host2 sshd[2421421]: Disconnected from invalid user ygarcia 193.123.68.117 port 11856 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec 21 17:20:35 host2 sshd[2420868]: Disconnected from invalid user jessica 193.123.68.117 port 49921 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.231.111
country_id: 6252001
description:
Dec 21 17:20:40 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (tried to use unsupported auth mechanism): user=<>, method=NTLM, rip=172.234.231.111, lip=66.85.158.91, TLS, session=<+ZN163RG3j2s6udv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.232.11.10
country_id: 1269750
description:
Dec 21 17:20:44 host2 sshd[2420983]: Disconnected from invalid user admin 136.232.11.10 port 11348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec 21 17:23:00 host2 sshd[2422818]: Disconnected from invalid user sai 193.123.68.117 port 49387 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec 21 17:23:34 host2 sshd[2423330]: Disconnected from invalid user qwe 198.245.55.32 port 58762 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.150.107.244
country_id: 1605651
description:
Dec 21 17:23:41 host2 sshd[2423416]: Disconnected from invalid user qwe 203.150.107.244 port 48612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.170.248.221
country_id: 2661886
description:
Dec 21 17:23:45 host2 sshd[2423515]: Disconnected from invalid user xh 81.170.248.221 port 35588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.245.55.32
country_id: 6251999
description:
Dec 21 17:24:39 host2 sshd[2424515]: Disconnected from invalid user web 198.245.55.32 port 45482 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.170.248.221
country_id: 2661886
description:
Dec 21 17:24:58 host2 sshd[2424690]: Disconnected from invalid user public 81.170.248.221 port 38552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.113.241
country_id: 1819730
description:
Dec 21 17:25:20 host2 sshd[2425072]: Disconnected from invalid user billing 101.36.113.241 port 57114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.193.137
country_id: 6252001
description:
Dec 21 17:25:56 host2 sshd[2425640]: Disconnected from invalid user sai 50.6.193.137 port 52764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.113.241
country_id: 1819730
description:
Dec 21 17:25:58 host2 sshd[2425658]: Disconnected from invalid user bigdata 101.36.113.241 port 42604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.32.10.237
country_id: 130758
description:
Dec 21 17:25:42 host2 sshd[2425376]: Disconnected from invalid user vscode 37.32.10.237 port 42770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.170.248.221
country_id: 2661886
description:
Dec 21 17:25:48 host2 sshd[2425506]: Disconnected from invalid user debian 81.170.248.221 port 36516 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 17:26:42 host2 sshd[2426192]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 198.245.55.32
country_id: 6251999
description:
Dec 21 17:26:53 host2 sshd[2426330]: Received disconnect from 198.245.55.32 port 55024:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.108.79.187
country_id: 3686110
description:
Dec 21 17:27:09 host2 sshd[2426537]: Disconnected from invalid user saas 190.108.79.187 port 26615 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.113.241
country_id: 1819730
description:
Dec 21 17:26:38 host2 sshd[2426172]: Disconnected from invalid user tmax 101.36.113.241 port 56330 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.108.79.187
country_id: 3686110
description:
Dec 21 17:29:36 host2 sshd[2428423]: Disconnected from invalid user oracle 190.108.79.187 port 34186 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.215.78
country_id: 732800
description:
Dec 21 17:36:11 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.255.215.78, lip=66.85.158.91, TLS, session=<VfXyIXVGMru5/9dO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.136.94
country_id: 99237
description:
Dec 21 17:36:29 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=65.20.136.94, lip=66.85.158.91, TLS, session=<p4EII3VG15NBFIhe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.88
country_id: 3865483
description:
Dec 21 17:41:05 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.250.88, lip=66.85.158.91, TLS, session=<e+YyM3VG142zAPpY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.163
country_id: 3175395
description:
Dec 21 17:41:25 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=185.15.171.163, lip=66.85.158.91, TLS, session=<nbqjNHVGCoC5D6uj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.67
country_id: 3017382
description:
Dec 21 17:41:47 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.67, lip=66.85.158.91, session=<cnPzNnVGP5pb51lD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.168
country_id: 3017382
description:
Dec 21 17:42:06 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.168, lip=66.85.158.91, session=<8nMVOHVGPetb51mo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 21 17:46:38 host2 sshd[2443566]: Disconnected from invalid user admin 2.57.121.112 port 20399 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 17:54:05 host2 pure-ftpd[2451015]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.125
country_id: 6252001
description:
Dec 21 17:54:15 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.5.125, lip=66.85.158.91, session=<88SQY3VGNq4SYQV9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.185
country_id: 3996063
description:
2025-12-21 17:58:27 dovecot_login authenticator failed for H=([177.236.145.185]) [177.236.145.185]:51639: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.26.32
country_id: 6252001
description:
Dec 21 17:59:26 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=18.97.26.32, lip=66.85.158.91, TLS handshaking: Connection closed, session=<D8MVdnVGhMISYRog>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2025-12-21 17:59:30 dovecot_login authenticator failed for H=([125.19.159.186]) [125.19.159.186]:44656: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-12-21 17:58:47 dovecot_login authenticator failed for H=177-72-87-7.static.as262543.net.br [177.72.87.7]:57946: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.26.32
country_id: 6252001
description:
Dec 21 17:59:31 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=18.97.26.32, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<qcdjdnVG0qUSYRog>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-12-21 17:59:58 dovecot_login authenticator failed for H=([103.174.145.35]) [103.174.145.35]:37714: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-12-21 18:09:45 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:37022: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2025-12-21 18:10:22 dovecot_login authenticator failed for H=([27.123.98.174]) [27.123.98.174]:39716: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 18:18:08 host2 sshd[2476944]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.24
country_id: 2186224
description:
2025-12-21 18:18:16 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.169.24]:47096: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.202
country_id: 1269750
description:
2025-12-21 18:18:26 dovecot_login authenticator failed for H=([127.0.0.1]) [182.95.123.202]:41266: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-12-21 18:18:37 dovecot_login authenticator failed for H=212.42.246.220.static.netvigator.com [220.246.42.212]:57375: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-12-21 18:18:39 dovecot_login authenticator failed for H=(177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:41385: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 18:22:53 host2 sshd[2481342]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.178.43.243
country_id: 3017382
description:
Dec 21 18:25:10 host2 pure-ftpd[2483655]: (?@51.178.43.243) [INFO] New connection from 51.178.43.243


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 51.178.43.243
country_id: 3017382
description:
Dec 21 18:25:35 host2 pure-ftpd[2483962]: (?@51.178.43.243) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 51.178.43.243
country_id: 3017382
description:
Dec 21 18:25:37 host2 pure-ftpd[2484203]: (?@51.178.43.243) [INFO] New connection from 51.178.43.243


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 51.178.43.243
country_id: 3017382
description:
Dec 21 18:25:28 host2 pure-ftpd[2483962]: (?@51.178.43.243) [INFO] New connection from 51.178.43.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.169.120.37
country_id: 1668284
description:
2025-12-21 18:28:17 dovecot_login authenticator failed for H=([192.169.120.37]) [192.169.120.37]:42125: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.100.10
country_id: 1269750
description:
2025-12-21 18:28:47 dovecot_login authenticator failed for H=(abts-west-static-208.237.201.106.airtelbroadband.in) [103.218.100.10]:57878: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-12-21 18:29:44 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:61650: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-12-21 18:31:26 dovecot_login authenticator failed for H=([49.124.205.169]) [49.124.205.169]:58616: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.128.160
country_id: 3469034
description:
Dec 21 18:42:17 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=191.53.128.160, lip=66.85.158.91, TLS, session=<17RKDnZGVpC/NYCg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.222
country_id: 3175395
description:
Dec 21 18:42:39 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=185.15.169.222, lip=66.85.158.91, TLS, session=<bqJ6D3ZGqee5D6ne>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 182.50.191.101
country_id: 3144096
description:
Dec 21 18:43:44 host2 pure-ftpd[2501937]: (?@182.50.191.101) [INFO] New connection from 182.50.191.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.140.151.129
country_id: 6252001
description:
[2025-12-21 18:48:24 +0530] info [cpaneld] 74.140.151.129 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.222.28.81
country_id: 6252001
description:
[2025-12-21 18:48:29 +0530] info [whostmgrd] 71.222.28.81 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.16.18.234
country_id: 6252001
description:
[2025-12-21 18:48:27 +0530] info [cpaneld] 216.16.18.234 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.224.3.148
country_id: 6252001
description:
[2025-12-21 18:48:31 +0530] info [cpaneld] 68.224.3.148 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.88.227.193
country_id: 6252001
description:
[2025-12-21 18:48:32 +0530] info [cpaneld] 75.88.227.193 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.114.187.52
country_id: 6252001
description:
[2025-12-21 18:48:33 +0530] info [cpaneld] 172.114.187.52 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.59.176.64
country_id: 6252001
description:
[2025-12-21 18:48:26 +0530] info [cpaneld] 172.59.176.64 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.141.176
country_id: 2328926
description:
Dec 21 18:49:46 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.141.176, lip=66.85.158.92, session=<e/4VKnZGnquYII2w>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.141.176
country_id: 2328926
description:
Dec 21 18:49:47 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.141.176, lip=66.85.158.92, TLS, session=<7QErKnZG3qyYII2w>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.57
country_id: 3175395
description:
Dec 21 18:50:18 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.169.57, lip=66.85.158.91, TLS, session=<3Sn5KnZGQ+25D6k5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.125
country_id: 3469034
description:
Dec 21 18:50:39 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=177.44.96.125, lip=66.85.158.91, TLS, session=<a5oiLHZGfJWxLGB9>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 18:56:58 host2 pure-ftpd[2519880]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 18:58:31 host2 sshd[2521273]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 180.252.154.9
country_id: 1643084
description:
Dec 21 18:59:16 host2 sshd[2521948]: Disconnected from invalid user sumit 180.252.154.9 port 56114 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.201.39.9
country_id: 6252001
description:
[2025-12-21 19:00:01 +0530] info [webmaild] 67.201.39.9 - info@maximsholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.144.233.117
country_id: 2750405
description:
Dec 21 19:03:27 host2 sshd[2526686]: Disconnected from invalid user ubuntu 136.144.233.117 port 55278 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 21 19:05:08 host2 sshd[2528795]: Disconnected from invalid user amin 52.224.240.74 port 47252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.187.21.105
country_id: 298795
description:
Dec 21 19:06:12 host2 sshd[2529895]: Disconnected from invalid user farhan 78.187.21.105 port 40042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 180.252.154.9
country_id: 1643084
description:
Dec 21 19:06:33 host2 sshd[2530164]: Disconnected from invalid user boss 180.252.154.9 port 52426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.157.200.48
country_id: 1643084
description:
Dec 21 19:07:00 host2 sshd[2530508]: Disconnected from invalid user ubuntu 43.157.200.48 port 49872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.224.240.74
country_id: 6252001
description:
Dec 21 19:08:16 host2 sshd[2531613]: Disconnected from invalid user user 52.224.240.74 port 35058 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 136.144.233.117
country_id: 2750405
description:
Dec 21 19:07:33 host2 sshd[2531013]: Received disconnect from 136.144.233.117 port 34598:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 136.144.233.117
country_id: 2750405
description:
Dec 21 19:07:33 host2 sshd[2531013]: Disconnected from invalid user mongod 136.144.233.117 port 34598 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 136.144.233.117
country_id: 2750405
description:
Dec 21 19:08:02 host2 sshd[2531406]: Disconnected from invalid user ali 136.144.233.117 port 46682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.55.87.153
country_id: 6252001
description:
Dec 21 19:08:12 host2 sshd[2531561]: Disconnected from invalid user invitado 45.55.87.153 port 33696 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-12-21 19:09:03 dovecot_login authenticator failed for H=(113-28-86-1.static.imsbiz.com) [113.28.86.1]:52694: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-12-21 19:09:40 dovecot_login authenticator failed for H=(aes-static-102.79.144.59.airtel.in) [59.144.79.102]:58240: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 21 19:11:46 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS, session=<UAjHeHZG7ofPWvQO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Dec 21 19:11:46 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<dybMeHZG8ofPWvQO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-21 19:12:08 dovecot_login authenticator failed for H=(229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:34644: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.153.27
country_id: 3144096
description:
2025-12-21 19:13:20 dovecot_login authenticator failed for H=(cm-178.232.153.27.get.no) [178.232.153.27]:56644: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.22
country_id: 1269750
description:
2025-12-21 19:12:39 dovecot_login authenticator failed for H=([182.95.181.22]) [182.95.181.22]:56856: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.29.26
country_id: 3144096
description:
2025-12-21 19:13:33 dovecot_login authenticator failed for H=(cm-178.232.29.26.get.no) [178.232.29.26]:48169: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.187.21.105
country_id: 298795
description:
Dec 21 19:13:44 host2 sshd[2537110]: Disconnected from invalid user jj 78.187.21.105 port 33196 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-12-21 19:13:56 dovecot_login authenticator failed for H=([62.201.228.210]) [62.201.228.210]:35056: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2025-12-21 19:14:33 dovecot_login authenticator failed for H=c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:47634: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 21 19:15:02 host2 sshd[2538531]: Disconnected from invalid user zone 103.210.21.242 port 42650 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 21 19:16:22 host2 sshd[2539975]: Disconnected from invalid user dmdba 103.210.21.242 port 40654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.35.17
country_id: 1819730
description:
Dec 21 19:15:49 host2 sshd[2539370]: Disconnected from invalid user miguel 118.193.35.17 port 50784 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.60.12.72
country_id: 6252001
description:
2025-12-21 19:17:13 dovecot_plain authenticator failed for H=([169.254.136.41]) [103.60.12.72]:50957: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.35.17
country_id: 1819730
description:
Dec 21 19:17:06 host2 sshd[2540604]: Disconnected from invalid user pymes 118.193.35.17 port 46586 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Dec 21 19:17:07 host2 dovecot[1601669]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<cwPti3ZG+JC58uIR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.21.242
country_id: 1880251
description:
Dec 21 19:18:51 host2 sshd[2541926]: Disconnected from invalid user testmail 103.210.21.242 port 41994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2025-12-21 19:18:58 dovecot_login authenticator failed for H=(177-174-0-3.user.vivozap.com.br) [177.174.0.3]:37452: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.35.17
country_id: 1819730
description:
Dec 21 19:21:36 host2 sshd[2544717]: Disconnected from invalid user deploy 118.193.35.17 port 46018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.35.17
country_id: 1819730
description:
Dec 21 19:22:48 host2 sshd[2546241]: Disconnected from invalid user es1 118.193.35.17 port 41820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.131.159
country_id: 6252001
description:
Dec 21 19:25:32 host2 sshd[2549755]: Invalid user cloudtourssrilan_travel from 124.198.131.159 port 49706


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 21 19:33:08 host2 sshd[2556265]: Disconnected from invalid user ashly 62.60.131.157 port 60965 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.152.201.166
country_id: 1643084
description:
Dec 21 19:33:54 host2 sshd[2556757]: Disconnected from invalid user marco 202.152.201.166 port 38568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.8.173
country_id: 298795
description:
Dec 21 19:35:41 host2 sshd[2558517]: Disconnected from invalid user server 94.102.8.173 port 60848 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.254
country_id: 6252001
description:
2025-12-21 19:36:05 dovecot_login authenticator failed for H=([209.23.72.254]) [209.23.72.254]:41794: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-21 19:36:40 dovecot_login authenticator failed for H=(cm-84.214.48.79.get.no) [84.214.48.79]:54163: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Dec 21 19:36:54 host2 sshd[2560256]: Disconnected from invalid user scpuser 51.254.103.32 port 50266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.155
country_id: 3996063
description:
2025-12-21 19:38:19 dovecot_login authenticator failed for H=(201.172.88.155-clientes-izzi.mx) [201.172.88.155]:34000: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 21 19:38:25 host2 sshd[2561759]: Disconnected from invalid user acs 35.200.237.19 port 1097 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.152.201.166
country_id: 1643084
description:
Dec 21 19:37:52 host2 sshd[2561240]: Disconnected from invalid user oracle 202.152.201.166 port 33802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-12-21 19:37:59 dovecot_login authenticator failed for H=(nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:54496: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.77
country_id: 2186224
description:
2025-12-21 19:38:09 dovecot_login authenticator failed for H=([127.0.0.1]) [121.73.162.77]:39670: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.235.65.22
country_id: 1269750
description:
2025-12-21 19:38:22 dovecot_login authenticator failed for H=([127.0.0.1]) [223.235.65.22]:35929: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Dec 21 19:37:48 host2 sshd[2561191]: Disconnected from invalid user user 27.254.152.90 port 47144 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.8.173
country_id: 298795
description:
Dec 21 19:39:05 host2 sshd[2562324]: Disconnected from invalid user maria 94.102.8.173 port 36110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.31.51
country_id: 1819730
description:
Dec 21 19:39:12 host2 sshd[2562395]: Disconnected from invalid user test 154.221.31.51 port 32974 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.254.103.32
country_id: 3017382
description:
Dec 21 19:39:55 host2 sshd[2562882]: Disconnected from invalid user maria 51.254.103.32 port 41806 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 21 19:40:04 host2 sshd[2563164]: Disconnected from invalid user jenkins 35.200.237.19 port 1088 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.176.58
country_id: 192950
description:
2025-12-21 19:40:16 dovecot_login authenticator failed for H=([196.207.176.58]) [196.207.176.58]:33495: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.102.8.173
country_id: 298795
description:
Dec 21 19:40:57 host2 sshd[2564205]: Disconnected from invalid user rachel 94.102.8.173 port 40178 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-12-21 19:41:00 dovecot_login authenticator failed for H=([117.247.239.202]) [117.247.239.202]:51070: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.200.237.19
country_id: 1269750
description:
Dec 21 19:42:03 host2 sshd[2565220]: Disconnected from invalid user servidor 35.200.237.19 port 1121 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.31.51
country_id: 1819730
description:
Dec 21 19:41:55 host2 sshd[2565026]: Disconnected from invalid user guest 154.221.31.51 port 50508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.31.51
country_id: 1819730
description:
Dec 21 19:43:35 host2 sshd[2566317]: Disconnected from invalid user marcus 154.221.31.51 port 54102 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-21 19:43:40 dovecot_login authenticator failed for H=(137-161-97-62.cust.smartcall.no) [62.97.161.137]:57471: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-12-21 19:43:57 dovecot_login authenticator failed for H=(95.158.39.201.bestsolution.net.ua) [95.158.39.201]:36098: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-21 19:51:21 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:45870: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-12-21 19:51:33 dovecot_login authenticator failed for H=(166.200-59-41.ttcl.co.tz) [41.59.200.166]:54479: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.202
country_id: 3175395
description:
Dec 21 19:55:18 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=194.60.212.202, lip=66.85.158.91, TLS, session=<qXsmE3dG6Y3CPNTK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.202.96.161
country_id: 3865483
description:
Dec 21 19:55:38 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=143.202.96.161, lip=66.85.158.91, TLS, session=<mSqaFHdGmZOPymCh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.190.214.241
country_id: 1643084
description:
Dec 21 19:56:28 host2 sshd[2577624]: Disconnected from invalid user hdoop 103.190.214.241 port 60816 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.190.214.241
country_id: 1643084
description:
Dec 21 19:58:42 host2 sshd[2579208]: Disconnected from invalid user junlong 103.190.214.241 port 60900 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.58
country_id: 3996063
description:
2025-12-21 19:58:55 dovecot_login authenticator failed for H=([177.236.146.58]) [177.236.146.58]:50215: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-12-21 19:59:14 dovecot_login authenticator failed for H=([101.127.101.225]) [101.127.101.225]:57162: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 19:59:53 host2 pure-ftpd[2580266]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.1.79
country_id: 690791
description:
Dec 21 20:00:04 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=176.103.1.79, lip=66.85.158.91, TLS, session=<M8VpJHdG/pWwZwFP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.249.149
country_id: 3865483
description:
Dec 21 20:00:25 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan>, method=PLAIN, rip=179.0.249.149, lip=66.85.158.91, TLS, session=<xu2cJXdGVZqzAPmV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.190.214.241
country_id: 1643084
description:
Dec 21 20:00:55 host2 sshd[2581391]: Disconnected from invalid user frank 103.190.214.241 port 60984 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 20:09:20 host2 sshd[2588507]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.185.85.106
country_id: 2264397
description:
[2025-12-21 20:21:53 +0530] info [webmaild] 130.185.85.106 - awanish@maximsholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.21.221
country_id: 1269750
description:
2025-12-21 20:22:33 dovecot_plain authenticator failed for H=(JKJEX) [103.148.21.221]:3873: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.78
country_id: 1269750
description:
2025-12-21 20:25:04 dovecot_login authenticator failed for H=(dsl-tn-dynamic-217.127.246.61.airtelbroadband.in) [122.186.60.78]:58880: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.62
country_id: 1269750
description:
2025-12-21 20:25:25 dovecot_login authenticator failed for H=([182.95.58.62]) [182.95.58.62]:33102: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.245
country_id: 6252001
description:
Dec 21 20:25:25 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=172.236.228.245, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<h4QogHdGToes7OT1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 21 20:28:48 host2 sshd[2605313]: Disconnected from invalid user shoutcast 64.227.176.54 port 40672 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
country_id: 294640
description:
2025-12-21 20:31:49 dovecot_login authenticator failed for H=([185.246.255.183]) [185.246.255.183]:39484: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.13.184
country_id: 1880251
description:
2025-12-21 20:32:21 dovecot_login authenticator failed for H=(184.13.129.180.unknown.m1.com.sg) [180.129.13.184]:44002: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2025-12-21 20:33:26 dovecot_login authenticator failed for H=([125.21.153.217]) [182.95.46.186]:53676: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.246.106
country_id: 1269750
description:
2025-12-21 20:32:41 dovecot_login authenticator failed for H=([128.185.246.106]) [128.185.246.106]:53138: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.222
country_id: 6252001
description:
Dec 21 20:32:49 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10 (no auth attempts in 0 secs): user=<>, rip=172.236.228.222, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:140943F2:SSL routines:ssl3_read_bytes:sslv3 alert unexpected message: SSL alert number 10, session=<5pSZmndGCsOs7OTe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.253
country_id: 1733045
description:
2025-12-21 20:33:00 dovecot_login authenticator failed for H=([49.124.150.253]) [49.124.150.253]:36354: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 21 20:35:10 host2 sshd[2610102]: Disconnected from invalid user katja 64.227.176.54 port 49034 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Dec 21 20:35:54 host2 sshd[2610678]: Disconnected from invalid user suporte 64.227.176.54 port 40102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.238.174.6
country_id: 1861060
description:
Dec 21 20:38:12 host2 sshd[2612242]: Disconnected from invalid user abdi 111.238.174.6 port 45356 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.136
country_id: 1819730
description:
Dec 21 20:40:56 host2 sshd[2614604]: Disconnected from invalid user samp 152.32.129.136 port 34998 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 111.238.174.6
country_id: 1861060
description:
Dec 21 20:42:27 host2 sshd[2615734]: Disconnected from invalid user guest 111.238.174.6 port 33470 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.85
country_id: 1269750
description:
Dec 21 20:43:24 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan>, method=PLAIN, rip=103.18.166.85, lip=66.85.158.91, TLS, session=<4M4ov3dGv61nEqZV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.142
country_id: 3865483
description:
Dec 21 20:42:59 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=179.0.251.142, lip=66.85.158.91, TLS, session=<dC/TvXdGrNuzAPuO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.238.174.6
country_id: 1861060
description:
Dec 21 20:43:50 host2 sshd[2616663]: Disconnected from invalid user developer 111.238.174.6 port 57608 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.136
country_id: 1819730
description:
Dec 21 20:44:06 host2 sshd[2616923]: Disconnected from invalid user celia 152.32.129.136 port 34034 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-12-21 20:44:28 dovecot_login authenticator failed for H=([196.28.226.124]) [196.28.226.124]:60594: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.238.174.6
country_id: 1861060
description:
Dec 21 20:45:11 host2 sshd[2618529]: Disconnected from invalid user uftp 111.238.174.6 port 53852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-21 20:45:38 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (blarmen) [24.15.216.41]:53794: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.12
country_id: 6252001
description:
Dec 21 20:49:04 host2 pure-ftpd[2622260]: (?@205.210.31.12) [INFO] New connection from 205.210.31.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.145
country_id: 3175395
description:
Dec 21 20:50:10 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=185.15.171.145, lip=66.85.158.91, TLS, session=<4mWx13dGo9G5D6uR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.152.27.237
country_id: 3469034
description:
Dec 21 20:50:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.152.27.237, lip=66.85.158.91, TLS, session=<6fze2HdGnaKxmBvt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.235.131
country_id: 690791
description:
2025-12-21 20:55:19 dovecot_login authenticator failed for H=([178.158.235.131]) [178.158.235.131]:56030: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.122
country_id: 6252001
description:
Dec 21 20:57:27 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.122, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Yc228ndGrMGi2JZ6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.122
country_id: 6252001
description:
Dec 21 20:58:21 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.122, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<CXDu9XdGrvei2JZ6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 21 20:59:03 host2 sshd[2632666]: Disconnected from invalid user tmp 146.59.95.254 port 40824 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.149.9
country_id: 798549
description:
Dec 21 21:03:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=85.217.149.9, lip=66.85.158.92, session=<30ETB3hG1JZV2ZUJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 21:02:49 host2 pure-ftpd[2636258]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.59.95.254
country_id: 1522867
description:
Dec 21 21:04:14 host2 sshd[2637539]: Disconnected from invalid user opc 146.59.95.254 port 56038 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.122
country_id: 6252001
description:
Dec 21 21:05:20 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.122, lip=66.85.158.91, TLS, session=<xVTsDnhGROii2JZ6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.90.110.186
country_id: 1269750
description:
Dec 21 21:07:13 host2 sshd[2640452]: Disconnected from invalid user builder 203.90.110.186 port 38424 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.90.110.186
country_id: 1269750
description:
Dec 21 21:09:19 host2 sshd[2642444]: Disconnected from invalid user test3 203.90.110.186 port 54094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.90.110.186
country_id: 1269750
description:
Dec 21 21:11:24 host2 sshd[2645184]: Disconnected from invalid user odoo 203.90.110.186 port 54442 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.141.196.109
country_id: 6252001
description:
[2025-12-21 21:17:01 +0530] info [cpaneld] 74.141.196.109 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.56.92.46
country_id: 6252001
description:
[2025-12-21 21:17:04 +0530] info [cpaneld] 173.56.92.46 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.217.43.244
country_id: 6252001
description:
[2025-12-21 21:16:54 +0530] info [cpaneld] 24.217.43.244 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.44.203.165
country_id: 6252001
description:
[2025-12-21 21:16:55 +0530] info [cpaneld] 38.44.203.165 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.27.130.29
country_id: 6252001
description:
[2025-12-21 21:16:57 +0530] info [cpaneld] 38.27.130.29 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.193.26.210
country_id: 6252001
description:
[2025-12-21 21:17:00 +0530] info [whostmgrd] 73.193.26.210 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.167.172
country_id: 6252001
description:
[2025-12-21 21:17:02 +0530] info [cpaneld] 172.58.167.172 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Dec 21 21:19:28 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, TLS: Connection closed, session=<gJdyQXhG8lmnXpI6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Dec 21 21:19:29 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=167.94.146.58, lip=66.85.158.91, session=<e2eKQXhG/FmnXpI6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.125
country_id: 6252001
description:
Dec 21 21:24:33 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.125, lip=66.85.158.92, TLS: Connection closed, session=<THidU3hG2LBChJl9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.121
country_id: 2077456
description:
2025-12-21 21:29:09 dovecot_login authenticator failed for H=([161.8.241.121]) [161.8.241.121]:60148: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.152
country_id: 3996063
description:
2025-12-21 21:29:25 dovecot_login authenticator failed for H=([177.239.160.152]) [177.239.160.152]:44923: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 21:31:22 host2 sshd[2664372]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.146.24
country_id: 2750405
description:
Dec 21 21:33:12 host2 sshd[2666071]: Disconnected from invalid user ubuntu 51.158.146.24 port 52974 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Dec 21 21:34:13 host2 sshd[2666780]: Disconnected from invalid user user1 196.28.242.198 port 39624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.146.24
country_id: 2750405
description:
Dec 21 21:34:17 host2 sshd[2666850]: Disconnected from invalid user sftpuser1 51.158.146.24 port 41076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.93.116.246
country_id: 2510769
description:
Dec 21 21:34:25 host2 sshd[2666918]: Disconnected from invalid user sftpuser1 93.93.116.246 port 52858 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.146.24
country_id: 2750405
description:
Dec 21 21:34:52 host2 sshd[2667221]: Disconnected from invalid user user1 51.158.146.24 port 59488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.93.116.246
country_id: 2510769
description:
Dec 21 21:37:49 host2 sshd[2669811]: Disconnected from invalid user app 93.93.116.246 port 42434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.93.116.246
country_id: 2510769
description:
Dec 21 21:39:12 host2 sshd[2670850]: Disconnected from invalid user admin 93.93.116.246 port 45880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.28.242.198
country_id: 2361809
description:
Dec 21 21:39:38 host2 sshd[2671279]: Disconnected from invalid user sftpuser1 196.28.242.198 port 47132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.93.116.246
country_id: 2510769
description:
Dec 21 21:39:51 host2 sshd[2671453]: Disconnected from invalid user elsearch 93.93.116.246 port 54222 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-12-21 21:46:13 dovecot_login authenticator failed for H=([177.236.146.209]) [177.236.146.209]:36460: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-12-21 21:46:41 dovecot_login authenticator failed for H=(9.72.116.151.hathway.com) [116.72.9.151]:44604: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.94
country_id: 6252001
description:
Dec 21 21:50:50 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.94, lip=66.85.158.91, TLS, session=<w6qgsXhGiCAtT7Ve>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.34
country_id: 6252001
description:
Dec 21 21:50:58 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=172.104.11.34, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<YWsjsnhGaP2saAsi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.239
country_id: 6252001
description:
Dec 21 21:51:18 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.239, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<dpxOs3hGZtOi2Jbv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.239
country_id: 6252001
description:
Dec 21 21:51:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 17 secs): user=<>, rip=162.216.150.239, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<W79RtXhGZOii2Jbv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.239
country_id: 6252001
description:
Dec 21 21:59:11 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=162.216.150.239, lip=66.85.158.92, TLS, session=<ktB4z3hGjPqi2Jbv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.78
country_id: 6252001
description:
Dec 21 22:02:38 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.193.78, lip=66.85.158.91, session=<LKLb23hGxocUQcFO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.159
country_id: 3144096
description:
2025-12-21 22:04:37 dovecot_login authenticator failed for H=(cm-84.213.189.159.get.no) [84.213.189.159]:54374: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.143
country_id: 798544
description:
Dec 21 22:05:18 host2 sshd[2711552]: Disconnected from invalid user test 83.168.69.143 port 55834 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.232.188.177
country_id: 6252001
description:
Dec 21 22:05:19 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.232.188.177, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3g5r5XhGwIys6Lyx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.220.10.60
country_id: 1269750
description:
2025-12-21 22:06:19 dovecot_login authenticator failed for H=(static.ftth.hpr.117.220.10.60.bsnl.in) [117.220.10.60]:53655: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Dec 21 22:05:41 host2 sshd[2711901]: Disconnected from invalid user ramesh 139.59.64.179 port 39612 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 22:05:43 host2 pure-ftpd[2711934]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-12-21 22:08:07 dovecot_login authenticator failed for H=([182.79.95.139]) [152.52.246.178]:52962: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.179
country_id: 1269750
description:
Dec 21 22:08:20 host2 sshd[2713990]: Disconnected from invalid user oneadmin 139.59.64.179 port 54922 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-21 22:08:25 dovecot_login authenticator failed for H=([128.185.253.122]) [128.185.253.122]:47448: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Dec 21 22:07:43 host2 sshd[2713497]: Disconnected from invalid user developer 139.59.64.179 port 43110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.143
country_id: 798544
description:
Dec 21 22:10:20 host2 sshd[2715972]: Disconnected from invalid user ionadmin 83.168.69.143 port 34168 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 22:11:11 host2 sshd[2716693]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.168.69.143
country_id: 798544
description:
Dec 21 22:10:53 host2 sshd[2716424]: Disconnected from invalid user alex 83.168.69.143 port 52792 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.168.69.143
country_id: 798544
description:
Dec 21 22:11:25 host2 sshd[2716881]: Disconnected from invalid user app 83.168.69.143 port 54158 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.214
country_id: 6252001
description:
Dec 21 22:11:56 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.192.214, lip=66.85.158.92, session=<mSgd/XhGSpIUQcDW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.104.127.219
country_id: 1269750
description:
Dec 21 22:17:10 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.104.127.219, lip=66.85.158.91, TLS, session=<SPuzDnlGbq1naH/b>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.143.228.155
country_id: 6252001
description:
Dec 21 22:16:49 host2 sshd[2722031]: Invalid user cloudtourssrilan_travel from 185.143.228.155 port 64332


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.50.1
country_id: 953987
description:
Dec 21 22:16:50 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=102.129.50.1, lip=66.85.158.91, TLS, session=<EDNiDXlGhtFmgTIB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-21 22:19:10 dovecot_login authenticator failed for H=177.162.84.34.bc.googleusercontent.com [34.84.162.177]:60645: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.144
country_id: 6252001
description:
Dec 21 22:19:12 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.144, lip=66.85.158.91, TLS handshaking: Connection closed, session=<SxcQF3lG38lAPsWQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.137
country_id: 6252001
description:
Dec 21 22:19:30 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.137, lip=66.85.158.91, TLS handshaking: Connection closed, session=<lbIiGHlG8lFAPsWJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2025-12-21 22:19:34 dovecot_login authenticator failed for H=([208.69.161.214]) [208.69.161.214]:38974: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.199.84.120
country_id: 6252001
description:
Dec 21 22:21:13 host2 pure-ftpd[2725802]: (?@198.199.84.120) [INFO] New connection from 198.199.84.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-12-21 22:21:39 dovecot_login authenticator failed for H=([128.185.208.42]) [128.185.208.42]:60266: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.91
country_id: 3175395
description:
Dec 21 22:21:40 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.15.169.91, lip=66.85.158.91, TLS, session=<JBfpHnlG3s65D6lb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.131
country_id: 3175395
description:
Dec 21 22:22:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<gihan>, method=PLAIN, rip=185.15.169.131, lip=66.85.158.91, TLS, session=<2WsBIHlGgLm5D6mD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.136
country_id: 3996063
description:
2025-12-21 22:22:31 dovecot_login authenticator failed for H=(201.173.250.136-clientes-izzi.mx) [201.173.250.136]:39161: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.224.244
country_id: 2921044
description:
Dec 21 22:25:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.209.224.244, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<TcS1LXlGkU+G0eD0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.166.74
country_id: 2921044
description:
Dec 21 22:26:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=164.90.166.74, lip=66.85.158.91, TLS handshaking: Connection closed, session=<xmzjL3lGvhykWqZK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.254.229.191
country_id: 3686110
description:
Dec 21 22:29:27 host2 sshd[2733241]: Disconnected from invalid user amit 170.254.229.191 port 54994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 21 22:31:00 host2 sshd[2734748]: Disconnected from invalid user smbguest 154.198.215.66 port 41300 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.140
country_id: 6252001
description:
Dec 21 22:31:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.140, lip=66.85.158.92, TLS: Connection closed, session=<qujDQXlGFvpChJmM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.198.215.66
country_id: 241170
description:
Dec 21 22:31:37 host2 sshd[2735340]: Disconnected from invalid user nodejs 154.198.215.66 port 53578 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-12-21 22:32:08 dovecot_login authenticator failed for H=([74.95.13.185]) [74.95.13.185]:58882: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Dec 21 22:33:11 host2 dovecot[1601669]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, session=<HUoRSXlGTAhChJl2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-12-21 22:32:29 dovecot_login authenticator failed for H=([103.5.63.166]) [103.5.63.166]:45070: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.198.215.66
country_id: 241170
description:
Dec 21 22:32:51 host2 sshd[2736311]: Disconnected from invalid user infra 154.198.215.66 port 49868 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.17
country_id: 3175395
description:
Dec 21 22:34:03 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<contact>, method=PLAIN, rip=185.15.171.17, lip=66.85.158.91, TLS, session=<1HUhS3lGLqO5D6sR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.85
country_id: 732800
description:
Dec 21 22:34:19 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<contact>, method=PLAIN, rip=185.253.159.85, lip=66.85.158.91, TLS, session=<6FImTHlGCLO5/Z9V>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.254.229.191
country_id: 3686110
description:
Dec 21 22:33:31 host2 sshd[2736890]: Disconnected from invalid user katja 170.254.229.191 port 43382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.212.90
country_id: 933860
description:
Dec 21 22:33:43 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=41.216.212.90, lip=66.85.158.91, TLS, session=<apOsSXlGRaQp2NRa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.226
country_id: 3865483
description:
Dec 21 22:34:01 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=179.0.250.226, lip=66.85.158.91, TLS, session=<gLrnSnlG3LazAPri>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-12-21 22:34:45 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (eptic) [73.183.74.177]:57666: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.221
country_id: 3017382
description:
Dec 21 22:43:27 host2 sshd[2746023]: Invalid user secondcoffeeinternational from 37.59.110.221 port 35896


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-12-21 22:45:47 dovecot_login authenticator failed for H=137.173.198.203.static.netvigator.com (145.173.198.203.static.netvigator.com) [203.198.173.137]:45278: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.110
country_id: 1269750
description:
2025-12-21 22:46:18 dovecot_login authenticator failed for H=(202.140.38.110.convergentindia.com) [202.140.38.110]:60582: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-12-21 22:46:48 dovecot_login authenticator failed for H=([103.168.241.32]) [103.168.241.32]:52254: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-12-21 22:48:26 dovecot_login authenticator failed for H=(nsg-static-145.58.71.182.airtel.in) [27.123.102.50]:37052: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-12-21 22:48:49 dovecot_login authenticator failed for H=(bb118-200-42-112.singnet.com.sg) [118.200.42.112]:54830: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.206
country_id: 1269750
description:
2025-12-21 22:49:28 dovecot_login authenticator failed for H=(nsg-corporate-206.64.186.122.airtel.in) [122.186.64.206]:48352: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-12-21 22:53:15 dovecot_login authenticator failed for H=([125.19.169.115]) [128.185.235.110]:34390: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.132.164.25
country_id: 2635167
description:
2025-12-21 22:54:35 dovecot_login authenticator failed for H=(ADMIN) [23.132.164.25]:56492: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Dec 21 22:55:41 host2 sshd[2757820]: Disconnected from invalid user livetest 159.223.8.81 port 42718 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.111
country_id: 6252001
description:
Dec 21 22:57:51 host2 pure-ftpd[2759767]: (?@147.185.132.111) [INFO] New connection from 147.185.132.111


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Dec 21 22:58:57 host2 sshd[2760770]: Disconnected from invalid user user01 159.223.8.81 port 57216 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.8.81
country_id: 2750405
description:
Dec 21 23:00:03 host2 sshd[2761825]: Disconnected from invalid user guest 159.223.8.81 port 53718 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.36.204
country_id: 3144096
description:
2025-12-21 23:01:10 dovecot_login authenticator failed for H=(cm-178.232.36.204.get.no) [178.232.36.204]:47576: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.98.97.183
country_id: 3077311
description:
Dec 21 23:01:13 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=176.98.97.183, lip=66.85.158.91, TLS, session=<APxjrHlGbMSwYmG3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Dec 21 23:00:37 host2 sshd[2762382]: Disconnected from invalid user ftest 159.223.8.81 port 44072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-21 23:01:26 dovecot_login authenticator failed for H=([1.7.229.162]) [136.232.73.130]:54550: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.72.200.48
country_id: 3077311
description:
Dec 21 23:01:32 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=178.72.200.48, lip=66.85.158.91, TLS, session=<jiVwrXlGGt+ySMgw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.30.170
country_id: 3144096
description:
2025-12-21 23:01:57 dovecot_login authenticator failed for H=([178.232.30.170]) [178.232.30.170]:45740: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-12-21 23:02:20 dovecot_login authenticator failed for H=(static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:54491: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 21 23:08:28 host2 pure-ftpd[2769004]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2025-12-21 23:11:18 dovecot_login authenticator failed for H=([182.73.109.194]) [182.73.109.194]:60120: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2025-12-21 23:10:57 dovecot_login authenticator failed for H=([49.124.151.78]) [49.124.151.78]:40138: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.194.231
country_id: 3144096
description:
2025-12-21 23:11:46 dovecot_login authenticator failed for H=(cm-178.232.194.231.get.no) [178.232.194.231]:47735: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-21 23:13:47 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:3735: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.11.216
country_id: 3144096
description:
2025-12-21 23:14:14 dovecot_login authenticator failed for H=(cm-84.211.11.216.get.no) [84.211.11.216]:38581: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.122
country_id: 1269750
description:
2025-12-21 23:14:36 dovecot_login authenticator failed for H=([182.95.178.122]) [182.95.178.122]:54050: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 23:21:14 host2 sshd[2779960]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Dec 21 23:31:14 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<8rC0GHpGKrRBMRRF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.201.62
country_id: 1269750
description:
2025-12-21 23:30:34 dovecot_login authenticator failed for H=(nsg-corporate-62.201.186.122.airtel.in) [122.186.201.62]:44666: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.142
country_id: 1269750
description:
2025-12-21 23:30:53 dovecot_login authenticator failed for H=([182.95.20.115]) [182.95.229.142]:38362: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Dec 21 23:31:36 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, TLS handshaking: Connection closed, session=<H+b5GXpGbINBMRRF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 21 23:34:58 host2 sshd[2791114]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.209.138
country_id: 798544
description:
Dec 21 23:35:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=91.246.209.138, lip=66.85.158.91, TLS, session=<5qlMJXpGq6xb9tGK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.98.134
country_id: 6290252
description:
Dec 21 23:34:44 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=109.206.98.134, lip=66.85.158.91, TLS, session=<55E0JHpG09NtzmKG>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.15.224.207
country_id: 6252001
description:
Dec 21 23:37:03 host2 pure-ftpd[2792887]: (?@20.15.224.207) [INFO] New connection from 20.15.224.207


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 21 23:37:50 host2 sshd[2793432]: Disconnected from invalid user amir 155.4.244.169 port 23101 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 21 23:39:06 host2 sshd[2794539]: Disconnected from invalid user cuckoo 155.4.244.169 port 19061 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 21 23:40:27 host2 sshd[2795707]: Disconnected from invalid user amir 158.69.194.34 port 60086 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 21 23:40:53 host2 sshd[2795993]: Disconnected from invalid user liwei 155.4.244.169 port 43859 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-12-21 23:42:03 dovecot_login authenticator failed for H=([41.72.201.170]) [41.72.202.86]:40690: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 21 23:42:10 host2 sshd[2796881]: Disconnected from invalid user hari 158.69.194.34 port 56450 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-12-21 23:41:23 dovecot_login authenticator failed for H=(IP-122-133.bol-online.com) [182.163.122.133]:36541: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.169
country_id: 2661886
description:
Dec 21 23:42:37 host2 sshd[2797215]: Disconnected from invalid user ubuntu 155.4.244.169 port 3342 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 21 23:42:38 host2 sshd[2797261]: Disconnected from invalid user lucas 209.141.47.217 port 48686 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.47.217
country_id: 6252001
description:
Dec 21 23:43:10 host2 sshd[2797777]: Disconnected from invalid user ahmet 209.141.47.217 port 59464 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 21 23:43:47 host2 sshd[2798201]: Disconnected from invalid user main 158.69.194.34 port 57012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.194
country_id: 6252001
description:
Dec 21 23:43:53 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.194, lip=66.85.158.91, session=<P2nxRXpGT6dBMQHC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.192
country_id: 6252001
description:
Dec 21 23:44:06 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.192, lip=66.85.158.91, TLS: Connection closed, session=<p96vRnpGnpxBMQHA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 21 23:45:20 host2 sshd[2800254]: Disconnected from invalid user liwei 141.147.62.42 port 57144 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 21 23:45:26 host2 sshd[2800367]: Received disconnect from 158.69.194.34 port 34454:11: Bye Bye [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.69.194.34
country_id: 6251999
description:
Dec 21 23:45:26 host2 sshd[2800367]: Disconnected from invalid user devops 158.69.194.34 port 34454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 21 23:54:01 host2 sshd[2807004]: Disconnected from invalid user Rizve 141.147.62.42 port 45778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 21 23:58:24 host2 sshd[2811118]: Disconnected from invalid user lucas 141.147.62.42 port 37592 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-21 23:59:49 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:33310: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.227.70
country_id: 1269750
description:
2025-12-22 00:00:11 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-145.59.23.125.airtelbroadband.in) [182.95.227.70]:49842: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 00:00:25 host2 sshd[2812972]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec 22 00:02:39 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<KlEPiXpGYJqLonHU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 22 00:02:46 host2 sshd[2814882]: Disconnected from invalid user ahmet 141.147.62.42 port 59776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.119
country_id: 3175395
description:
Dec 22 00:03:08 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=185.197.8.119, lip=66.85.158.91, TLS, session=<r03HiXpGaI25xQh3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.98
country_id: 690791
description:
Dec 22 00:03:26 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan>, method=PLAIN, rip=194.44.140.98, lip=66.85.158.91, TLS, session=<QfHYinpGhbzCLIxi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.197.135
country_id: 3144096
description:
2025-12-22 00:06:23 dovecot_login authenticator failed for H=(cm-178.232.197.135.get.no) [178.232.197.135]:38308: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 22 00:08:17 host2 sshd[2819621]: Disconnected from invalid user devops 141.147.62.42 port 43484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 00:09:25 host2 sshd[2820509]: Disconnected from invalid user admin 2.57.121.112 port 51776 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Dec 22 00:10:41 host2 sshd[2821827]: Disconnected from invalid user bo 40.115.18.231 port 43838 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 00:11:03 host2 pure-ftpd[2822339]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Dec 22 00:14:12 host2 sshd[2825420]: Disconnected from invalid user uno50 41.111.162.34 port 14948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.115.18.231
country_id: 2750405
description:
Dec 22 00:14:45 host2 sshd[2825933]: Disconnected from invalid user postgres 40.115.18.231 port 55584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 141.147.62.42
country_id: 2921044
description:
Dec 22 00:14:52 host2 sshd[2826056]: Disconnected from invalid user erfan 141.147.62.42 port 35072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-12-22 00:16:21 dovecot_login authenticator failed for H=(nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:39706: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 00:15:47 host2 sshd[2827148]: Disconnected from invalid user user 2.57.121.25 port 43434 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-12-22 00:16:33 dovecot_login authenticator failed for H=(201.173.250.42-clientes-izzi.mx) [201.173.250.42]:41240: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 00:18:20 host2 sshd[2829317]: Disconnected from invalid user syed 62.60.131.157 port 12775 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.111.162.34
country_id: 2589581
description:
Dec 22 00:19:04 host2 sshd[2829883]: Disconnected from invalid user ubuntu 41.111.162.34 port 18584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Dec 22 00:20:53 host2 sshd[2831810]: Disconnected from invalid user django 41.111.162.34 port 1649 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Dec 22 00:23:13 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+ceZ0npGfIHY2s5E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Dec 22 00:23:34 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZO7Y03pGJPXY2s5E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.103.85
country_id: 3469034
description:
Dec 22 00:23:43 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=186.224.103.85, lip=66.85.158.91, TLS, session=<bAta03pGLba64GdV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.60.116
country_id: 798544
description:
Dec 22 00:24:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=91.231.60.116, lip=66.85.158.91, TLS, session=<Wwh41HpGU45b5zx0>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.220.185.118
country_id: 6252001
description:
Dec 22 00:29:47 host2 pure-ftpd[2840147]: (?@44.220.185.118) [INFO] New connection from 44.220.185.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-12-22 00:31:22 dovecot_login authenticator failed for H=81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:43476: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-12-22 00:31:50 dovecot_login authenticator failed for H=ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:55588: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.189
country_id: 6252001
description:
Dec 22 00:35:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.62.156.189, lip=66.85.158.92, session=<v2bP/3pGvUJAPpy9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.182
country_id: 6252001
description:
Dec 22 00:36:05 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.182, lip=66.85.158.92, TLS: Connection closed, session=<s9eYAHtGHBhAPpy2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.126.146
country_id: 3144096
description:
2025-12-22 00:36:51 dovecot_login authenticator failed for H=(cm-178.232.126.146.get.no) [178.232.126.146]:59526: 535 Incorrect authentication data (set_id=hnt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.77.210.69
country_id: 6252001
description:
2025-12-22 00:36:38 dovecot_login authenticator failed for H=wsip-174-77-210-69.lf.br.cox.net [174.77.210.69]:58446: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-12-22 00:40:47 dovecot_login authenticator failed for H=([152.52.12.201]) [152.52.245.38]:48508: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Dec 22 00:40:50 host2 sshd[2850312]: Disconnected from invalid user csgoserver 103.13.206.142 port 56952 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.72.59
country_id: 3996063
description:
2025-12-22 00:41:07 dovecot_login authenticator failed for H=(201.173.72.59-clientes-izzi.mx) [201.173.72.59]:48010: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.88.76.27
country_id: 1269750
description:
Dec 22 00:41:16 host2 sshd[2850621]: Disconnected from invalid user db2inst1 103.88.76.27 port 59234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.206.142
country_id: 1643084
description:
Dec 22 00:41:35 host2 sshd[2850836]: Disconnected from invalid user dalia 103.13.206.142 port 38956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.112.2
country_id: 149590
description:
2025-12-22 00:42:09 dovecot_login authenticator failed for H=([41.93.112.2]) [41.93.112.2]:51164: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.110
country_id: 1269750
description:
2025-12-22 00:42:53 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-201.85.23.125.airtelbroadband.in) [182.95.57.110]:32908: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.206.142
country_id: 1643084
description:
Dec 22 00:43:00 host2 sshd[2851823]: Disconnected from invalid user ubuntu 103.13.206.142 port 50752 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.57
country_id: 6252001
description:
Dec 22 00:45:55 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.57, lip=66.85.158.92, TLS, session=</gTOI3tGKPvN0h85>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.234
country_id: 6252001
description:
Dec 22 00:52:04 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.234, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<zL3FOXtG7srN0h/q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.59.110.221
country_id: 3017382
description:
Dec 22 00:53:15 host2 sshd[2859996]: Invalid user secondcoffeeinternational from 37.59.110.221 port 49048


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 94.102.49.155
country_id: 2750405
description:
Dec 22 00:56:06 host2 pure-ftpd[2862477]: (?@94.102.49.155) [INFO] New connection from 94.102.49.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.224.18.139
country_id: 6252001
description:
2025-12-22 00:57:02 dovecot_plain authenticator failed for H=ec2-54-224-18-139.compute-1.amazonaws.com (EC2AMAZ-7E395FK.ec2.internal) [54.224.18.139]:55363: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.75.222.34
country_id: 3077311
description:
Dec 22 01:04:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=217.75.222.34, lip=66.85.158.91, TLS, session=<tguXZHtG6N/ZS94i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.90
country_id: 298795
description:
Dec 22 01:04:39 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=95.0.32.90, lip=66.85.158.91, TLS, session=<rwDDZXtGPZRfACBa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 22 01:08:53 host2 sshd[2872697]: Disconnected from invalid user gitlab-runner 172.245.208.136 port 53860 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 01:09:39 host2 sshd[2873046]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 22 01:10:00 host2 sshd[2873251]: Disconnected from invalid user salma 172.245.208.136 port 59980 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 22 01:10:31 host2 sshd[2873839]: Disconnected from invalid user cma 172.245.208.136 port 54244 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.76.55.177
country_id: 3175395
description:
2025-12-22 01:10:53 dovecot_login authenticator failed for H=([127.0.0.1]) [151.76.55.177]:39154: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.137.91
country_id: 6252001
description:
2025-12-22 01:11:00 dovecot_login authenticator failed for H=wsip-70-166-137-91.fv.ks.cox.net ([127.0.0.1]) [70.166.137.91]:40376: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 22 01:13:12 host2 sshd[2876030]: Received disconnect from 172.245.208.136 port 54172:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Dec 22 01:13:12 host2 sshd[2876030]: Disconnected from invalid user new 172.245.208.136 port 54172 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 01:13:24 host2 pure-ftpd[2876151]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-22 01:20:48 dovecot_login authenticator failed for H=([152.52.234.46]) [182.95.176.194]:52040: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.91.230
country_id: 3865483
description:
Dec 22 01:30:17 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan>, method=PLAIN, rip=190.181.91.230, lip=66.85.158.91, TLS, session=<z+YgwXtGuJS+tVvm>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 94.102.49.155
country_id: 2750405
description:
Dec 22 01:29:27 host2 pure-ftpd[2888986]: (?@94.102.49.155) [INFO] New connection from 94.102.49.155


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.217.112.99
country_id: 798544
description:
Dec 22 01:29:51 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=178.217.112.99, lip=66.85.158.91, TLS, session=<u7Prv3tGL6+y2XBj>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.94.133.80
country_id: 1643084
description:
[2025-12-22 01:33:20 +0530] info [whostmgrd] 103.94.133.80 - info@idesignvector.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.94.133.80
country_id: 1643084
description:
Dec 22 01:33:21 host2 sshd[2892376]: Invalid user info@idesignvector.com from 103.94.133.80 port 53162


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 01:32:26 host2 sshd[2891539]: Disconnected from invalid user dexter 62.60.131.157 port 12754 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.94.133.80
country_id: 1643084
description:
Dec 22 01:33:20 host2 pure-ftpd[2892379]: (?@103.94.133.80) [INFO] New connection from 103.94.133.80


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.105.191.6
country_id: 6252001
description:
[2025-12-22 01:33:36 +0530] info [whostmgrd] 143.105.191.6 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.221.60.108
country_id: 6252001
description:
Dec 22 01:34:28 host2 pure-ftpd[2893322]: (?@20.221.60.108) [INFO] New connection from 20.221.60.108


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 22 01:38:11 host2 sshd[2896329]: Disconnected from invalid user sammy 103.171.85.219 port 45954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-22 01:39:05 dovecot_plain authenticator failed for H=c-73-137-7-97.hsd1.ga.comcast.net (retthory) [73.137.7.97]:54090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.43.148.30
country_id: 3175395
description:
Dec 22 01:40:20 host2 sshd[2898091]: Disconnected from invalid user db2fenc 151.43.148.30 port 8677 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.219
country_id: 1643084
description:
Dec 22 01:39:38 host2 sshd[2897403]: Disconnected from invalid user email 103.171.85.219 port 38648 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 22 01:39:40 host2 sshd[2897434]: Disconnected from invalid user db2inst1 64.23.180.137 port 34554 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.23.180.137
country_id: 6252001
description:
Dec 22 01:40:44 host2 sshd[2898527]: Disconnected from invalid user cosmos 64.23.180.137 port 54488 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.93
country_id: 6252001
description:
Dec 22 01:43:58 host2 pure-ftpd[2900997]: (?@147.185.132.93) [INFO] New connection from 147.185.132.93


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2025-12-22 01:45:02 dovecot_login authenticator failed for H=([128.185.253.98]) [128.185.253.98]:37508: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2025-12-22 01:45:26 dovecot_login authenticator failed for H=([128.185.217.84]) [128.185.239.182]:45254: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-12-22 01:47:19 dovecot_login authenticator failed for H=89-67-37-2.dynamic.play.pl [89.67.37.2]:43318: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-22 01:47:42 dovecot_login authenticator failed for H=([187.7.85.97]) [201.15.149.254]:39041: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.43.148.30
country_id: 3175395
description:
Dec 22 01:47:33 host2 sshd[2904280]: Disconnected from invalid user irfan 151.43.148.30 port 8336 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 01:48:36 host2 sshd[2905083]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 152.32.186.240
country_id: 1819730
description:
Dec 22 01:54:58 host2 dovecot[1601669]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=152.32.186.240, lip=66.85.158.92, session=<7t+1GnxG0JqYILrw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.186.240
country_id: 1819730
description:
Dec 22 01:54:57 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.186.240, lip=66.85.158.92, session=<pcaiGnxGzpmYILrw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-12-22 01:56:17 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [223.197.153.135]:53039: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-12-22 01:56:57 dovecot_login authenticator failed for H=079.33.246.220.static.netvigator.com [220.246.33.79]:58974: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-12-22 02:04:59 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com [79.138.90.195]:50082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-12-22 02:05:23 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:36818: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.86
country_id: 6252001
description:
2025-12-22 02:08:17 dovecot_login authenticator failed for H=([63.65.203.86]) [63.65.203.86]:60367: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-12-22 02:08:40 dovecot_login authenticator failed for H=bl23-64-8.dsl.telepac.pt [144.64.64.8]:3918: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 02:08:59 host2 sshd[2924582]: Disconnected from invalid user abigale 62.60.131.157 port 16553 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.69.91
country_id: 2921044
description:
Dec 22 02:10:41 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=165.22.69.91, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<ewbrUnxGfyqlFkVb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-12-22 02:10:53 dovecot_login authenticator failed for H=(78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:57914: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.119.148
country_id: 2921044
description:
Dec 22 02:11:16 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=165.232.119.148, lip=66.85.158.92, TLS handshaking: Connection closed, session=<orYIVXxGoiCl6HeU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.178.78.157
country_id: 3996063
description:
Dec 22 02:11:55 host2 sshd[2927288]: Disconnected from invalid user oracle 189.178.78.157 port 56022 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.15.141
country_id: 6252001
description:
Dec 22 02:14:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.163.15.141, lip=66.85.158.92, TLS, session=<ZLj/X3xGUrAUow+N>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 02:15:48 host2 pure-ftpd[2930782]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.225.33
country_id: 6252001
description:
Dec 22 02:16:14 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.15.225.33, lip=66.85.158.91, TLS, session=<2Y/CZnxGaroUD+Eh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-12-22 02:17:51 dovecot_login authenticator failed for H=li2180-133.members.linode.com [192.46.237.133]:58522: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.6.176
country_id: 298795
description:
2025-12-22 02:20:13 dovecot_login authenticator failed for H=([188.59.6.176]) [188.59.6.176]:53786: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.222
country_id: 3996063
description:
2025-12-22 02:21:07 dovecot_login authenticator failed for H=([177.236.146.222]) [177.236.146.222]:33186: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-12-22 02:20:47 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:41806: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 02:26:04 host2 sshd[2939044]: Disconnected from invalid user admin 2.57.121.112 port 20561 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
country_id: 294640
description:
2025-12-22 02:28:20 dovecot_login authenticator failed for H=([185.246.255.183]) [185.246.255.183]:34714: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.40.238
country_id: 1210997
description:
2025-12-22 02:28:49 dovecot_login authenticator failed for H=([49.0.40.238]) [49.0.40.238]:34650: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-12-22 02:29:04 dovecot_login authenticator failed for H=([124.246.114.111]) [124.246.114.111]:46699: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-12-22 02:31:32 dovecot_login authenticator failed for H=107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:4921: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-22 02:32:01 dovecot_login authenticator failed for H=([125.19.196.207]) [27.123.104.142]:51386: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.16
country_id: 6252001
description:
Dec 22 02:34:37 host2 pure-ftpd[2946103]: (?@147.185.132.16) [INFO] New connection from 147.185.132.16


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 22 02:36:17 host2 sshd[2947756]: Disconnected from invalid user sysadmin 103.139.192.221 port 60970 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Dec 22 02:36:38 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@seyawin.com>, method=PLAIN, rip=193.30.97.33, lip=66.85.158.91, session=<ckOer3xGPObBHmEh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 22 02:36:50 host2 sshd[2948138]: Disconnected from invalid user t128 199.195.248.191 port 56106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 22 02:38:31 host2 sshd[2949381]: Disconnected from invalid user teste2 199.195.248.191 port 37496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 22 02:38:43 host2 sshd[2949524]: Disconnected from invalid user bitnami 198.23.143.193 port 40020 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.23.143.193
country_id: 6252001
description:
Dec 22 02:39:52 host2 sshd[2950484]: Disconnected from invalid user developer 198.23.143.193 port 39096 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 22 02:41:45 host2 sshd[2952299]: Received disconnect from 199.195.248.191 port 56732:11: Bye Bye [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec 22 02:41:48 host2 sshd[2952325]: Disconnected from invalid user pepe 177.85.247.230 port 25244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.248.191
country_id: 6252001
description:
Dec 22 02:42:18 host2 sshd[2952657]: Disconnected from invalid user test1 199.195.248.191 port 41118 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.85.247.230
country_id: 3469034
description:
Dec 22 02:42:59 host2 sshd[2953093]: Disconnected from invalid user mario 177.85.247.230 port 7844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.85.247.230
country_id: 3469034
description:
Dec 22 02:43:31 host2 sshd[2953599]: Disconnected from invalid user sign 177.85.247.230 port 28010 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.23.199.119
country_id: 1643084
description:
Dec 22 02:44:40 host2 sshd[2954407]: Disconnected from invalid user alpha 103.23.199.119 port 56926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 22 02:47:52 host2 sshd[2957678]: Disconnected from invalid user teste2 103.139.192.221 port 47474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 22 02:48:41 host2 sshd[2958285]: Disconnected from invalid user markus 103.139.192.221 port 33036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2025-12-22 02:51:19 dovecot_login authenticator failed for H=144.46.246.220.static.netvigator.com [220.246.46.144]:60890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.192.221
country_id: 1643084
description:
Dec 22 02:51:03 host2 sshd[2960284]: Disconnected from invalid user root1 103.139.192.221 port 46194 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.188.10
country_id: 3144096
description:
2025-12-22 02:51:45 dovecot_login authenticator failed for H=(cm-178.232.188.10.get.no) [178.232.188.10]:42038: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.193
country_id: 6252001
description:
Dec 22 02:53:58 host2 dovecot[1601669]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.193, lip=66.85.158.91, session=<Zwq27XxG9Nes7OTB>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 02:57:31 host2 sshd[2965543]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 02:59:17 host2 sshd[2966668]: Disconnected from invalid user admin 2.57.121.112 port 12793 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.99.94
country_id: 3996063
description:
Dec 22 02:58:41 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=138.122.99.94, lip=66.85.158.91, TLS, session=<RaOW/XxG++OKemNe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.5
country_id: 798544
description:
Dec 22 02:59:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=77.65.142.5, lip=66.85.158.91, TLS, session=<qrOt/nxGOsBNQY4F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.81.30.149
country_id: 2921044
description:
Dec 22 02:59:48 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=206.81.30.149, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<JGiXAn1GBUHOUR6V>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.206.154
country_id: 2921044
description:
Dec 22 03:00:23 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.206.154, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DeGxBH1GvIMuZc6a>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.163
country_id: 3996063
description:
2025-12-22 03:06:21 dovecot_login authenticator failed for H=(201.172.88.163-clientes-izzi.mx) [201.172.88.163]:54313: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2025-12-22 03:06:35 dovecot_login authenticator failed for H=([176.30.212.99]) [176.30.212.99]:52646: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-12-22 03:14:49 dovecot_login authenticator failed for H=([177.236.146.209]) [177.236.146.209]:52934: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2025-12-22 03:15:10 dovecot_login authenticator failed for H=([1.7.229.162]) [136.232.73.130]:58068: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.51.208.158
country_id: 3469034
description:
Dec 22 03:16:27 host2 sshd[2979681]: Disconnected from invalid user doc 187.51.208.158 port 40331 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.207.165
country_id: 1643084
description:
Dec 22 03:16:53 host2 sshd[2980043]: Disconnected from invalid user dan 157.20.207.165 port 57248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 22 03:17:06 host2 sshd[2980266]: Disconnected from invalid user ansible 83.229.122.23 port 50902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.51.208.158
country_id: 3469034
description:
Dec 22 03:17:25 host2 sshd[2980522]: Disconnected from invalid user ansible 187.51.208.158 port 48580 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 03:17:48 host2 pure-ftpd[2980836]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.250.154
country_id: 3865483
description:
Dec 22 03:18:14 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 29 secs): user=<gihan>, method=PLAIN, rip=179.0.250.154, lip=66.85.158.91, TLS, session=<JuDDQn1GTLmzAPqa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.105.219.200
country_id: 690791
description:
Dec 22 03:17:33 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=176.105.219.200, lip=66.85.158.91, TLS, session=<qHgPQX1GRsywadvI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 22 03:19:01 host2 sshd[2981722]: Disconnected from invalid user dan 83.229.122.23 port 52998 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.51.208.158
country_id: 3469034
description:
Dec 22 03:20:19 host2 sshd[2982797]: Disconnected from invalid user dan 187.51.208.158 port 47892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.117
country_id: 6252001
description:
Dec 22 03:19:31 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.117, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<7FgWSX1GV92TuYR1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.207.165
country_id: 1643084
description:
Dec 22 03:21:08 host2 sshd[2983400]: Disconnected from invalid user hari 157.20.207.165 port 38712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 03:21:26 host2 sshd[2983718]: Disconnected from invalid user abagail 62.60.131.157 port 36186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.51.208.158
country_id: 3469034
description:
Dec 22 03:21:42 host2 sshd[2983888]: Disconnected from invalid user hari 187.51.208.158 port 33429 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-12-22 03:22:39 dovecot_login authenticator failed for H=([103.107.36.18]) [103.107.36.18]:42306: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.21
country_id: 1269750
description:
2025-12-22 03:22:58 dovecot_login authenticator failed for H=(nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:41082: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Dec 22 03:22:57 host2 sshd[2984674]: Disconnected from invalid user flussonic 83.229.122.23 port 58314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.20.207.165
country_id: 1643084
description:
Dec 22 03:23:01 host2 sshd[2984725]: Disconnected from invalid user qq 157.20.207.165 port 41746 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.20.207.165
country_id: 1643084
description:
Dec 22 03:25:20 host2 sshd[2986535]: Disconnected from invalid user doc 157.20.207.165 port 59044 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.63
country_id: 1733045
description:
2025-12-22 03:27:59 dovecot_login authenticator failed for H=([49.124.151.63]) [49.124.151.63]:54660: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-12-22 03:28:22 dovecot_login authenticator failed for H=([65.20.205.228]) [65.20.205.228]:50201: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec 22 03:30:23 host2 sshd[2990771]: Disconnected from invalid user user 2.57.121.25 port 23935 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.251.122.86
country_id: 3017382
description:
2025-12-22 03:30:52 dovecot_plain authenticator failed for H=(myvm5.evyo5qjl14qe1exzla54i1z3rh.parx.internal.cloudapp.net) [4.251.122.86]:49246: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-22 03:33:27 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [122.186.202.58]:50374: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.156
country_id: 6252001
description:
2025-12-22 03:34:20 dovecot_login authenticator failed for H=([127.0.0.1]) [24.121.1.156]:37536: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.132.97.76
country_id: 2264397
description:
2025-12-22 03:33:51 dovecot_login authenticator failed for H=a94-132-97-76.cpe.netcabo.pt [94.132.97.76]:55334: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.211.57.196
country_id: 6252001
description:
2025-12-22 03:34:13 dovecot_login authenticator failed for H=wsip-72-211-57-196.lv.lv.cox.net ([127.0.0.1]) [72.211.57.196]:43459: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 03:36:20 host2 sshd[2996689]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-12-22 03:37:08 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:52063: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-12-22 03:37:27 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:54427: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-12-22 03:40:00 dovecot_login authenticator failed for H=([128.185.241.123]) [152.52.213.98]:47068: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-12-22 03:40:19 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:60973: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.34.72.212
country_id: 1668284
description:
[2025-12-22 03:41:48 +0530] info [cpaneld] 1.34.72.212 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.169
country_id: 6252001
description:
Dec 22 03:41:53 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=198.235.24.169, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<BNQYmX1GbcPG6xip>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 22 03:49:57 host2 sshd[3012947]: Disconnected from invalid user scanner 49.204.74.149 port 37030 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 22 03:51:33 host2 sshd[3014193]: Disconnected from invalid user wp 49.204.74.149 port 35670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.204.74.149
country_id: 1269750
description:
Dec 22 03:52:47 host2 sshd[3014652]: Disconnected from invalid user vicente 49.204.74.149 port 59286 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.213.52
country_id: 1819730
description:
Dec 22 03:55:21 host2 sshd[3016783]: Disconnected from invalid user wp 123.58.213.52 port 57914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Dec 22 03:54:48 host2 sshd[3016264]: Disconnected from invalid user amstest 123.58.213.52 port 49476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.52
country_id: 1819730
description:
Dec 22 03:55:54 host2 sshd[3017111]: Disconnected from invalid user carlos1 123.58.213.52 port 46092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 03:57:17 host2 sshd[3017997]: Disconnected from invalid user janiya 62.60.131.157 port 8048 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.130.148.217
country_id: 1512440
description:
2025-12-22 04:02:50 dovecot_login authenticator failed for H=([45.130.148.217]) [45.130.148.217]:36552: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-12-22 04:03:06 dovecot_login authenticator failed for H=([152.52.236.122]) [152.52.236.122]:54716: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.169.221
country_id: 3144096
description:
2025-12-22 04:05:58 dovecot_login authenticator failed for H=(221-169-97-62.cust.smartcall.no) [62.97.169.221]:48625: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-12-22 04:06:14 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.210.86]:52506: 535 Incorrect authentication data (set_id=marketing)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 62.60.131.162
country_id: 130758
description:
Denial of Service (DoS) attack was discovered from 62.60.131.162: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2025-12-22 04:09:23 dovecot_login authenticator failed for H=([201.219.68.189]) [201.219.68.189]:40082: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.55
country_id: 798544
description:
Dec 22 04:10:20 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<designdpt>, method=PLAIN, rip=77.65.142.55, lip=66.85.158.91, TLS, session=<ww/e/X1GHaRNQY43>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-12-22 04:09:40 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [64.49.97.15]:37206: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 169.239.117.145
country_id: 2215636
description:
Dec 22 04:10:02 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<designdpt@colourmarklabels.com>, method=PLAIN, rip=169.239.117.145, lip=66.85.158.91, TLS, session=<gQ25/H1Gzeyp73WR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.231.122.53
country_id: 798544
description:
Dec 22 04:14:12 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 10 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=91.231.122.53, lip=66.85.158.91, session=<ITcRDH5Gecxb53o1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.27.148.94
country_id: 192950
description:
Dec 22 04:13:46 host2 sshd[3032866]: Disconnected from invalid user jay 105.27.148.94 port 53428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Dec 22 04:14:25 host2 sshd[3033385]: Disconnected from invalid user irfan 105.27.148.94 port 39218 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.157.130
country_id: 690791
description:
Dec 22 04:14:31 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=37.221.157.130, lip=66.85.158.91, TLS, session=<NgDGDH5GwLYl3Z2C>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-12-22 04:15:21 dovecot_login authenticator failed for H=([45.170.50.2]) [45.170.50.2]:37231: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
country_id: 3469034
description:
2025-12-22 04:15:51 dovecot_login authenticator failed for H=([200.195.67.82]) [200.195.67.82]:35633: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.163
country_id: 3996063
description:
2025-12-22 04:16:09 dovecot_login authenticator failed for H=(201.172.88.163-clientes-izzi.mx) [201.172.88.163]:40803: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Dec 22 04:17:24 host2 sshd[3036522]: Disconnected from invalid user prometheus 190.117.52.211 port 52812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 22 04:17:46 host2 sshd[3036774]: Disconnected from invalid user clamav 103.136.43.74 port 56974 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 04:20:13 host2 pure-ftpd[3039931]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-22 04:20:50 dovecot_login authenticator failed for H=([213.55.79.199]) [213.55.79.195]:60048: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.114
country_id: 1269750
description:
2025-12-22 04:20:50 dovecot_login authenticator failed for H=(nsg-corporate-17.50.186.122.airtel.in) [182.95.61.114]:45796: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.92.14
country_id: 6252001
description:
Dec 22 04:21:37 host2 sshd[3041562]: Disconnected from invalid user clamav 162.214.92.14 port 60210 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.214.92.14
country_id: 6252001
description:
Dec 22 04:22:10 host2 sshd[3042227]: Disconnected from invalid user vhpadmin 162.214.92.14 port 46056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.117.52.211
country_id: 3932488
description:
Dec 22 04:22:41 host2 sshd[3042684]: Disconnected from invalid user vhpadmin 190.117.52.211 port 43766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-12-22 04:23:00 dovecot_login authenticator failed for H=(177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:35683: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.119
country_id: 6252001
description:
Dec 22 04:23:04 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.119, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<muxXLH5G/NHG6xh3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.214.92.14
country_id: 6252001
description:
Dec 22 04:23:51 host2 sshd[3044019]: Disconnected from invalid user usuario1 162.214.92.14 port 60070 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.2
country_id: 1269750
description:
2025-12-22 04:24:47 dovecot_login authenticator failed for H=([125.20.223.161]) [152.52.236.2]:41136: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 04:25:56 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (munsiver) [87.103.126.54]:28340: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.136.43.74
country_id: 2017370
description:
Dec 22 04:25:56 host2 sshd[3046860]: Disconnected from invalid user zcm 103.136.43.74 port 38176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.46.50.43
country_id: 290557
description:
Dec 22 04:26:46 host2 sshd[3048123]: Disconnected from invalid user vhpadmin 20.46.50.43 port 54756 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.110.166.67
country_id: 1694008
description:
Dec 22 04:27:20 host2 sshd[3048918]: Disconnected from invalid user admin 27.110.166.67 port 35962 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.46.50.43
country_id: 290557
description:
Dec 22 04:27:24 host2 sshd[3049034]: Disconnected from invalid user steam 20.46.50.43 port 51424 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-12-22 04:27:26 dovecot_login authenticator failed for H=([117.247.239.202]) [117.247.239.202]:41742: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 22 04:27:34 host2 sshd[3049205]: Disconnected from invalid user test2 42.200.66.164 port 45734 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.156
country_id: 6252001
description:
Dec 22 04:28:11 host2 sshd[3050037]: Disconnected from invalid user joao 108.85.73.156 port 36312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-12-22 04:28:18 dovecot_login authenticator failed for H=([118.26.153.84]) [118.26.153.84]:54034: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.156
country_id: 6252001
description:
Dec 22 04:28:57 host2 sshd[3051061]: Disconnected from invalid user deployer 108.85.73.156 port 39862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Dec 22 04:29:58 host2 sshd[3052119]: Disconnected from invalid user leo 42.200.66.164 port 43226 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.156
country_id: 6252001
description:
Dec 22 04:30:07 host2 sshd[3052451]: Disconnected from invalid user temp 108.85.73.156 port 37090 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 22 04:29:20 host2 sshd[3051490]: Disconnected from invalid user ironman 188.166.156.169 port 54116 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.110.166.67
country_id: 1694008
description:
Dec 22 04:30:44 host2 sshd[3053194]: Disconnected from invalid user soporte 27.110.166.67 port 41098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 22 04:30:45 host2 sshd[3053209]: Disconnected from invalid user 1 156.236.75.64 port 44454 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.82.64.201
country_id: 6252001
description:
2025-12-22 04:31:00 dovecot_login authenticator failed for H=([172.82.64.201]) [172.82.64.201]:42050: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 22 04:30:21 host2 sshd[3052791]: Disconnected from invalid user ftpuser 188.166.156.169 port 44582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-12-22 04:31:41 dovecot_login authenticator failed for H=(70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52590: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 22 04:32:07 host2 sshd[3054883]: Disconnected from invalid user wagner 107.175.89.172 port 58136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2025-12-22 04:32:17 dovecot_login authenticator failed for H=(171.140.212.218.starhub.net.sg) [218.212.140.171]:24798: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.156.169
country_id: 2635167
description:
Dec 22 04:31:22 host2 sshd[3053861]: Disconnected from invalid user ming 188.166.156.169 port 59474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 22 04:33:14 host2 sshd[3056219]: Disconnected from invalid user wagner 156.236.75.64 port 42426 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.156
country_id: 6252001
description:
Dec 22 04:32:49 host2 sshd[3055748]: Disconnected from invalid user webadmin 108.85.73.156 port 46026 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-12-22 04:32:53 dovecot_login authenticator failed for H=([182.79.95.231]) [152.52.244.46]:39508: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.75.64
country_id: 1819730
description:
Dec 22 04:33:52 host2 sshd[3057000]: Disconnected from invalid user auditor 156.236.75.64 port 33230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.85.73.156
country_id: 6252001
description:
Dec 22 04:33:20 host2 sshd[3056338]: Disconnected from invalid user test 108.85.73.156 port 52760 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-12-22 04:34:59 dovecot_login authenticator failed for H=ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:35334: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.48.80.134
country_id: 1210997
description:
Dec 22 04:34:24 host2 sshd[3057659]: Disconnected from invalid user wagner 182.48.80.134 port 54824 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-12-22 04:34:48 dovecot_login authenticator failed for H=([65.20.191.97]) [65.20.191.97]:53250: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.48.80.134
country_id: 1210997
description:
Dec 22 04:35:40 host2 sshd[3059303]: Disconnected from invalid user ansibleuser 182.48.80.134 port 48040 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.217.116.28
country_id: 6252001
description:
Dec 22 04:36:51 host2 sshd[3060784]: Disconnected from invalid user taylor 13.217.116.28 port 55022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 22 04:37:19 host2 sshd[3061214]: Disconnected from invalid user rust 107.175.89.172 port 48720 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.48.12.87
country_id: 2510769
description:
Dec 22 04:37:55 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=83.48.12.87, lip=66.85.158.91, TLS, session=<BSN1YH5GO75TMAxX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2025-12-22 04:37:59 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [182.95.228.194]:34652: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-12-22 04:37:46 dovecot_login authenticator failed for H=(nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:52076: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 13.217.116.28
country_id: 6252001
description:
Dec 22 04:37:46 host2 sshd[3061780]: Disconnected from invalid user storm 13.217.116.28 port 45184 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.98.154
country_id: 6290252
description:
Dec 22 04:38:23 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.206.98.154, lip=66.85.158.91, TLS, session=<W/0kYn5Gc9ltzmKa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 13.217.116.28
country_id: 6252001
description:
Dec 22 04:38:33 host2 sshd[3062862]: Disconnected from invalid user paula 13.217.116.28 port 35760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 22 04:39:22 host2 sshd[3063618]: Disconnected from invalid user juan 107.175.89.172 port 50858 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-12-22 04:39:37 dovecot_login authenticator failed for H=187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:55992: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-12-22 04:40:03 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:50354: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-12-22 04:40:25 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:49100: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.44.231
country_id: 1168579
description:
2025-12-22 04:40:45 dovecot_login authenticator failed for H=([203.124.44.231]) [203.124.44.231]:38166: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-12-22 04:43:08 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:38258: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-12-22 04:43:23 dovecot_login authenticator failed for H=(syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:44995: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec 22 04:45:11 host2 sshd[3071806]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.54
country_id: 1819730
description:
Dec 22 04:45:06 host2 sshd[3071376]: Disconnected from invalid user deploy 156.236.75.54 port 44212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.54
country_id: 1819730
description:
Dec 22 04:46:00 host2 sshd[3073420]: Disconnected from invalid user ubuntu 156.236.75.54 port 56448 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.236.75.54
country_id: 1819730
description:
Dec 22 04:47:11 host2 sshd[3074589]: Disconnected from invalid user going 156.236.75.54 port 52698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.0.216.227
country_id: 6252001
description:
Dec 22 04:47:19 host2 sshd[3074702]: Disconnected from invalid user tech 162.0.216.227 port 54280 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.89.172
country_id: 6252001
description:
Dec 22 04:47:33 host2 sshd[3074859]: Disconnected from invalid user up 107.175.89.172 port 38314 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.175.56
country_id: 3017382
description:
Dec 22 04:51:39 host2 sshd[3078539]: Disconnected from invalid user jerry 51.68.175.56 port 36996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.0.216.227
country_id: 6252001
description:
Dec 22 04:52:24 host2 sshd[3079309]: Disconnected from invalid user ubuntu 162.0.216.227 port 45982 [preauth]


plugin: ossec
rule: 5761
name: Multiple SSHD authentication disconnects. Possible brute-force attack
abuser: 162.0.216.227
country_id: 6252001
description:
Dec 22 04:53:32 host2 sshd[3080243]: Received disconnect from 162.0.216.227 port 48200:11: Bye Bye [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-12-22 04:54:01 dovecot_login authenticator failed for H=(beta.corporatecitizen.in) [103.29.235.44]:36716: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.229.6
country_id: 149590
description:
2025-12-22 04:54:15 dovecot_login authenticator failed for H=([41.59.229.6]) [41.59.229.6]:49420: 535 Incorrect authentication data (set_id=ronaldjohnston)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-12-22 04:55:14 dovecot_login authenticator failed for H=([196.191.212.235]) [213.55.85.202]:3967: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.41.27
country_id: 1269750
description:
2025-12-22 04:55:16 dovecot_login authenticator failed for H=([127.0.0.1]) [59.98.41.27]:48803: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.0.216.227
country_id: 6252001
description:
Dec 22 04:54:34 host2 sshd[3081617]: Disconnected from invalid user richard 162.0.216.227 port 55048 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.43.27
country_id: 3144096
description:
2025-12-22 04:55:28 dovecot_login authenticator failed for H=([127.0.0.1]) [178.232.43.27]:50178: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.79
country_id: 2300660
description:
2025-12-22 04:56:20 dovecot_login authenticator failed for H=([197.251.249.79]) [197.251.249.79]:50113: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-22 04:56:56 dovecot_login authenticator failed for H=54.126.103.87.rev.vodafone.pt [87.103.126.54]:34215: 535 Incorrect authentication data (set_id=zxup4hcs@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-12-22 04:57:35 dovecot_login authenticator failed for H=([180.188.143.166]) [180.188.143.166]:41799: 535 Incorrect authentication data (set_id=zxup4hcs)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec 22 05:08:28 host2 sshd[3093836]: Disconnected from invalid user keyon 62.60.131.157 port 57712 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-12-22 05:12:13 dovecot_login authenticator failed for H=(229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:45359: 535 Incorrect authentication data (set_id=amila@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-12-22 05:12:28 dovecot_login authenticator failed for H=(ccabv.org9.static.gvt.net.br) [187.58.241.90]:37138: 535 Incorrect authentication data (set_id=amila)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-12-22 05:15:26 dovecot_plain authenticator failed for H=c-24-15-216-41.hsd1.il.comcast.net (curgale) [24.15.216.41]:41166: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 05:22:41 host2 pure-ftpd[3105087]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.214
country_id: 1643084
description:
Dec 22 05:25:52 host2 sshd[3107760]: Disconnected from invalid user wj 103.187.147.214 port 40410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-12-22 05:30:51 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:44178: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2025-12-22 05:31:20 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:44940: 535 Incorrect authentication data (set_id=ronaldjohnston@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-12-22 05:32:29 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (hytors) [73.176.157.57]:58948: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.188.130
country_id: 3144096
description:
2025-12-22 05:35:53 dovecot_login authenticator failed for H=(cm-84.213.188.130.get.no) [84.213.188.130]:43148: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2025-12-22 05:35:35 dovecot_login authenticator failed for H=(adsl-181-129-31-42.une.net.co) [181.129.31.42]:33546: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.179.129
country_id: 3144096
description:
2025-12-22 05:43:31 dovecot_login authenticator failed for H=([127.0.0.1]) [84.213.179.129]:42615: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.121.74.83
country_id: 1269750
description:
2025-12-22 05:43:40 dovecot_login authenticator failed for H=([127.0.0.1]) [103.121.74.83]:60600: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec 22 05:47:39 host2 sshd[3125694]: Disconnected from invalid user admin 2.57.121.112 port 49788 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.119.148
country_id: 2921044
description:
Dec 22 05:49:52 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=165.232.119.148, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Hv7IYn9Gamil6HeU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.146
country_id: 798544
description:
Dec 22 05:53:18 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=46.20.58.146, lip=66.85.158.91, TLS, session=<kAQXbn9GaIwuFDqS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.141
country_id: 1269750
description:
Dec 22 05:53:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=103.51.223.141, lip=66.85.158.91, TLS, session=<bInnbH9GR9xnM9+N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.245
country_id: 6252001
description:
Dec 22 05:53:47 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.245, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yp7HcH9GfNbG6xj1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.56
country_id: 2921044
description:
2025-12-22 05:54:48 dovecot_login authenticator failed for H=(ZaNmZW9pOZ) [158.94.208.56]:62743: 535 Incorrect authentication data (set_id=dmch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.56
country_id: 2921044
description:
2025-12-22 05:55:36 dovecot_login authenticator failed for H=(FllWXMR) [158.94.208.56]:59453: 535 Incorrect authentication data (set_id=dmch)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.56
country_id: 2921044
description:
2025-12-22 05:56:26 dovecot_login authenticator failed for H=(h07f8Olfm) [158.94.208.56]:64418: 535 Incorrect authentication data (set_id=dmch)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.94.208.56
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[66.85.158.91] [Remote IP Address]=[158.94.208.56] [Authentication Database]=[mail] [Username]=[dmch] (5/5 failures) (blocked until [Mon Dec 22 00:41:24 2025 UTC/Mon Dec 22 06:11:24 2025 LOCAL])


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.141.198
country_id: 99237
description:
Dec 22 05:57:52 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=65.20.141.198, lip=66.85.158.91, TLS, session=<0ehefn9GhtdBFI3G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.31.149
country_id: 798544
description:
Dec 22 05:58:09 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<gihan>, method=PLAIN, rip=178.216.31.149, lip=66.85.158.91, TLS, session=<MoV1f39GPKmy2B+V>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-12-22 06:00:05 dovecot_login authenticator failed for H=(nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:51290: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2025-12-22 06:00:27 dovecot_login authenticator failed for H=([37.34.237.45]) [37.34.237.45]:37449: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.34
country_id: 1269750
description:
2025-12-22 06:01:48 dovecot_login authenticator failed for H=(nsg-corporate-6.249.186.122.airtel.in) [116.193.128.34]:48906: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 161.35.223.182
country_id: 2921044
description:
Dec 22 06:01:59 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=161.35.223.182, lip=66.85.158.92, session=<Evkfjn9GqeWhI9+2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.121.160
country_id: 2921044
description:
Dec 22 06:02:00 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=157.230.121.160, lip=66.85.158.92, session=<HQ0tjn9GuDud5nmg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-12-22 06:02:35 dovecot_login authenticator failed for H=([122.184.120.98]) [122.184.120.98]:35108: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-22 06:09:16 dovecot_login authenticator failed for H=(nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:38312: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.90
country_id: 1149361
description:
2025-12-22 06:09:42 dovecot_login authenticator failed for H=([149.54.15.90]) [149.54.15.90]:38020: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.118.138
country_id: 3144096
description:
2025-12-22 06:10:29 dovecot_login authenticator failed for H=(cm-46.212.118.138.get.no) [46.212.118.138]:56658: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 85.217.140.16
country_id: 798549
description:
Dec 22 06:11:03 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=85.217.140.16, lip=66.85.158.91, TLS: Connection closed, session=<tiOGrn9GmJtV2YwQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-12-22 06:11:20 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [186.179.100.129]:1351: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.149.45
country_id: 3144096
description:
2025-12-22 06:11:36 dovecot_login authenticator failed for H=(cm-84.210.149.45.get.no) [84.210.149.45]:50014: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.51
country_id: 6252001
description:
Dec 22 06:12:17 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.51, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2t31sn9GOsLN0h8z>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.14
country_id: 798549
description:
Dec 22 06:13:43 host2 pure-ftpd[3144535]: (?@85.217.149.14) [INFO] New connection from 85.217.149.14


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 85.217.149.14
country_id: 798549
description:
Dec 22 06:14:36 host2 pure-ftpd[3145206]: (?@85.217.149.14) [INFO] New connection from 85.217.149.14


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 85.217.149.14
country_id: 798549
description:
Dec 22 06:14:40 host2 pure-ftpd[3145259]: (?@85.217.149.14) [INFO] New connection from 85.217.149.14


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.39.212.84
country_id: 2510769
description:
Dec 22 06:18:16 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<gihan@gnetuniversals.com>, method=PLAIN, rip=46.39.212.84, lip=66.85.158.91, TLS, session=<Pz9cx39G2K4uJ9RU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.0.251.164
country_id: 3865483
description:
Dec 22 06:18:42 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<gihan>, method=PLAIN, rip=179.0.251.164, lip=66.85.158.91, TLS, session=<QWSTyH9G6+azAPuk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2025-12-22 06:19:03 dovecot_login authenticator failed for H=c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:54312: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.78
country_id: 1733045
description:
2025-12-22 06:19:30 dovecot_login authenticator failed for H=([49.124.151.78]) [49.124.151.78]:39344: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-12-22 06:20:55 dovecot_login authenticator failed for H=([115.240.244.52]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-22 06:20:39 dovecot_login authenticator failed for H=([125.20.183.201]) [27.123.90.94]:47282: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 22 06:22:16 host2 sshd[3151128]: Disconnected from invalid user gemma 160.251.101.169 port 59338 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 22 06:22:55 host2 sshd[3151608]: Disconnected from invalid user jean 160.251.101.169 port 32888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.101.169
country_id: 1861060
description:
Dec 22 06:23:33 host2 sshd[3152107]: Disconnected from invalid user sk 160.251.101.169 port 57622 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.99.252
country_id: 1880251
description:
Dec 22 06:25:16 host2 pure-ftpd[3153597]: (?@134.209.99.252) [INFO] New connection from 134.209.99.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-22 06:26:18 dovecot_login authenticator failed for H=7.248.146.34.bc.googleusercontent.com [34.146.248.7]:49804: 535 Incorrect authentication data (set_id=elizabethbowman@dragon.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-12-22 06:26:29 dovecot_login authenticator failed for H=([196.216.81.126]) [196.216.81.126]:48238: 535 Incorrect authentication data (set_id=elizabethbowman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 133.117.72.88
country_id: 1861060
description:
Dec 22 06:29:02 host2 sshd[3156495]: Disconnected from invalid user user3 133.117.72.88 port 54100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 133.117.72.88
country_id: 1861060
description:
Dec 22 06:30:00 host2 sshd[3156932]: Disconnected from invalid user teamspeak3 133.117.72.88 port 40624 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-12-22 06:30:06 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (symigoto) [174.161.27.82]:60428: 535 Incorrect authentication data (set_id=v-deploy@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-12-22 06:31:42 dovecot_login authenticator failed for H=(syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:44786: 535 Incorrect authentication data (set_id=587hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-12-22 06:32:08 dovecot_login authenticator failed for H=(nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:47118: 535 Incorrect authentication data (set_id=587hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.5.47
country_id: 6252001
description:
Dec 22 06:34:00 host2 dovecot[1601669]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=18.97.5.47, lip=66.85.158.92, TLS handshaking: Connection closed, session=<cNqZAIBGYKoSYQUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-12-22 06:34:00 dovecot_login authenticator failed for H=([125.20.249.39]) [128.185.214.78]:55522: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-12-22 06:34:19 dovecot_login authenticator failed for H=ip076.net-81-16-164.koping.net [81.16.164.76]:44536: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 22 06:35:21 host2 sshd[3161063]: Disconnected from invalid user test2 201.76.120.30 port 46256 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:36:37 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<b7f6CYBGYtMDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 22 06:36:49 host2 sshd[3162202]: Disconnected from invalid user ftpuser 201.76.120.30 port 38252 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.76.120.30
country_id: 3469034
description:
Dec 22 06:37:35 host2 sshd[3162688]: Disconnected from invalid user admin 201.76.120.30 port 50160 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec 22 06:39:30 host2 dovecot[1601669]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<zbVSFIBG5M4DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-12-22 06:40:45 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:55999: 535 Incorrect authentication data (set_id=hnt@essenceceylontea.com)


