# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.77.172.159
country_id: 3996063
description:
Dec  1 00:11:57 host2 sshd[4074523]: Disconnected from invalid user foundry 200.77.172.159 port 51618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec  1 00:12:07 host2 sshd[4074698]: Disconnected from invalid user bounce 203.150.107.244 port 50560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  1 00:11:28 host2 sshd[4073815]: Disconnected from invalid user mika 182.18.139.237 port 46652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.97.205.137
country_id: 1269750
description:
Dec  1 00:11:48 host2 sshd[4074294]: Disconnected from invalid user crafty 59.97.205.137 port 20130 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  1 00:12:29 host2 sshd[4074907]: Disconnected from invalid user crafty 182.18.139.237 port 42276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.165.17
country_id: 6251999
description:
Dec  1 00:12:30 host2 sshd[4074923]: Disconnected from invalid user deployer 54.39.165.17 port 54892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.150.107.244
country_id: 1605651
description:
Dec  1 00:13:22 host2 sshd[4075594]: Disconnected from invalid user runner 203.150.107.244 port 48894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.39.165.17
country_id: 6251999
description:
Dec  1 00:13:36 host2 sshd[4075701]: Disconnected from invalid user vlad 54.39.165.17 port 42700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.18.139.237
country_id: 1269750
description:
Dec  1 00:14:33 host2 sshd[4076372]: Disconnected from invalid user gerrit 182.18.139.237 port 33518 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.10.47.6
country_id: 1643084
description:
Dec  1 00:15:38 host2 sshd[4077191]: Disconnected from invalid user gerrit 114.10.47.6 port 35471 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-01 00:17:16 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:37966: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-12-01 00:17:26 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:54505: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.19.10.129
country_id: 3865483
description:
Dec  1 00:17:33 host2 sshd[4078260]: Disconnected from invalid user testftp 190.19.10.129 port 56192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.240
country_id: 1880251
description:
Dec  1 00:18:13 host2 sshd[4078698]: Disconnected from invalid user es 45.78.227.240 port 59470 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.75
country_id: 2510769
description:
2025-12-01 00:21:02 dovecot_login authenticator failed for (ADMIN) [212.102.49.75]:2252: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.207
country_id: 1880251
description:
Dec  1 00:28:49 host2 sshd[4085425]: Disconnected from invalid user sonar 45.78.207.207 port 33506 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.207.207
country_id: 1880251
description:
Dec  1 00:31:19 host2 sshd[4086945]: Disconnected from invalid user user4 45.78.207.207 port 38150 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.210.228
country_id: 6251999
description:
Dec  1 00:33:03 host2 pure-ftpd[4087896]: (?@148.113.210.228) [INFO] New connection from 148.113.210.228


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.210.228
country_id: 6251999
description:
Dec  1 00:33:14 host2 pure-ftpd[4087987]: (?@148.113.210.228) [INFO] New connection from 148.113.210.228


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.210.228
country_id: 6251999
description:
Dec  1 00:33:18 host2 pure-ftpd[4088027]: (?@148.113.210.228) [INFO] New connection from 148.113.210.228


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 00:36:08 host2 sshd[4089862]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.18
country_id: 3042225
description:
2025-12-01 00:36:56 dovecot_login authenticator failed for (ADMIN) [91.90.124.18]:25680: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-12-01 00:37:47 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:38108: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-12-01 00:38:27 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:40388: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.244
country_id: 1819730
description:
Dec  1 00:38:56 host2 sshd[4091293]: Disconnected from invalid user mailuser 118.193.43.244 port 60452 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-01 00:41:35 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:45406: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.43.244
country_id: 1819730
description:
Dec  1 00:41:40 host2 sshd[4093068]: Disconnected from invalid user airflow 118.193.43.244 port 37698 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.119
country_id: 6252001
description:
Dec  1 00:42:54 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.119, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<2oBOptREa9XG6xh3>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 44.220.185.131
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 44.220.185.131: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.244
country_id: 1819730
description:
Dec  1 00:45:18 host2 sshd[4097584]: Disconnected from invalid user andy 118.193.43.244 port 51706 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.43.244
country_id: 1819730
description:
Dec  1 00:46:33 host2 sshd[4098265]: Disconnected from invalid user vpn 118.193.43.244 port 56948 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Dec  1 00:49:54 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=34.122.105.182, lip=66.85.158.91, TLS: Connection closed, session=<s7FVv9REDKIiemm2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.54
country_id: 6252001
description:
2025-12-01 00:52:31 dovecot_login authenticator failed for (ADMIN) [173.244.56.54]:22417: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-12-01 00:57:15 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:42232: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-01 01:01:15 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:47310: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-12-01 01:01:15 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:41687: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-01 01:01:27 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:39820: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-12-01 01:01:49 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:53499: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2025-12-01 01:02:04 dovecot_login authenticator failed for ([125.19.171.126]) [152.52.197.174]:51756: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-01 01:02:04 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:48602: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 01:04:18 host2 sshd[4111112]: Disconnected from invalid user noor 62.60.131.157 port 34672 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.159
country_id: 6252001
description:
2025-12-01 01:09:22 dovecot_login authenticator failed for (ADMIN) [173.244.56.159]:40084: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-12-01 01:16:33 dovecot_login authenticator failed for ([27.123.119.235]) [122.185.176.126]:45234: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.247.80.227
country_id: 1269750
description:
2025-12-01 01:16:46 dovecot_login authenticator failed for ([47.247.80.227]) [47.247.80.227]:51288: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.82
country_id: 1149361
description:
2025-12-01 01:16:53 dovecot_login authenticator failed for ([149.54.51.82]) [149.54.51.82]:44555: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.25
country_id: 1220409
description:
Dec  1 01:17:04 host2 sshd[4120974]: Disconnected from invalid user botuser 185.121.0.25 port 43238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-12-01 01:17:12 dovecot_login authenticator failed for ([203.193.168.136]) [203.193.168.136]:41698: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.31.164.124
country_id: 6252001
description:
2025-12-01 01:17:27 dovecot_plain authenticator failed for c-76-31-164-124.hsd1.tx.comcast.net (dicalundyl) [76.31.164.124]:58654: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.25
country_id: 1220409
description:
Dec  1 01:18:28 host2 sshd[4121995]: Disconnected from invalid user hamed 185.121.0.25 port 45930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-01 01:19:51 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59999: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-12-01 01:19:55 dovecot_login authenticator failed for (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [201.15.149.254]:56978: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-12-01 01:19:38 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:63898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.121.0.25
country_id: 1220409
description:
Dec  1 01:19:44 host2 sshd[4122692]: Disconnected from invalid user valheim 185.121.0.25 port 47916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.25
country_id: 1220409
description:
Dec  1 01:20:58 host2 sshd[4123686]: Disconnected from invalid user hu 185.121.0.25 port 34284 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.45.6.205
country_id: 1819730
description:
2025-12-01 01:23:02 dovecot_login authenticator failed for (ADMIN) [89.45.6.205]:37391: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.121.0.25
country_id: 1220409
description:
Dec  1 01:22:11 host2 sshd[4124314]: Disconnected from invalid user frontend 185.121.0.25 port 37312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-12-01 01:23:14 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:60060: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-01 01:24:15 dovecot_plain authenticator failed for (nonve) [102.53.15.180]:55504: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 01:33:06 host2 sshd[4132879]: Disconnected from invalid user noor 62.60.131.157 port 51345 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-01 01:33:13 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (chuman) [67.172.54.29]:49466: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-01 01:33:17 dovecot_plain authenticator failed for (astist) [65.20.133.208]:51469: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-01 01:33:20 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (lares) [68.40.189.43]:53408: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.184
country_id: 1880251
description:
Dec  1 01:35:40 host2 sshd[4134392]: Disconnected from invalid user elemental 101.47.143.184 port 51408 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.3
country_id: 2510769
description:
2025-12-01 01:37:04 dovecot_login authenticator failed for (ADMIN) [212.102.49.3]:63402: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.23
country_id: 3624060
description:
2025-12-01 01:37:52 dovecot_login authenticator failed for ([127.0.0.1]) [186.177.88.23]:40881: 535 Incorrect authentication data (set_id=chitral00@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.41.39.119
country_id: 2510769
description:
2025-12-01 01:38:04 dovecot_login authenticator failed for 119.red-83-41-39.dynamicip.rima-tde.net ([127.0.0.1]) [83.41.39.119]:44060: 535 Incorrect authentication data (set_id=chitral00)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.93.171.56
country_id: 2921044
description:
Dec  1 01:39:51 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=142.93.171.56, lip=66.85.158.91, session=<Ucj8cdVEwDSOXas4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec  1 01:42:58 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<6/v7fNVE1prCw3NV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2025-12-01 01:45:11 dovecot_login authenticator failed for ([122.185.246.177]) [122.184.127.150]:58998: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2025-12-01 01:45:24 dovecot_login authenticator failed for ([46.210.95.88]) [46.210.95.88]:42515: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.184
country_id: 1880251
description:
Dec  1 01:45:32 host2 sshd[4141919]: Disconnected from invalid user taibabi 101.47.143.184 port 55204 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-12-01 01:47:38 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:59916: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.184
country_id: 1880251
description:
Dec  1 01:47:59 host2 sshd[4143396]: Disconnected from invalid user ftpuser 101.47.143.184 port 42614 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-01 01:47:15 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (prouryncy) [87.103.126.54]:56077: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-12-01 01:48:08 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:58403: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.106.74.123
country_id: 719819
description:
2025-12-01 01:54:22 dovecot_login authenticator failed for (ADMIN) [86.106.74.123]:49194: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 02:01:47 host2 sshd[4152131]: Disconnected from invalid user guy 62.60.131.157 port 17304 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.210.105
country_id: 6252001
description:
Dec  1 02:04:28 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=172.104.210.105, lip=66.85.158.92, session=<vPgMytVEAKesaNJp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 02:04:57 host2 sshd[4154704]: Disconnected from invalid user guy 62.60.131.157 port 53497 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.220.10.3
country_id: 1269750
description:
Dec  1 02:08:07 host2 sshd[4156861]: Disconnected from invalid user dd 117.220.10.3 port 37872 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.239.47.24
country_id: 6252001
description:
2025-12-01 02:08:25 dovecot_plain authenticator failed for ([10.21.18.223]) [84.239.47.24]:59354: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.24.86
country_id: 2635167
description:
2025-12-01 02:09:15 dovecot_login authenticator failed for (ADMIN) [158.173.24.86]:36793: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.215
country_id: 6252001
description:
Dec  1 02:12:03 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.215, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Gnco5dVEWsXG6xjX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.7
country_id: 2750405
description:
Dec  1 02:12:33 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=31.14.32.7, lip=66.85.158.91, session=<UuXs5tVEjOIfDiAH>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 02:13:48 host2 sshd[4161350]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.220.10.3
country_id: 1269750
description:
Dec  1 02:14:35 host2 sshd[4161858]: Disconnected from invalid user vncuser 117.220.10.3 port 33142 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-12-01 02:15:12 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (agest) [98.227.25.115]:58714: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Dec  1 02:15:48 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=</+OL8tVEuqCLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.220.10.3
country_id: 1269750
description:
Dec  1 02:18:18 host2 sshd[4164426]: Disconnected from invalid user oracle 117.220.10.3 port 50552 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.169.142.214
country_id: 2963597
description:
Dec  1 02:23:22 host2 sshd[4167203]: Disconnected from invalid user sftp 52.169.142.214 port 35568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Dec  1 02:24:31 host2 sshd[4167976]: Disconnected from invalid user mc 52.169.142.214 port 53514 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Dec  1 02:25:39 host2 sshd[4168961]: Disconnected from invalid user bot 52.169.142.214 port 57354 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.106.74.126
country_id: 719819
description:
2025-12-01 02:25:42 dovecot_login authenticator failed for (ADMIN) [86.106.74.126]:24897: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Dec  1 02:26:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<wjugF9ZEyoqLonHU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 02:27:40 host2 sshd[4169999]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 02:28:26 host2 sshd[4170415]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.123
country_id: 1880251
description:
Dec  1 02:30:29 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=15.235.175.123, lip=66.85.158.91, session=<mPIWJ9ZE7ccP6697>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.116
country_id: 1880251
description:
Dec  1 02:30:43 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=15.235.175.116, lip=66.85.158.91, session=<5bDvJ9ZEJ5MP6690>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.2.249.160
country_id: 3469034
description:
Dec  1 02:33:37 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=186.2.249.160, lip=66.85.158.91, TLS, session=<0uEqMdZEbem6Avmg>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.55.241.218
country_id: 2921044
description:
[2025-12-01 02:33:57 +0530] info [cpaneld] 185.55.241.218 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.179.189.184
country_id: 3469034
description:
Dec  1 02:33:57 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=45.179.189.184, lip=66.85.158.91, TLS, session=<YNRgMtZEe7gts724>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.251.178
country_id: 2921044
description:
Dec  1 02:33:59 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.251.178, lip=66.85.158.92, session=<ajKQM9ZE6aVo+Puy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.203.193
country_id: 2921044
description:
Dec  1 02:33:59 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=207.154.203.193, lip=66.85.158.92, session=<LEyeM9ZE2FTPmsvB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.129.64.237
country_id: 2921044
description:
Dec  1 02:35:06 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=57.129.64.237, lip=66.85.158.91, session=<pdyZN9ZEFOI5gUDt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.105.70.190
country_id: 3017382
description:
Dec  1 02:36:18 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=46.105.70.190, lip=66.85.158.91, TLS: Connection closed, session=<6aHnO9ZEd4YuaUa+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-01 02:38:57 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (ceadmont) [71.224.169.28]:41144: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.150
country_id: 1210997
description:
2025-12-01 02:40:28 dovecot_login authenticator failed for (ADMIN) [64.64.112.150]:6927: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 02:48:15 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<did+ZtZE/rVRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.48.25
country_id: 2750405
description:
2025-12-01 02:50:10 dovecot_login authenticator failed for (ADMIN) [212.56.48.25]:3714: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.117.167
country_id: 2921044
description:
Dec  1 02:55:56 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 29 secs): user=<>, rip=157.230.117.167, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gFoegtZEJmmd5nWn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.173
country_id: 294640
description:
2025-12-01 02:57:18 dovecot_login authenticator failed for (ADMIN) [149.88.26.173]:34352: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.50.147
country_id: 3175395
description:
Dec  1 03:00:05 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.77.50.147, lip=66.85.158.91, TLS, session=<vfvtj9ZEuOy5TTKT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.64.244.118
country_id: 690791
description:
Dec  1 02:59:47 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=195.64.244.118, lip=66.85.158.91, TLS, session=<kznRjtZEO6jDQPR2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.55
country_id: 6252001
description:
Dec  1 03:01:57 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.55, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1kOel9ZEhL8UQcE3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-12-01 03:03:50 dovecot_plain authenticator failed for (riemenness) [65.20.191.12]:42318: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.161
country_id: 2993457
description:
Dec  1 03:16:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.161, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<iARQytZEvQnCpRCh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.105
country_id: 6252001
description:
Dec  1 03:18:11 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.194.105, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<rKmn0dZE9NkUQcJp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-12-01 03:20:41 dovecot_plain authenticator failed for (antism) [94.201.22.158]:58297: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-01 03:20:44 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (toxic) [174.166.153.20]:50012: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.12
country_id: 3017382
description:
Dec  1 03:24:06 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=94.231.206.12, lip=66.85.158.91, session=<9gXO5tZEJ6he584M>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.8
country_id: 3017382
description:
Dec  1 03:24:16 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=94.231.206.8, lip=66.85.158.91, session=<Axpv59ZEc4xe584I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.13
country_id: 3017382
description:
Dec  1 03:24:28 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.13, lip=66.85.158.91, session=<w18h6NZE3ale584N>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.11
country_id: 3017382
description:
Dec  1 03:24:31 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=94.231.206.11, lip=66.85.158.91, session=<lNdU6NZEq45e584L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-12-01 03:25:34 dovecot_login authenticator failed for (syn-075-183-102-189.res.spectrum.com) [75.183.102.189]:51840: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-12-01 03:25:53 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:47942: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Dec  1 03:27:15 host2 sshd[20110]: Disconnected from invalid user ts1 161.132.68.222 port 33362 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 161.132.68.222
country_id: 3932488
description:
Dec  1 03:28:31 host2 sshd[21091]: Disconnected from invalid user dev 161.132.68.222 port 42038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.160.200.211
country_id: 1880251
description:
Dec  1 03:28:54 host2 sshd[21390]: Disconnected from invalid user master 43.160.200.211 port 38892 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Dec  1 03:30:54 host2 sshd[23214]: Disconnected from invalid user master 161.132.68.222 port 53686 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.41
country_id: 617790
description:
2025-12-01 03:30:27 dovecot_login authenticator failed for (ADMIN) [178.175.128.41]:48496: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 161.132.68.222
country_id: 3932488
description:
Dec  1 03:33:20 host2 sshd[25114]: Disconnected from invalid user hu 161.132.68.222 port 35852 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 03:33:40 host2 sshd[25294]: Disconnected from invalid user admin 2.57.121.112 port 57901 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-12-01 03:34:14 dovecot_plain authenticator failed for (unworichin) [102.53.15.180]:35452: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.160.200.211
country_id: 1880251
description:
Dec  1 03:34:51 host2 sshd[26535]: Disconnected from invalid user hu 43.160.200.211 port 37098 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.156.129.179
country_id: 2264397
description:
Dec  1 03:36:34 host2 pure-ftpd[28458]: (?@45.156.129.179) [INFO] New connection from 45.156.129.179


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-12-01 03:41:33 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (clationont) [71.224.169.28]:52942: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.57
country_id: 3625428
description:
2025-12-01 03:44:22 dovecot_login authenticator failed for (ADMIN) [95.181.237.57]:58640: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Dec  1 03:46:05 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.92, session=<ARduNddEtDCs7OTF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.224.238
country_id: 1880251
description:
Dec  1 03:50:45 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=15.235.224.238, lip=66.85.158.92, session=<IZMlRtdEq80P6+Du>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.166
country_id: 3144096
description:
2025-12-01 04:00:21 dovecot_login authenticator failed for (ADMIN) [46.246.122.166]:7919: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.52.217.43
country_id: 3686110
description:
2025-12-01 04:03:27 dovecot_login authenticator failed for ([127.0.0.1]) [181.52.217.43]:35106: 535 Incorrect authentication data (set_id=inf@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.90
country_id: 1269750
description:
2025-12-01 04:03:36 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.228.90]:51672: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 04:04:26 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<RGPmdtdEq7RRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-12-01 04:06:10 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:35258: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2025-12-01 04:06:40 dovecot_login authenticator failed for ([62.220.236.203]) [62.220.236.203]:36580: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Dec  1 04:11:03 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3uC6jtdEvtFChJlx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-12-01 04:11:18 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:33111: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-01 04:11:32 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (anness) [81.225.30.107]:48503: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2025-12-01 04:11:59 dovecot_login authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:33310: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-12-01 04:13:49 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:51074: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.159
country_id: 1733045
description:
2025-12-01 04:14:48 dovecot_login authenticator failed for ([49.124.154.159]) [49.124.154.159]:39012: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-01 04:16:06 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (cricancola) [76.145.10.140]:58708: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.123.8.143
country_id: 1168579
description:
2025-12-01 04:16:17 dovecot_plain authenticator failed for (1J0G627F) [223.123.8.143]:8281: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 04:17:22 host2 sshd[83720]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.162
country_id: 798549
description:
2025-12-01 04:18:56 dovecot_login authenticator failed for (ADMIN) [91.90.120.162]:55689: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.72
country_id: 2510769
description:
2025-12-01 04:19:32 dovecot_login authenticator failed for (ADMIN) [212.102.49.72]:41035: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  1 04:20:42 host2 sshd[88328]: Disconnected from invalid user ansible 45.249.247.165 port 42950 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.173.54
country_id: 6252001
description:
Dec  1 04:21:50 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=134.209.173.54, lip=66.85.158.92, TLS: Connection closed, session=<FjlRtddE6bWG0a02>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  1 04:22:41 host2 sshd[91291]: Disconnected from invalid user testing 45.249.247.165 port 39774 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-12-01 04:24:53 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:42163: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.226.192
country_id: 6251999
description:
2025-12-01 04:24:34 dovecot_login authenticator failed for host-24-224-226-192.public.eastlink.ca [24.224.226.192]:41208: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  1 04:25:10 host2 sshd[94510]: Disconnected from invalid user plex 45.249.247.165 port 60954 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.209.173.54
country_id: 6252001
description:
Dec  1 04:25:35 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=134.209.173.54, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<jqGywtdE9rqG0a02>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec  1 04:27:17 host2 sshd[97700]: Disconnected from invalid user a 200.69.236.207 port 59165 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.249.247.165
country_id: 1819730
description:
Dec  1 04:29:46 host2 sshd[100628]: Disconnected from invalid user ubuntu 45.249.247.165 port 51600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec  1 04:32:26 host2 sshd[103353]: Disconnected from invalid user sga 200.69.236.207 port 47316 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.85
country_id: 2264397
description:
Dec  1 04:32:46 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.85, lip=66.85.158.91, session=<wYZg3NdEIeBtadJV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.20
country_id: 6290252
description:
2025-12-01 04:33:55 dovecot_login authenticator failed for (ADMIN) [37.46.115.20]:59072: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 173.24.18.140
country_id: 6252001
description:
Dec  1 04:35:23 host2 sshd[106168]: Disconnecting authenticating user root 173.24.18.140 port 54224: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 173.24.18.140
country_id: 6252001
description:
Dec  1 04:35:23 host2 sshd[106168]: error: maximum authentication attempts exceeded for root from 173.24.18.140 port 54224 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 173.24.18.140
country_id: 6252001
description:
Dec  1 04:35:31 host2 sshd[106249]: Disconnecting invalid user admin 173.24.18.140 port 55676: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Dec  1 04:36:53 host2 sshd[107737]: Disconnected from invalid user intel 95.0.27.163 port 55934 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.204.195
country_id: 6251999
description:
Dec  1 04:37:00 host2 pure-ftpd[107850]: (?@128.203.204.195) [INFO] New connection from 128.203.204.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.249
country_id: 6252001
description:
2025-12-01 04:37:42 dovecot_login authenticator failed for ([127.0.0.1]) [98.185.121.249]:35726: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.204.195
country_id: 6251999
description:
Dec  1 04:37:10 host2 pure-ftpd[108017]: (?@128.203.204.195) [INFO] New connection from 128.203.204.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.46
country_id: 6252001
description:
2025-12-01 04:37:25 dovecot_login authenticator failed for ([127.0.0.1]) [98.181.46.46]:45797: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.176
country_id: 6252001
description:
Dec  1 04:37:25 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.176, lip=66.85.158.91, session=<aYsG7ddEPP7N0h+w>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.97.117.34
country_id: 1269750
description:
Dec  1 04:38:13 host2 sshd[108786]: Disconnected from invalid user azureuser 14.97.117.34 port 40483 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.112.8
country_id: 6252001
description:
Dec  1 04:38:46 host2 sshd[109155]: Disconnected from invalid user frontend 159.203.112.8 port 34718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.118.142.216
country_id: 3686110
description:
Dec  1 04:39:01 host2 sshd[109314]: Disconnected from invalid user hadoop 186.118.142.216 port 59428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.112.8
country_id: 6252001
description:
Dec  1 04:39:47 host2 sshd[109948]: Disconnected from invalid user halo 159.203.112.8 port 54494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.118.142.216
country_id: 3686110
description:
Dec  1 04:40:18 host2 sshd[110455]: Disconnected from invalid user old 186.118.142.216 port 33948 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-12-01 04:40:47 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:34720: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.97.117.34
country_id: 1269750
description:
Dec  1 04:40:52 host2 sshd[110890]: Disconnected from invalid user david 14.97.117.34 port 33806 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.0.27.163
country_id: 298795
description:
Dec  1 04:40:14 host2 sshd[110397]: Disconnected from invalid user test 95.0.27.163 port 54256 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec  1 04:41:41 host2 sshd[111520]: Disconnected from invalid user deployer 200.69.236.207 port 56265 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec  1 04:41:45 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<ya5l/NdEwIbCw3NV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.203.112.8
country_id: 6252001
description:
Dec  1 04:41:47 host2 sshd[111599]: Disconnected from invalid user client 159.203.112.8 port 39268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.249.251.2
country_id: 6252001
description:
Dec  1 04:41:20 host2 sshd[111304]: Disconnected from invalid user old 74.249.251.2 port 46290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.69.236.207
country_id: 3865483
description:
Dec  1 04:43:06 host2 sshd[112427]: Disconnected from invalid user admin 200.69.236.207 port 41409 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.97.117.34
country_id: 1269750
description:
Dec  1 04:42:13 host2 sshd[111842]: Disconnected from invalid user ubuntu 14.97.117.34 port 38790 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.118.142.216
country_id: 3686110
description:
Dec  1 04:42:46 host2 sshd[112209]: Disconnected from invalid user builder 186.118.142.216 port 52670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.214.48.79
country_id: 3144096
description:
2025-12-01 04:43:43 dovecot_login authenticator failed for ([127.0.0.1]) [84.214.48.79]:44794: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Dec  1 04:43:48 host2 sshd[112858]: Disconnected from invalid user halo 95.0.27.163 port 45768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.165.255.181
country_id: 290557
description:
2025-12-01 04:43:57 dovecot_login authenticator failed for bba-217-165-255-181.alshamil.net.ae ([127.0.0.1]) [217.165.255.181]:49284: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Dec  1 04:44:57 host2 sshd[114057]: Disconnected from invalid user huawei 152.32.252.65 port 46782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.0.27.163
country_id: 298795
description:
Dec  1 04:45:00 host2 sshd[114082]: Disconnected from invalid user old 95.0.27.163 port 36166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.252.65
country_id: 1819730
description:
Dec  1 04:47:11 host2 sshd[115735]: Disconnected from invalid user deployer 152.32.252.65 port 51622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.254.80.99
country_id: 1269750
description:
2025-12-01 04:47:35 dovecot_plain authenticator failed for (cataliated) [65.254.80.99]:57338: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-12-01 04:47:39 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (ancity) [5.185.233.251]:44550: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-12-01 04:47:42 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (bionia) [73.224.171.101]:57222: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 04:48:19 host2 sshd[116335]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.249.251.2
country_id: 6252001
description:
Dec  1 04:48:56 host2 sshd[116730]: Disconnected from invalid user ubuntu 74.249.251.2 port 48246 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-12-01 04:49:47 dovecot_login authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:35256: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.124
country_id: 6252001
description:
2025-12-01 04:50:46 dovecot_login authenticator failed for (ADMIN) [191.96.37.124]:15853: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.14.36
country_id: 3144096
description:
2025-12-01 04:54:30 dovecot_login authenticator failed for ([127.0.0.1]) [84.211.14.36]:33398: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.236.236.178
country_id: 6252001
description:
2025-12-01 04:54:36 dovecot_login authenticator failed for mail-gateway3.zarcrom.net ([127.0.0.1]) [209.236.236.178]:38532: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.185.206
country_id: 6252001
description:
Dec  1 05:00:56 host2 pure-ftpd[124603]: (?@40.124.185.206) [INFO] New connection from 40.124.185.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-12-01 05:01:55 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:39292: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2025-12-01 05:02:09 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:37398: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.70
country_id: 597427
description:
2025-12-01 05:03:39 dovecot_login authenticator failed for (ADMIN) [194.32.122.70]:53004: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.22
country_id: 718075
description:
2025-12-01 05:05:45 dovecot_login authenticator failed for (ADMIN) [185.225.31.22]:49463: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-01 05:06:22 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60948: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-12-01 05:10:26 dovecot_plain authenticator failed for (nenatic) [46.8.240.26]:49020: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.191.250.136
country_id: 6252001
description:
2025-12-01 05:12:56 dovecot_login authenticator failed for wsip-184-191-250-136.fv.ks.cox.net ([127.0.0.1]) [184.191.250.136]:33141: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.90.94
country_id: 1269750
description:
2025-12-01 05:13:10 dovecot_login authenticator failed for ([127.0.0.1]) [27.123.90.94]:43116: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.65.142.55
country_id: 798544
description:
Dec  1 05:13:21 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=77.65.142.55, lip=66.85.158.91, TLS, session=<ijiIbNhEV8RNQY43>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.40.76
country_id: 953987
description:
Dec  1 05:13:42 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.64.40.76, lip=66.85.158.91, TLS, session=<gzCxbdhEHt5mQChM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 156.232.94.72
country_id: 241170
description:
Dec  1 05:16:06 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=1013) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=156.232.94.72, lip=66.85.158.91, session=<OCdgd9hEIOac6F5I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Dec  1 05:16:22 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sysnytech.com>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<K4E5eNhE0N5283VD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.252.133
country_id: 1819730
description:
Dec  1 05:17:15 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=152.32.252.133, lip=66.85.158.92, TLS handshaking: Connection closed, session=<wEt1e9hEWDWYIPyF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.117
country_id: 357994
description:
2025-12-01 05:21:25 dovecot_login authenticator failed for (ADMIN) [188.214.122.117]:25117: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.67
country_id: 1861060
description:
2025-12-01 05:29:10 dovecot_login authenticator failed for (ADMIN) [149.22.87.67]:45152: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-12-01 05:35:51 dovecot_plain authenticator failed for (resser) [65.20.148.165]:39903: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-12-01 05:35:54 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (dectyphid) [24.1.200.187]:51608: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.194.98
country_id: 6252001
description:
2025-12-01 05:35:57 dovecot_plain authenticator failed for c-73-197-194-98.hsd1.nj.comcast.net (anized) [73.197.194.98]:49810: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Dec  1 05:36:11 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<8DQOv9hEJIKSOC+J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.46
country_id: 2264397
description:
2025-12-01 05:40:37 dovecot_login authenticator failed for (ADMIN) [146.70.59.46]:35824: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.101.70
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 161.97.101.70 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.192.106.246
country_id: 3469034
description:
Dec  1 05:45:13 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=181.192.106.246, lip=66.85.158.91, TLS, session=<Eqbz3dhE8dG1wGr2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.102.169
country_id: 798544
description:
Dec  1 05:45:31 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.102.169, lip=66.85.158.91, TLS, session=<tSCV39hEx4yy22ap>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-12-01 05:47:57 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (thweanula) [98.193.112.85]:40698: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.19.79.32
country_id: 285570
description:
2025-12-01 05:48:01 dovecot_plain authenticator failed for (gamis) [185.19.79.32]:47303: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.251.213.33
country_id: 2589581
description:
2025-12-01 05:49:28 dovecot_plain authenticator failed for (PMAJ2FF461FCD) [154.251.213.33]:10125: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.145
country_id: 6252001
description:
2025-12-01 05:56:18 dovecot_login authenticator failed for (ADMIN) [173.244.56.145]:13431: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.126.17
country_id: 6252001
description:
Dec  1 05:56:52 host2 sshd[164265]: Disconnected from invalid user asterisk 158.51.126.17 port 37772 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.85
country_id: 6252001
description:
Dec  1 05:57:00 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.85, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CpulCdlEeMWTuYRV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 158.51.126.17
country_id: 6252001
description:
Dec  1 06:02:08 host2 sshd[168602]: Disconnected from invalid user csgo 158.51.126.17 port 54960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.126.17
country_id: 6252001
description:
Dec  1 06:03:11 host2 sshd[170122]: Disconnected from invalid user drcomadmin 158.51.126.17 port 53930 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Dec  1 06:03:25 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS: Connection closed, session=<nQSXINlEpu5ChJl6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 06:06:21 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<eEHzKtlEXJkXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.126.17
country_id: 6252001
description:
Dec  1 06:06:38 host2 sshd[173229]: Disconnected from invalid user docker 158.51.126.17 port 50876 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.242.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 172.56.242.238 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.3.217
country_id: 2661886
description:
2025-12-01 06:11:13 dovecot_login authenticator failed for (ADMIN) [46.246.3.217]:17898: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.20
country_id: 2635167
description:
Dec  1 06:14:31 host2 dovecot[3366265]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.20, lip=66.85.158.91, TLS, session=<pJlBSNlEy6W594kU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.153.26.38
country_id: 1643084
description:
2025-12-01 06:15:22 dovecot_plain authenticator failed for (gttamericas.wbsyzv2pqgqutcmqq4namzv3gh.jktx.internal.cloudapp.net) [70.153.26.38]:61890: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.53
country_id: 6252001
description:
Dec  1 06:17:54 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.53, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VehaVNlEA9fG6xg1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.242
country_id: 6252001
description:
Dec  1 06:19:17 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.242, lip=66.85.158.92, TLS, session=<ncVWWdlEauvG6xjy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-01 06:19:20 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (trintunbe) [174.169.224.27]:53438: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 06:23:24 host2 sshd[185874]: Disconnected from invalid user user 2.57.121.25 port 13307 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-12-01 06:24:39 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:43344: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 06:24:12 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<UEfLatlEjI0XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-12-01 06:25:13 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:39366: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 06:26:06 host2 sshd[188028]: Disconnected from invalid user user 2.57.121.25 port 47345 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.153.26.38
country_id: 1643084
description:
2025-12-01 06:26:56 dovecot_plain authenticator failed for (gttamericas.wbsyzv2pqgqutcmqq4namzv3gh.jktx.internal.cloudapp.net) [70.153.26.38]:49441: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.7
country_id: 732800
description:
2025-12-01 06:27:00 dovecot_login authenticator failed for (ADMIN) [94.156.14.7]:41634: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec  1 06:27:05 host2 sshd[188582]: Disconnected from invalid user radio 121.52.147.5 port 48744 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.53.166
country_id: 6252001
description:
2025-12-01 06:28:04 dovecot_login authenticator failed for (ADMIN) [212.56.53.166]:28700: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.189.154.201
country_id: 3595528
description:
Dec  1 06:27:36 host2 sshd[188881]: Disconnected from invalid user bot 181.189.154.201 port 3696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec  1 06:30:07 host2 sshd[190477]: Disconnected from invalid user deploy 121.52.147.5 port 53918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.189.154.201
country_id: 3595528
description:
Dec  1 06:29:54 host2 sshd[190211]: Disconnected from invalid user ubuntu 181.189.154.201 port 6445 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec  1 06:31:35 host2 sshd[191349]: Disconnected from invalid user init 121.52.147.5 port 34042 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.189.154.201
country_id: 3595528
description:
Dec  1 06:31:25 host2 sshd[191300]: Disconnected from invalid user bitnami 181.189.154.201 port 8419 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.189.154.201
country_id: 3595528
description:
Dec  1 06:32:38 host2 sshd[191869]: Disconnected from invalid user taiga 181.189.154.201 port 7979 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.189.154.201
country_id: 3595528
description:
Dec  1 06:33:45 host2 sshd[192500]: Disconnected from invalid user ekp 181.189.154.201 port 5140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-12-01 06:34:34 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:39488: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-12-01 06:34:12 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:46866: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.147.5
country_id: 1168579
description:
Dec  1 06:34:17 host2 sshd[192772]: Disconnected from invalid user pdx 121.52.147.5 port 43032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 121.52.147.5
country_id: 1168579
description:
Dec  1 06:35:36 host2 sshd[193751]: Disconnected from invalid user drcomadmin 121.52.147.5 port 54492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Dec  1 06:36:28 host2 sshd[194274]: Disconnected from invalid user deployer 45.78.223.80 port 45812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec  1 06:37:07 host2 sshd[194656]: Disconnected from invalid user mqm 45.78.224.109 port 43712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec  1 06:39:50 host2 sshd[196141]: Disconnected from invalid user dockeradmin 45.78.224.109 port 46404 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.164
country_id: 2328926
description:
2025-12-01 06:42:53 dovecot_login authenticator failed for (ADMIN) [146.70.65.164]:2822: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.224.109
country_id: 1880251
description:
Dec  1 06:42:24 host2 sshd[197895]: Disconnected from invalid user postgres 45.78.224.109 port 34856 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-12-01 06:44:13 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:49789: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-12-01 06:44:45 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:32782: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.16.91
country_id: 1880251
description:
2025-12-01 06:44:58 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:50315: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec  1 06:45:03 host2 sshd[199750]: Disconnected from invalid user fiscal 45.78.224.109 port 44534 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-12-01 06:45:36 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:42154: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 06:46:40 host2 sshd[200973]: Disconnected from invalid user porter 62.60.131.157 port 29938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec  1 06:48:10 host2 sshd[201831]: Disconnected from invalid user cgpexpert 103.100.208.88 port 35929 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec  1 06:48:49 host2 sshd[202214]: Disconnected from invalid user botuser 179.33.186.151 port 19867 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.109
country_id: 1880251
description:
Dec  1 06:50:06 host2 sshd[203034]: Disconnected from invalid user amir 45.78.224.109 port 39616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec  1 06:51:40 host2 sshd[204094]: Disconnected from invalid user odoo 103.100.208.88 port 33505 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec  1 06:51:49 host2 sshd[204180]: Disconnected from invalid user odoo 179.33.186.151 port 3954 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.100.208.88
country_id: 1819730
description:
Dec  1 06:53:02 host2 sshd[204986]: Disconnected from invalid user dev 103.100.208.88 port 46925 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec  1 06:53:08 host2 sshd[205098]: Disconnected from invalid user minecraft 179.33.186.151 port 8188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec  1 06:54:20 host2 sshd[206154]: Disconnected from invalid user ubuntu 103.100.208.88 port 60345 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.33.186.151
country_id: 3686110
description:
Dec  1 06:54:25 host2 sshd[206360]: Disconnected from invalid user hu 179.33.186.151 port 9330 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.208.88
country_id: 1819730
description:
Dec  1 06:55:27 host2 sshd[207389]: Disconnected from invalid user botuser 103.100.208.88 port 45527 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.33.186.151
country_id: 3686110
description:
Dec  1 06:55:42 host2 sshd[207548]: Disconnected from invalid user elasticsearch 179.33.186.151 port 34897 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.61
country_id: 597427
description:
2025-12-01 06:56:39 dovecot_login authenticator failed for (ADMIN) [194.32.122.61]:1348: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-01 06:57:16 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (chary) [98.40.101.10]:45214: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Dec  1 06:59:13 host2 sshd[209921]: Disconnected from invalid user sftpuser 45.78.223.80 port 41476 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-12-01 07:00:26 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:47196: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-12-01 07:00:12 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:55438: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-12-01 07:03:29 dovecot_login authenticator failed for (223-30-0-0.lan.sify.net) [49.37.32.248]:44250: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.8.52
country_id: 798544
description:
Dec  1 07:03:28 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=89.186.8.52, lip=66.85.158.91, TLS, session=<RIJZ9tlEf4BZugg0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.134.73.222
country_id: 3017382
description:
Dec  1 07:03:36 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.134.73.222, lip=66.85.158.92, session=<1QvR99lE9dBbhkne>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-12-01 07:03:50 dovecot_login authenticator failed for (aes-static-102.79.144.59.airtel.in) [59.144.79.102]:37628: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.220.112
country_id: 1880251
description:
Dec  1 07:03:51 host2 sshd[213042]: Disconnected from invalid user ubuntu 45.78.220.112 port 56764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.36.81
country_id: 3469034
description:
Dec  1 07:03:10 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=191.240.36.81, lip=66.85.158.91, TLS, session=<jeY69dlE/sC/8CRR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.80
country_id: 1880251
description:
Dec  1 07:04:27 host2 sshd[213409]: Disconnected from invalid user jmarquez 45.78.223.80 port 59612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.119
country_id: 357994
description:
2025-12-01 07:05:35 dovecot_login authenticator failed for (ADMIN) [188.214.122.119]:62956: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.80
country_id: 1880251
description:
Dec  1 07:06:59 host2 sshd[214980]: Disconnected from invalid user testadmin 45.78.223.80 port 57560 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.69
country_id: 6252001
description:
Dec  1 07:07:55 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.69, lip=66.85.158.91, TLS, session=<oCVIB9pEaObN0h9F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.114.153.71
country_id: 357994
description:
2025-12-01 07:09:11 dovecot_plain authenticator failed for (8N8LN255TCKTWN) [62.114.153.71]:65010: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.147
country_id: 660013
description:
2025-12-01 07:13:28 dovecot_login authenticator failed for (ADMIN) [188.126.89.147]:54726: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 07:14:07 host2 sshd[220057]: Disconnected from invalid user admin 2.57.121.112 port 24551 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec  1 07:14:59 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@venee.lk>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<o0hrINpEoNDCw3NV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 07:15:46 host2 sshd[221332]: Disconnected from invalid user admin 2.57.121.112 port 56069 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.217.208.1
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 83.217.208.1 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.6
country_id: 2750405
description:
Dec  1 07:19:30 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=31.14.32.6, lip=66.85.158.92, session=<9YipMNpEyoUfDiAG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 07:24:08 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<gKk9QdpEZK4DjyE/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 07:23:59 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<ziqXQNpEef9RvaKO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 07:26:30 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=</hGzSdpEgNUDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-12-01 07:26:21 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:51490: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-12-01 07:27:32 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (coless) [73.168.136.150]:53800: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-01 07:27:36 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (toliader) [87.103.126.54]:31488: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 07:27:38 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<rnfHTdpE0K0DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.129.44
country_id: 617790
description:
2025-12-01 07:27:53 dovecot_login authenticator failed for (ADMIN) [178.175.129.44]:20453: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.69
country_id: 2264397
description:
Dec  1 07:28:59 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=109.105.210.69, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hz6fUtpEC8NtadJF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.70
country_id: 2264397
description:
Dec  1 07:29:00 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=109.105.210.70, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<OOaqUtpEzettadJG>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.210.67
country_id: 2264397
description:
Dec  1 07:28:58 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=109.105.210.67, lip=66.85.158.92, session=<VAyEUtpESYNtadJD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.68
country_id: 2264397
description:
Dec  1 07:28:59 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=109.105.210.68, lip=66.85.158.92, TLS, session=<clOVUtpEYbltadJE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 109.105.210.67
country_id: 2264397
description:
Dec  1 07:28:58 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=109.105.210.67, lip=66.85.158.92, TLS: SSL_read failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UCWNUtpEirVtadJD>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 07:30:03 host2 dovecot[3366265]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<SPJkVtpEftADjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 07:31:28 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<TB1yW9pErusDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.13.220.220
country_id: 6252001
description:
2025-12-01 07:32:56 dovecot_plain authenticator failed for c-73-13-220-220.hsd1.de.comcast.net (shard) [73.13.220.220]:53192: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.44
country_id: 3175395
description:
Dec  1 07:35:12 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=185.15.171.44, lip=66.85.158.91, TLS, session=<NCTTZ9pEn6O5D6ss>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.209
country_id: 3469034
description:
Dec  1 07:35:33 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.53.131.209, lip=66.85.158.91, TLS, session=<X7/3aNpElqu/NYPR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.11
country_id: 732800
description:
2025-12-01 07:43:23 dovecot_login authenticator failed for (ADMIN) [94.156.14.11]:35286: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.162.45
country_id: 1861060
description:
Dec  1 07:45:39 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=8.211.162.45, lip=66.85.158.92, session=<zPYzjtpEVNwI06It>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.140
country_id: 660013
description:
2025-12-01 07:47:47 dovecot_login authenticator failed for (ADMIN) [188.126.89.140]:53871: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.120
country_id: 3996063
description:
2025-12-01 07:50:02 dovecot_login authenticator failed for ([127.0.0.1]) [201.173.216.120]:34489: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.220.126
country_id: 1269750
description:
2025-12-01 07:50:24 dovecot_login authenticator failed for ([127.0.0.1]) [152.52.220.126]:33850: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-12-01 07:50:49 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (flingial) [98.40.101.10]:42400: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.124
country_id: 6252001
description:
Dec  1 07:52:49 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.124, lip=66.85.158.92, TLS: Connection closed, session=<omfMp9pE1MxChJl8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.203
country_id: 6252001
description:
Dec  1 07:54:13 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.203, lip=66.85.158.91, TLS, session=<W1HPrNpEpPnG6xjL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.34.157
country_id: 6252001
description:
2025-12-01 07:59:29 dovecot_login authenticator failed for (ADMIN) [143.244.34.157]:39874: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.245
country_id: 6252001
description:
Dec  1 08:02:45 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.245, lip=66.85.158.92, TLS, session=<voRTy9pElPzN0h/1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec  1 08:04:19 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<u2L50NpEvqg2rEyT>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.62.222.54
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 178.62.222.54 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 178.62.222.54
country_id: 2750405
description:
Dec  1 08:07:36 host2 sshd[255749]: Invalid user cloudtourssrilan_travel from 178.62.222.54 port 49854


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.3
country_id: 1861060
description:
2025-12-01 08:08:17 dovecot_login authenticator failed for (ADMIN) [149.22.87.3]:36293: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.144
country_id: 798549
description:
2025-12-01 08:14:18 dovecot_login authenticator failed for (ADMIN) [91.90.120.144]:4407: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-12-01 08:14:42 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:42986: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.85
country_id: 3996063
description:
2025-12-01 08:15:12 dovecot_login authenticator failed for (201.172.88.85-clientes-izzi.mx) [201.172.88.85]:36118: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Dec  1 08:17:33 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.92, session=<wANDANtEToY2xDDo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec  1 08:19:21 host2 sshd[263275]: Disconnected from invalid user sonarqube 143.198.85.84 port 40254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.37.155
country_id: 2077456
description:
Dec  1 08:20:20 host2 sshd[264084]: Disconnected from invalid user saas 144.48.37.155 port 54308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec  1 08:22:09 host2 sshd[265507]: Disconnected from invalid user terraria 143.198.85.84 port 53578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.37.155
country_id: 2077456
description:
Dec  1 08:22:35 host2 sshd[265808]: Disconnected from invalid user nrk 144.48.37.155 port 52244 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.198.85.84
country_id: 1880251
description:
Dec  1 08:23:26 host2 sshd[266530]: Disconnected from invalid user ts1 143.198.85.84 port 54784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.37.155
country_id: 2077456
description:
Dec  1 08:23:58 host2 sshd[266879]: Disconnected from invalid user ali 144.48.37.155 port 55840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.198.85.84
country_id: 1880251
description:
Dec  1 08:24:41 host2 sshd[267530]: Disconnected from invalid user ali 143.198.85.84 port 32978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  1 08:24:52 host2 sshd[267642]: Disconnected from invalid user gits 27.111.32.174 port 37928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.37.155
country_id: 2077456
description:
Dec  1 08:25:19 host2 sshd[268111]: Disconnected from invalid user vagrant 144.48.37.155 port 44546 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  1 08:26:07 host2 sshd[268627]: Disconnected from invalid user qw 27.111.32.174 port 42540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.48.37.155
country_id: 2077456
description:
Dec  1 08:26:38 host2 sshd[268959]: Disconnected from invalid user monitoring 144.48.37.155 port 44200 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  1 08:27:19 host2 sshd[269457]: Disconnected from invalid user vagrant 27.111.32.174 port 57950 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.45
country_id: 2635167
description:
2025-12-01 08:27:52 dovecot_login authenticator failed for (ADMIN) [98.159.234.45]:51263: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.71
country_id: 298795
description:
2025-12-01 08:28:29 dovecot_login authenticator failed for (ADMIN) [188.213.34.71]:17344: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Dec  1 08:28:30 host2 sshd[270357]: Disconnected from invalid user rstudio 27.111.32.174 port 55524 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.125
country_id: 6252001
description:
Dec  1 08:36:10 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.125, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Mw7bQttEhcHG6xh9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 08:37:30 host2 sshd[278162]: Disconnected from invalid user admin 2.57.121.112 port 40689 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 08:38:45 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<2Zb9S9tEjrMXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 08:38:44 host2 sshd[279073]: Disconnected from invalid user user 2.57.121.25 port 35061 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 08:39:07 host2 sshd[279483]: Disconnected from invalid user admin 2.57.121.112 port 5406 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 08:40:38 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<gVqzUttEnyxRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 08:43:03 host2 sshd[282597]: Disconnected from invalid user tevin 62.60.131.157 port 27055 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 08:43:21 host2 sshd[283001]: Disconnected from invalid user admin 2.57.121.112 port 63500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-01 08:44:50 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50640: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 08:45:07 host2 sshd[284659]: Disconnected from invalid user tevin 62.60.131.157 port 25520 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.121
country_id: 6252001
description:
Dec  1 08:45:08 host2 pure-ftpd[284732]: (?@66.132.153.121) [INFO] New connection from 66.132.153.121


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-12-01 08:45:52 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:53854: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.37.9
country_id: 6252001
description:
2025-12-01 08:46:09 dovecot_login authenticator failed for (ADMIN) [191.96.37.9]:9637: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.21
country_id: 732800
description:
2025-12-01 08:48:18 dovecot_login authenticator failed for (ADMIN) [94.156.14.21]:11649: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-12-01 08:54:19 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:45962: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-12-01 08:54:50 dovecot_login authenticator failed for ([45.168.140.35]) [45.168.140.35]:48976: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.79.85.18
country_id: 3469034
description:
2025-12-01 08:55:03 dovecot_plain authenticator failed for (CEJ5O) [170.79.85.18]:24873: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.79.85.18
country_id: 3469034
description:
2025-12-01 08:55:09 dovecot_login authenticator failed for (CEJ5O) [170.79.85.18]:24873: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-12-01 08:55:40 dovecot_login authenticator failed for (techday.com.ua) [46.149.83.62]:51509: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2025-12-01 08:56:19 dovecot_login authenticator failed for (netmail.nasmhpd.org) [50.235.31.47]:41322: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2025-12-01 08:57:05 dovecot_plain authenticator failed for (bitomating) [46.10.210.68]:59720: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.28
country_id: 99237
description:
2025-12-01 08:59:02 dovecot_plain authenticator failed for (pompra) [65.20.129.28]:56040: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 08:59:48 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<sE9Bl9tEgrcXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.150
country_id: 1210997
description:
2025-12-01 09:03:08 dovecot_login authenticator failed for (ADMIN) [64.64.112.150]:8293: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-12-01 09:03:29 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:52468: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-12-01 09:03:49 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:50241: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.24
country_id: 2661886
description:
2025-12-01 09:06:43 dovecot_login authenticator failed for (ADMIN) [212.112.19.24]:50644: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.216.141
country_id: 99237
description:
Dec  1 09:09:59 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=65.20.216.141, lip=66.85.158.91, TLS, session=<w466uttE0K9BFNiN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 103.237.57.144
country_id: 1269750
description:
Dec  1 09:09:22 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=103.237.57.144, lip=66.85.158.91, session=<vRGcudtE9pVn7TmQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.197.8.144
country_id: 3175395
description:
Dec  1 09:09:40 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=185.197.8.144, lip=66.85.158.91, session=<jCSnuttEXrO5xQiQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-12-01 09:12:49 dovecot_login authenticator failed for (RMdf8HC8oH) [178.16.54.32]:61673: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 09:13:33 host2 sshd[309673]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.237.138.83
country_id: 6252001
description:
Dec  1 09:13:29 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.237.138.83, lip=66.85.158.91, session=<hnNMyNtEcLEj7YpT>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.164
country_id: 2993457
description:
Dec  1 09:13:29 host2 pure-ftpd[309624]: (?@194.165.16.164) [INFO] New connection from 194.165.16.164


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.243.219.50
country_id: 6252001
description:
Dec  1 09:13:43 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=35.243.219.50, lip=66.85.158.91, session=<NbokydtEqNwj89sy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-12-01 09:13:13 dovecot_login authenticator failed for (lWSI2aqSRz) [178.16.54.32]:50714: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-12-01 09:14:46 dovecot_login authenticator failed for (uqpSWX) [178.16.54.32]:54878: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.241
country_id: 1880251
description:
Dec  1 09:17:04 host2 sshd[312447]: Disconnected from invalid user sysadmin 101.47.48.241 port 58988 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.195
country_id: 6252001
description:
Dec  1 09:17:08 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.195, lip=66.85.158.92, session=<L1Jl1dtE8OrG6xjD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.185.36
country_id: 1819730
description:
Dec  1 09:17:24 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=152.32.185.36, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gghY1ttEDquYILkk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2025-12-01 09:20:11 dovecot_plain authenticator failed for c-68-40-189-43.hsd1.mi.comcast.net (uncylowes) [68.40.189.43]:59644: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.60
country_id: 1814991
description:
2025-12-01 09:22:11 dovecot_login authenticator failed for (ADMIN) [188.241.80.60]:26659: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.48.241
country_id: 1880251
description:
Dec  1 09:22:10 host2 sshd[317103]: Disconnected from invalid user vendas 101.47.48.241 port 49322 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.214.95.250
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 195.214.95.250 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec  1 09:23:44 host2 sshd[318397]: Disconnected from invalid user test1 179.51.153.37 port 50392 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.144.19.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 35.144.19.16 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.255.101.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 98.255.101.75 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.105.234
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.56.105.234 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec  1 09:25:17 host2 sshd[319677]: Disconnected from invalid user admin 179.51.153.37 port 57110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec  1 09:25:40 host2 sshd[319958]: Disconnected from invalid user ansadmin 162.240.212.247 port 36662 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.92
country_id: 1819730
description:
Dec  1 09:25:59 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.142.154.92, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8wj+9NtEDF0tjppc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec  1 09:26:50 host2 sshd[320687]: Disconnected from invalid user zookeeper 162.240.212.247 port 35372 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.212.247
country_id: 6252001
description:
Dec  1 09:28:01 host2 sshd[321401]: Disconnected from invalid user luis 162.240.212.247 port 34064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.19
country_id: 2029969
description:
2025-12-01 09:28:11 dovecot_login authenticator failed for (ADMIN) [173.244.58.19]:37652: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.140.2.120
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.140.2.120 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Dec  1 09:29:11 host2 sshd[322291]: Disconnected from invalid user postgres 162.240.212.247 port 32790 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.11.13.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.11.13.219 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.18.191.75
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.18.191.75 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.134.173.104
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.134.173.104 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.220.107.36
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.220.107.36 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.51.153.37
country_id: 3469034
description:
Dec  1 09:31:23 host2 sshd[323825]: Disconnected from invalid user db2inst1 179.51.153.37 port 40576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.198
country_id: 1733045
description:
Dec  1 09:31:45 host2 sshd[324087]: Disconnected from invalid user hello 202.165.16.198 port 51226 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.165.16.198
country_id: 1733045
description:
Dec  1 09:35:33 host2 sshd[326558]: Disconnected from invalid user db2inst1 202.165.16.198 port 59242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.198
country_id: 1733045
description:
Dec  1 09:36:48 host2 sshd[327568]: Disconnected from invalid user service 202.165.16.198 port 43406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.173.178
country_id: 2921044
description:
2025-12-01 09:37:24 dovecot_login authenticator failed for (ADMIN) [181.214.173.178]:40267: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.165.16.198
country_id: 1733045
description:
Dec  1 09:38:00 host2 sshd[328291]: Disconnected from invalid user ts2 202.165.16.198 port 51530 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 09:37:07 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<UTmyHNxEQocXXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.50.250.217
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.50.250.217 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.167.214
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.167.214 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.217.64.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 97.217.64.178 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.167.57.149
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.167.57.149 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.215.189.171
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.215.189.171 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.33.76.148
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.33.76.148 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.186.222.187
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.186.222.187 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.3
country_id: 2993457
description:
2025-12-01 09:46:16 dovecot_login authenticator failed for (ADMIN) [95.181.233.3]:49859: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.152.195.249
country_id: 6252001
description:
2025-12-01 09:51:46 dovecot_plain authenticator failed for ([89.116.164.85]) [47.152.195.249]:59256: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-12-01 09:52:24 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:48780: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-12-01 09:52:08 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:54011: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.0.132.205
country_id: 3469034
description:
2025-12-01 09:54:21 dovecot_plain authenticator failed for ([89.116.164.85]) [138.0.132.205]:10199: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.193
country_id: 2960313
description:
2025-12-01 09:55:38 dovecot_login authenticator failed for (ADMIN) [37.46.113.193]:19149: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.103
country_id: 6252001
description:
Dec  1 09:58:04 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.103, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<nRnEZ9xE88PN0h9n>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2025-12-01 09:58:08 dovecot_login authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:46451: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-12-01 09:58:29 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:37965: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.255.32.136
country_id: 102358
description:
2025-12-01 09:58:57 dovecot_plain authenticator failed for ([89.116.164.85]) [151.255.32.136]:8001: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 09:59:33 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ZrHybNxEWo4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.78.207.148
country_id: 3658394
description:
2025-12-01 10:03:29 dovecot_plain authenticator failed for ([89.116.164.85]) [181.78.207.148]:54507: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.37
country_id: 6252001
description:
Dec  1 10:05:39 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.37, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<LQDZgtxENNSTuYQl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.247.168
country_id: 1562822
description:
2025-12-01 10:05:58 dovecot_login authenticator failed for (ADMIN) [173.239.247.168]:51369: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 10:08:23 host2 sshd[355412]: Disconnected from invalid user user 2.57.121.25 port 49720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.42
country_id: 6252001
description:
2025-12-01 10:11:37 dovecot_login authenticator failed for (ADMIN) [173.244.56.42]:51315: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.4.73
country_id: 690791
description:
Dec  1 10:11:41 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=176.103.4.73, lip=66.85.158.91, TLS, session=<b4lcl9xEzN2wZwRJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.116
country_id: 3175395
description:
Dec  1 10:12:00 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.139.180.116, lip=66.85.158.91, TLS, session=<pqWJmNxEnK+5i7R0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.195.115.85
country_id: 1269750
description:
Dec  1 10:14:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@visionsolutionshospital.com>, method=PLAIN, rip=194.195.115.85, lip=66.85.158.91, session=<OlccodxE8JzCw3NV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.106.25.217
country_id: 6251999
description:
Dec  1 10:15:24 host2 sshd[361649]: Disconnected from invalid user marvin 140.106.25.217 port 53574 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.190.79.43
country_id: 3469034
description:
Dec  1 10:15:56 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=177.190.79.43, lip=66.85.158.91, TLS, session=<h4WaptxEh+Oxvk8r>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.245.219.199
country_id: 6290252
description:
Dec  1 10:16:14 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.245.219.199, lip=66.85.158.91, TLS, session=<Mcm/p9xE9J9t9dvH>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 140.106.25.217
country_id: 6251999
description:
Dec  1 10:16:24 host2 sshd[362480]: Disconnected from invalid user github 140.106.25.217 port 52232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 140.106.25.217
country_id: 6251999
description:
Dec  1 10:17:23 host2 sshd[363269]: Disconnected from invalid user devuser 140.106.25.217 port 50892 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.122.177
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.58.122.177 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.172.43.109
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.172.43.109 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.168.209.51
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 174.168.209.51 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.26.234.16
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.26.234.16 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.196.148.161
country_id: 3469034
description:
2025-12-01 10:20:48 dovecot_plain authenticator failed for ([89.116.164.85]) [177.196.148.161]:41269: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.197.8.146
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 162.197.8.146 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.4.114.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.4.114.111 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.6.85.238
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.6.85.238 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.119.224.29
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.119.224.29 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 208.107.193.163
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 208.107.193.163 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.38.145.80
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 136.38.145.80 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.167.56.47
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.167.56.47 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.216.116.28
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.216.116.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.109.202
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 47.150.109.202 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.176.49.129
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.176.49.129 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:25:04 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<3H1MyNxEttMDjyE/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.223.76.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.223.76.181 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.220.118.201
country_id: 6290252
description:
2025-12-01 10:26:34 dovecot_plain authenticator failed for 178-220-118-201.static.isp.telekom.rs (prodions) [178.220.118.201]:40923: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.10.48.122
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 67.10.48.122 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.174.174.39
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 216.174.174.39 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.48.57.154
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.48.57.154 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.89.213.92
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 64.89.213.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.5.138.94
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 172.5.138.94 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.222.12.182
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.222.12.182 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.20
country_id: 2661886
description:
2025-12-01 10:27:54 dovecot_login authenticator failed for (ADMIN) [212.112.19.20]:10764: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:28:09 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<hR9U09xENtEDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.88
country_id: 6252001
description:
Dec  1 10:28:42 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.149.88, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<nrVS1dxEq9qi2JVY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.48.92
country_id: 6251999
description:
2025-12-01 10:29:07 dovecot_login authenticator failed for (ADMIN) [212.32.48.92]:52708: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.88
country_id: 6252001
description:
Dec  1 10:29:12 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 18 secs): user=<>, rip=162.216.149.88, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<iVQa19xEBu+i2JVY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:30:05 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<8Eg+2txEuMoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:30:22 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<5P1D29xEDtcDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-01 10:30:32 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (nopol) [98.192.74.183]:34816: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:30:47 host2 dovecot[3366265]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<E7jJ3NxEdtgDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:31:57 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<CZHt4NxEFuUDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.18.126
country_id: 1269750
description:
2025-12-01 10:31:59 dovecot_login authenticator failed for (telemedia-ap-dynamic-126.18.175.122.airtelbroadband.in) [122.175.18.126]:52201: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:32:47 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, session=<GC/q49xEzMIDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:33:18 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<Xx3F5dxE7qwDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.215.111.144
country_id: 3144096
description:
2025-12-01 10:33:39 dovecot_login authenticator failed for ([127.0.0.1]) [84.215.111.144]:33151: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.93.59.131
country_id: 1821275
description:
2025-12-01 10:33:53 dovecot_login authenticator failed for ([127.0.0.1]) [182.93.59.131]:48484: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:33:54 host2 dovecot[3366265]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<j9bp59xEQIYDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec  1 10:34:22 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, session=<nqqY6dxEHsc2rEyT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 10:35:33 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, session=<ypLL7dxEOM0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.88
country_id: 6252001
description:
Dec  1 10:36:09 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.88, lip=66.85.158.92, TLS, session=<NeH379xEquWi2JVY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 10:38:10 host2 sshd[381079]: Disconnected from invalid user flor 62.60.131.157 port 20229 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.252.197.98
country_id: 3202326
description:
2025-12-01 10:38:26 dovecot_plain authenticator failed for ([89.116.164.85]) [188.252.197.98]:20969: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.247.42.36
country_id: 2658434
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 94.247.42.36 - - "POST /cpsess0130295740/3rdparty/roundcube/:2087/json-api/create_user_session HTTP/1.1" FAILED LOGIN webmaild: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.110
country_id: 2635167
description:
2025-12-01 10:45:56 dovecot_login authenticator failed for (ADMIN) [158.173.23.110]:30897: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.68
country_id: 783754
description:
2025-12-01 10:46:23 dovecot_login authenticator failed for (ADMIN) [31.171.154.68]:37112: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.79.54.237
country_id: 3469034
description:
2025-12-01 10:50:04 dovecot_plain authenticator failed for 170-79-54-237.justwebtelecom.com.br ([89.116.164.85]) [170.79.54.237]:44341: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.79.54.237
country_id: 3469034
description:
2025-12-01 10:50:11 dovecot_login authenticator failed for 170-79-54-237.justwebtelecom.com.br ([89.116.164.85]) [170.79.54.237]:44341: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.80.74.188
country_id: 3175395
description:
2025-12-01 10:52:27 dovecot_plain authenticator failed for ([89.116.164.85]) [91.80.74.188]:51893: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-12-01 10:56:01 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (phile) [73.161.96.107]:36620: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.178.24.101
country_id: 6252001
description:
2025-12-01 10:57:10 dovecot_plain authenticator failed for ([89.116.164.85]) [107.178.24.101]:9774: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-12-01 11:01:22 dovecot_login authenticator failed for ([61.246.72.73]) [203.132.133.54]:35730: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.228.15.99
country_id: 1269750
description:
2025-12-01 11:01:29 dovecot_plain authenticator failed for ([89.116.164.85]) [223.228.15.99]:40597: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.94.211
country_id: 1880251
description:
2025-12-01 11:01:44 dovecot_login authenticator failed for ([223.25.94.211]) [223.25.94.211]:58442: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.124
country_id: 783754
description:
2025-12-01 11:02:16 dovecot_login authenticator failed for (ADMIN) [31.171.154.124]:39442: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.180
country_id: 6252001
description:
Dec  1 11:03:52 host2 pure-ftpd[405786]: (?@147.185.132.180) [INFO] New connection from 147.185.132.180


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.143
country_id: 2960313
description:
2025-12-01 11:06:18 dovecot_login authenticator failed for (ADMIN) [37.46.113.143]:63325: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.154
country_id: 6252001
description:
Dec  1 11:11:02 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.154, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<sFCybN1E2q+H7X6a>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.190
country_id: 798544
description:
Dec  1 11:11:31 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=31.179.228.190, lip=66.85.158.91, TLS, session=<0jlwbd1ExK8fs+S+>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.40.85.205
country_id: 6252001
description:
[2025-12-01 11:12:04 +0530] info [cpaneld] 70.40.85.205 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.57.104
country_id: 6252001
description:
Dec  1 11:11:12 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.29.57.104, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YbZTbd1E3NsUHTlo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.137.152
country_id: 3469034
description:
Dec  1 11:11:13 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=190.89.137.152, lip=66.85.158.91, TLS, session=<OUhHbN1EPOy+WYmY>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.213.223.12
country_id: 6252001
description:
[2025-12-01 11:11:59 +0530] info [cpaneld] 108.213.223.12 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.21.160.28
country_id: 6252001
description:
[2025-12-01 11:12:06 +0530] info [cpaneld] 76.21.160.28 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.234.41.66
country_id: 6252001
description:
[2025-12-01 11:12:08 +0530] info [whostmgrd] 69.234.41.66 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.70.67.135
country_id: 6252001
description:
[2025-12-01 11:12:17 +0530] info [cpaneld] 73.70.67.135 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.52.112.248
country_id: 6252001
description:
[2025-12-01 11:12:26 +0530] info [cpaneld] 184.52.112.248 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.231.162.135
country_id: 6252001
description:
[2025-12-01 11:12:13 +0530] info [cpaneld] 47.231.162.135 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 134.122.91.234
country_id: 2921044
description:
Dec  1 11:14:17 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=134.122.91.234, lip=66.85.158.92, TLS, session=<yYtSeN1EelGGelvq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.169.52
country_id: 3469034
description:
2025-12-01 11:15:14 dovecot_plain authenticator failed for ([89.116.164.85]) [45.238.169.52]:7394: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.81.33
country_id: 6251999
description:
2025-12-01 11:17:03 dovecot_login authenticator failed for (ADMIN) [66.56.81.33]:46926: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.196.242
country_id: 3469034
description:
Dec  1 11:16:56 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=179.189.196.242, lip=66.85.158.91, TLS, session=<fDGtgN1EkaazvcTy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.186.75.106
country_id: 6290252
description:
Dec  1 11:17:14 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=93.186.75.106, lip=66.85.158.91, TLS, session=<7u7lgd1E9eVduktq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.124
country_id: 6252001
description:
Dec  1 11:17:28 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.132.124, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<ZCu7g91E19aTuYR8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 138.91.109.125
country_id: 6252001
description:
Dec  1 11:18:55 host2 pure-ftpd[418930]: (?@138.91.109.125) [INFO] New connection from 138.91.109.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.244.73.238
country_id: 6252001
description:
2025-12-01 11:19:05 dovecot_plain authenticator failed for ([89.116.164.85]) [74.244.73.238]:14105: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.244.73.238
country_id: 6252001
description:
2025-12-01 11:19:12 dovecot_login authenticator failed for ([89.116.164.85]) [74.244.73.238]:14105: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 11:21:19 host2 sshd[420934]: Disconnected from invalid user admin 2.57.121.112 port 19611 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.24
country_id: 1522867
description:
2025-12-01 11:23:17 dovecot_login authenticator failed for (ADMIN) [62.133.47.24]:47484: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.124
country_id: 6252001
description:
Dec  1 11:24:37 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.124, lip=66.85.158.91, TLS, session=<mdJHnd1EfP2TuYR8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-12-01 11:26:07 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:50286: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.254.80.99
country_id: 1269750
description:
2025-12-01 11:26:51 dovecot_plain authenticator failed for (thipes) [65.254.80.99]:55502: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec  1 11:27:26 host2 sshd[426404]: Disconnected from invalid user roott 143.110.137.94 port 56612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Dec  1 11:30:04 host2 sshd[428726]: Disconnected from invalid user tony 37.252.188.15 port 44200 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 11:30:49 host2 sshd[429472]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec  1 11:30:18 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<gbucsd1ENJAD7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Dec  1 11:31:56 host2 sshd[430482]: Disconnected from invalid user frappe 37.252.188.15 port 51502 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 37.252.188.15
country_id: 2782113
description:
Dec  1 11:33:59 host2 sshd[432330]: Disconnected from invalid user andy 37.252.188.15 port 48958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.56.11.17
country_id: 3865483
description:
Dec  1 11:34:56 host2 sshd[433138]: Disconnected from invalid user mega 186.56.11.17 port 35354 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec  1 11:35:25 host2 sshd[433761]: Disconnected from invalid user root2 143.110.137.94 port 53164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.252.188.15
country_id: 2782113
description:
Dec  1 11:37:08 host2 sshd[435146]: Disconnected from invalid user cinema 37.252.188.15 port 45128 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.56.11.17
country_id: 3865483
description:
Dec  1 11:39:15 host2 sshd[437149]: Disconnected from invalid user admin 186.56.11.17 port 51712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Dec  1 11:44:47 host2 sshd[442407]: Disconnected from invalid user testftp 143.110.137.94 port 37658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.42.1
country_id: 1643084
description:
Dec  1 11:45:27 host2 sshd[443137]: Disconnected from invalid user tony 103.67.42.1 port 34228 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.42.1
country_id: 1643084
description:
Dec  1 11:46:50 host2 sshd[444720]: Disconnected from invalid user ubuntu 103.67.42.1 port 40500 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.14
country_id: 2029969
description:
2025-12-01 11:47:06 dovecot_login authenticator failed for (ADMIN) [173.244.58.14]:48004: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec  1 11:46:28 host2 sshd[444402]: Disconnected from invalid user vagrant 177.10.201.7 port 46698 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.137.94
country_id: 6252001
description:
Dec  1 11:46:39 host2 sshd[444554]: Disconnected from invalid user qwerty 143.110.137.94 port 50154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.198.238
country_id: 130758
description:
Dec  1 11:49:14 host2 sshd[446762]: Disconnected from invalid user vagrant 62.60.198.238 port 56282 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.164.240.11
country_id: 3895114
description:
2025-12-01 11:50:39 dovecot_plain authenticator failed for pc-11-240-164-190.cm.vtr.net ([89.116.164.85]) [190.164.240.11]:37614: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.42.1
country_id: 1643084
description:
Dec  1 11:50:59 host2 sshd[448547]: Disconnected from invalid user user 103.67.42.1 port 44186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.131.159
country_id: 6252001
description:
Dec  1 11:51:41 host2 sshd[449387]: Invalid user cloudtourssrilan_travel from 124.198.131.159 port 56402


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.32
country_id: 390903
description:
2025-12-01 11:52:30 dovecot_login authenticator failed for (ADMIN) [79.127.181.32]:33326: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.10.201.7
country_id: 3469034
description:
Dec  1 11:52:10 host2 sshd[449864]: Disconnected from invalid user terraria 177.10.201.7 port 50880 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.96.41.141
country_id: 1269750
description:
2025-12-01 11:55:33 dovecot_plain authenticator failed for ([89.116.164.85]) [117.96.41.141]:20985: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.198.238
country_id: 130758
description:
Dec  1 11:56:00 host2 sshd[454649]: Disconnected from invalid user odoo 62.60.198.238 port 51898 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 11:56:56 host2 sshd[455651]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Dec  1 11:56:31 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@systemtec.lk>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<eJE2D95Ebqd283VD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.67.235.174
country_id: 935317
description:
2025-12-01 11:59:47 dovecot_plain authenticator failed for ([89.116.164.85]) [154.67.235.174]:48970: 535 Incorrect authentication data (set_id=support@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.198.238
country_id: 130758
description:
Dec  1 12:01:37 host2 sshd[460281]: Disconnected from invalid user terraria 62.60.198.238 port 41020 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.5
country_id: 6252001
description:
Dec  1 12:04:08 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=194.164.107.5, lip=66.85.158.91, TLS, session=<hkeiKt5EoKfCpGsF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-12-01 12:04:45 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:56706: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.214
country_id: 3865483
description:
Dec  1 12:04:52 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=190.181.101.214, lip=66.85.158.91, TLS, session=<qvUgLN5Ewqq+tWXW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.61.153.63
country_id: 2510769
description:
Dec  1 12:05:11 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=37.61.153.63, lip=66.85.158.91, TLS, session=<QUtRLd5E26MlPZk/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 12:06:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<NXnAMd5ELjlRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.50
country_id: 6252001
description:
2025-12-01 12:07:04 dovecot_login authenticator failed for (ADMIN) [173.244.56.50]:9567: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.69.129.95
country_id: 1819730
description:
Dec  1 12:07:38 host2 sshd[467025]: Disconnected from invalid user administrator 103.69.129.95 port 51516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Dec  1 12:09:58 host2 sshd[469315]: Disconnected from invalid user superset 187.107.88.97 port 54323 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.228
country_id: 6252001
description:
2025-12-01 12:10:23 dovecot_login authenticator failed for (ADMIN) [191.96.67.228]:26071: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.234
country_id: 1880251
description:
Dec  1 12:11:13 host2 sshd[470669]: Disconnected from invalid user ubuntu 45.78.227.234 port 32884 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.69.129.95
country_id: 1819730
description:
Dec  1 12:15:29 host2 sshd[474547]: Disconnected from invalid user production 103.69.129.95 port 33978 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.138
country_id: 6252001
description:
Dec  1 12:16:55 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.138, lip=66.85.158.91, TLS: Connection closed, session=<D69VWN5E9IZChJmK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Dec  1 12:17:16 host2 sshd[476165]: Disconnected from invalid user master 187.107.88.97 port 34630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Dec  1 12:20:10 host2 sshd[478831]: Disconnected from invalid user erpnext 187.107.88.97 port 40868 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.69.129.95
country_id: 1819730
description:
Dec  1 12:20:30 host2 sshd[479109]: Disconnected from invalid user bounce 103.69.129.95 port 47976 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Dec  1 12:22:25 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<VV3aa95EoLOSOC+J>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.107.88.97
country_id: 3469034
description:
Dec  1 12:23:13 host2 sshd[481472]: Disconnected from invalid user nominatim 187.107.88.97 port 43438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.53
country_id: 390903
description:
2025-12-01 12:23:45 dovecot_login authenticator failed for (ADMIN) [79.127.181.53]:23640: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 12:24:17 host2 sshd[482467]: Disconnected from invalid user makena 62.60.131.157 port 23786 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-01 12:26:06 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:65517: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 12:26:18 host2 sshd[484198]: Disconnected from invalid user makena 62.60.131.157 port 6496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.107.88.97
country_id: 3469034
description:
Dec  1 12:26:12 host2 sshd[484142]: Disconnected from invalid user taibabi 187.107.88.97 port 39976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.234
country_id: 1880251
description:
Dec  1 12:27:22 host2 sshd[485170]: Disconnected from invalid user erpnext 45.78.227.234 port 58402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.18
country_id: 2589581
description:
2025-12-01 12:28:00 dovecot_login authenticator failed for (ADMIN) [176.125.228.18]:33617: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.227.234
country_id: 1880251
description:
Dec  1 12:29:53 host2 sshd[487042]: Disconnected from invalid user es 45.78.227.234 port 60226 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.209.96.179
country_id: 2921044
description:
Dec  1 12:31:28 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=8.209.96.179, lip=66.85.158.91, session=<bL1ejN5EtugI0WCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-01 12:33:04 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:60904: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-12-01 12:32:28 dovecot_login authenticator failed for ([125.23.235.136]) [128.185.252.110]:49098: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.131.134.68
country_id: 3658394
description:
2025-12-01 12:35:30 dovecot_plain authenticator failed for ([89.116.164.85]) [190.131.134.68]:51194: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-12-01 12:37:23 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:49032: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.148.10.116
country_id: 1210997
description:
2025-12-01 12:38:18 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.116]:48052: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 12:40:55 host2 sshd[498308]: Disconnected from invalid user admin 2.57.121.112 port 27579 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.68
country_id: 6252001
description:
2025-12-01 12:40:25 dovecot_login authenticator failed for (ADMIN) [173.244.56.68]:52991: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.244.246
country_id: 2077456
description:
2025-12-01 12:43:49 dovecot_login authenticator failed for ([127.0.0.1]) [120.157.244.246]:37428: 535 Incorrect authentication data (set_id=art@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-01 12:43:58 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:44742: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.213.35
country_id: 3996063
description:
2025-12-01 12:44:00 dovecot_login authenticator failed for ([127.0.0.1]) [187.161.213.35]:41723: 535 Incorrect authentication data (set_id=art)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-12-01 12:44:13 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:54464: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.81.192
country_id: 6251999
description:
2025-12-01 12:46:10 dovecot_login authenticator failed for (ADMIN) [66.56.81.192]:34150: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.57.132
country_id: 3469034
description:
2025-12-01 12:47:08 dovecot_plain authenticator failed for 138-36-57-132.static.sumicity.net.br ([89.116.164.85]) [138.36.57.132]:10681: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.57.132
country_id: 3469034
description:
2025-12-01 12:47:14 dovecot_login authenticator failed for 138-36-57-132.static.sumicity.net.br ([89.116.164.85]) [138.36.57.132]:10681: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.193.142.160
country_id: 3469034
description:
2025-12-01 12:48:59 dovecot_plain authenticator failed for 200-193-142-160.user3p.v-tal.net.br ([89.116.164.85]) [200.193.142.160]:60296: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec  1 12:49:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, TLS, session=<N9avy95ESIcD7r/l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.52.177
country_id: 953987
description:
Dec  1 12:53:38 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@jrdc.lk>, method=PLAIN, rip=102.129.52.177, lip=66.85.158.91, TLS, session=<hnli2t5EC4pmgTSx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.29.218.152
country_id: 3686110
description:
2025-12-01 12:53:50 dovecot_plain authenticator failed for dynamic-186-29-218-152.dynamic.etb.net.co ([89.116.164.85]) [186.29.218.152]:42710: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.47.234
country_id: 2300660
description:
Dec  1 12:54:02 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=41.139.47.234, lip=66.85.158.91, TLS, session=<wHrQ295Eiuspiy/q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.33
country_id: 6252001
description:
Dec  1 12:55:47 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.33, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<r+1U495E0tmTuYQh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.162.12
country_id: 290557
description:
2025-12-01 12:56:53 dovecot_login authenticator failed for (ADMIN) [217.138.162.12]:60754: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.0.186.225
country_id: 3865483
description:
2025-12-01 12:57:51 dovecot_plain authenticator failed for ([89.116.164.85]) [168.0.186.225]:36514: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.206
country_id: 1269750
description:
2025-12-01 13:00:39 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.178.206]:34740: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2025-12-01 13:00:17 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.181.166]:40534: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
country_id: 798544
description:
2025-12-01 13:01:37 dovecot_plain authenticator failed for (cimas) [94.254.244.211]:40491: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.213
country_id: 2510769
description:
2025-12-01 13:04:45 dovecot_login authenticator failed for (ADMIN) [212.102.49.213]:43163: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.177.134
country_id: 3175395
description:
Dec  1 13:07:09 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@systemtec.lk>, method=PLAIN, rip=185.68.177.134, lip=66.85.158.91, TLS, session=</BgCC99E2rG5RLGG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.68
country_id: 3469034
description:
Dec  1 13:07:30 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.44.71.68, lip=66.85.158.91, TLS, session=<pdEbDN9EHtexLEdE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.46.146.249
country_id: 6252001
description:
2025-12-01 13:11:54 dovecot_plain authenticator failed for ([89.116.164.85]) [73.46.146.249]:51167: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.88.26.151
country_id: 294640
description:
2025-12-01 13:14:17 dovecot_login authenticator failed for (ADMIN) [149.88.26.151]:49448: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.46.136.234
country_id: 3865483
description:
2025-12-01 13:15:47 dovecot_plain authenticator failed for ([89.116.164.85]) [181.46.136.234]:19685: 535 Incorrect authentication data (set_id=sales@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.224.215.23
country_id: 1269750
description:
2025-12-01 13:18:20 dovecot_login authenticator failed for ([127.0.0.1]) [74.224.215.23]:5312: 535 Incorrect authentication data (set_id=training)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.55.58
country_id: 298795
description:
2025-12-01 13:18:12 dovecot_login authenticator failed for ([127.0.0.1]) [185.254.55.58]:33006: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 13:22:45 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<cwSlQ99EdMAXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-01 13:24:05 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (chabrater) [81.225.30.107]:36698: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 13:24:28 host2 sshd[541273]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.156
country_id: 6252001
description:
2025-12-01 13:26:29 dovecot_login authenticator failed for (ADMIN) [173.244.56.156]:12300: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.218
country_id: 798549
description:
2025-12-01 13:30:45 dovecot_login authenticator failed for (ADMIN) [91.90.120.218]:15118: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-12-01 13:32:38 dovecot_login authenticator failed for bl14-230-132.dsl.telepac.pt [85.247.230.132]:43868: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-12-01 13:33:14 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:33585: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.13.107
country_id: 3469034
description:
2025-12-01 13:33:57 dovecot_plain authenticator failed for ([89.116.164.85]) [170.233.13.107]:12683: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-12-01 13:34:37 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:59126: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-12-01 13:34:47 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:53640: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-12-01 13:38:59 dovecot_login authenticator failed for (189.218.82.49-clientes-izzi.mx) [189.218.82.49]:33366: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-12-01 13:39:24 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:43414: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.61
country_id: 2635167
description:
2025-12-01 13:43:53 dovecot_login authenticator failed for (ADMIN) [98.159.234.61]:10578: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.87.218.89
country_id: 102358
description:
2025-12-01 13:45:28 dovecot_plain authenticator failed for ([89.116.164.85]) [178.87.218.89]:57722: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-12-01 13:47:07 dovecot_plain authenticator failed for (entorely) [154.146.240.123]:37522: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.210
country_id: 798549
description:
2025-12-01 13:46:38 dovecot_login authenticator failed for (ADMIN) [91.90.120.210]:32861: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec  1 13:48:00 host2 sshd[562752]: Disconnected from invalid user shiny 45.144.233.139 port 50214 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.178.15.45
country_id: 3865483
description:
2025-12-01 13:47:09 dovecot_plain authenticator failed for ([89.116.164.85]) [190.178.15.45]:44936: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 13:48:30 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<zTW3n99EYqQXXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 13:50:31 host2 sshd[565240]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec  1 13:50:22 host2 sshd[565123]: Disconnected from invalid user mm 45.144.233.139 port 47612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Dec  1 13:51:13 host2 sshd[565836]: Disconnected from invalid user victor 98.159.109.235 port 41064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.233.151.14
country_id: 3469034
description:
Dec  1 13:51:56 host2 sshd[566396]: Disconnected from invalid user Test 170.233.151.14 port 40048 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.10.75
country_id: 2300660
description:
Dec  1 13:52:28 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=41.139.10.75, lip=66.85.158.91, TLS, session=<sOHmrN9EwswpiwpL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Dec  1 13:52:45 host2 sshd[567195]: Disconnected from invalid user ctf 103.49.238.251 port 36764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.8.118.140
country_id: 1269750
description:
Dec  1 13:52:49 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.8.118.140, lip=66.85.158.91, TLS, session=<zqIrrt9EPpdnCHaM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.212.79.24
country_id: 3469034
description:
2025-12-01 13:52:09 dovecot_plain authenticator failed for ([89.116.164.85]) [177.212.79.24]:51582: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 170.233.151.14
country_id: 3469034
description:
Dec  1 13:53:11 host2 sshd[567572]: Disconnected from invalid user init 170.233.151.14 port 48542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Dec  1 13:54:51 host2 sshd[569567]: Disconnected from invalid user testftp 70.65.44.183 port 34068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.233.151.14
country_id: 3469034
description:
Dec  1 13:55:40 host2 sshd[570379]: Disconnected from invalid user max 170.233.151.14 port 41412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.234.237.10
country_id: 298795
description:
2025-12-01 13:56:16 dovecot_plain authenticator failed for ([89.116.164.85]) [88.234.237.10]:46716: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Dec  1 13:56:32 host2 sshd[571098]: Disconnected from invalid user temp 103.49.238.251 port 43436 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - yashihol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashihol (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec  1 13:57:31 host2 sshd[572128]: Disconnected from invalid user public 45.144.233.139 port 34710 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 70.65.44.183
country_id: 6251999
description:
Dec  1 13:57:16 host2 sshd[571850]: Disconnected from invalid user gerrit 70.65.44.183 port 34286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Dec  1 13:58:23 host2 sshd[572938]: Disconnected from invalid user sopuser 70.65.44.183 port 34392 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.144.233.139
country_id: 2921044
description:
Dec  1 13:58:29 host2 sshd[573003]: Disconnected from invalid user invoices 45.144.233.139 port 50742 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 13:59:12 host2 sshd[573649]: Disconnected from invalid user admin 2.57.121.112 port 49289 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 98.159.109.235
country_id: 6252001
description:
Dec  1 14:00:57 host2 sshd[575462]: Disconnected from invalid user usuario2 98.159.109.235 port 45938 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-12-01 14:01:11 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (bress) [73.171.230.200]:53652: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.251
country_id: 1643084
description:
Dec  1 14:01:43 host2 sshd[576180]: Disconnected from invalid user bot 103.49.238.251 port 39800 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-12-01 14:01:09 dovecot_plain authenticator failed for (prothnus) [65.20.233.110]:38516: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.121
country_id: 783754
description:
2025-12-01 14:03:26 dovecot_login authenticator failed for (ADMIN) [31.171.154.121]:48014: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.226.104.207
country_id: 298795
description:
2025-12-01 14:10:09 dovecot_plain authenticator failed for ([89.116.164.85]) [88.226.104.207]:11656: 535 Incorrect authentication data (set_id=marketing@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-12-01 14:10:13 dovecot_login authenticator failed for ([62.73.121.209]) [62.73.121.209]:56032: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-12-01 14:10:22 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:58582: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 14:11:37 host2 sshd[586534]: Disconnected from invalid user miya 62.60.131.157 port 7078 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 192.3.154.58
country_id: 6252001
description:
Dec  1 14:12:07 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=192.3.154.58, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<RStS9N9E3uHAA5o6>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - ceyl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 14:16:37 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<wEhKBOBEQlVRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-12-01 14:17:03 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (nisfase) [72.241.202.216]:57747: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.52
country_id: 2661886
description:
2025-12-01 14:18:43 dovecot_login authenticator failed for (ADMIN) [46.246.8.52]:46755: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec  1 14:21:24 host2 sshd[595398]: Disconnected from invalid user openbravo 201.249.205.94 port 43438 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.138.184
country_id: 3144096
description:
2025-12-01 14:23:00 dovecot_login authenticator failed for ([127.0.0.1]) [178.232.138.184]:38258: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.37
country_id: 3865483
description:
2025-12-01 14:22:47 dovecot_login authenticator failed for (ADMIN) [146.70.38.37]:6413: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-01 14:23:09 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.226.118]:45976: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Dec  1 14:23:43 host2 sshd[597512]: Disconnected from invalid user customer 196.188.120.232 port 55264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec  1 14:23:57 host2 sshd[597712]: Disconnected from invalid user debian 201.249.205.94 port 57380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Dec  1 14:25:00 host2 sshd[598772]: Disconnected from invalid user tuan 196.188.120.232 port 33410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec  1 14:25:17 host2 sshd[599219]: Disconnected from invalid user sopuser 36.67.70.198 port 55868 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.188.120.232
country_id: 337996
description:
Dec  1 14:26:16 host2 sshd[600146]: Disconnected from invalid user superset 196.188.120.232 port 44612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec  1 14:26:57 host2 sshd[600746]: Disconnected from invalid user bob 36.67.70.198 port 33304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.230.95
country_id: 2635167
description:
Dec  1 14:27:41 host2 sshd[601568]: Disconnected from invalid user amssys 165.227.230.95 port 38328 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec  1 14:28:51 host2 sshd[602625]: Disconnected from invalid user student 201.249.205.94 port 50878 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Dec  1 14:30:04 host2 sshd[603803]: Disconnected from invalid user sopuser 196.188.120.232 port 33312 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec  1 14:30:17 host2 sshd[604066]: Disconnected from invalid user server 36.67.70.198 port 45910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.230.95
country_id: 2635167
description:
Dec  1 14:31:12 host2 sshd[604915]: Disconnected from invalid user sonarqube 165.227.230.95 port 46230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.188.120.232
country_id: 337996
description:
Dec  1 14:32:29 host2 sshd[606107]: Disconnected from invalid user fred 196.188.120.232 port 37698 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.227.230.95
country_id: 2635167
description:
Dec  1 14:32:19 host2 sshd[605876]: Disconnected from invalid user radarr 165.227.230.95 port 47606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.67.70.198
country_id: 1643084
description:
Dec  1 14:33:23 host2 sshd[606913]: Disconnected from invalid user superset 36.67.70.198 port 55242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.230.95
country_id: 2635167
description:
Dec  1 14:33:27 host2 sshd[606977]: Disconnected from invalid user ir 165.227.230.95 port 48548 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.235.171
country_id: 102358
description:
2025-12-01 14:33:38 dovecot_login authenticator failed for (ADMIN) [95.181.235.171]:54387: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Dec  1 14:35:58 host2 sshd[609410]: Disconnected from invalid user javad 201.249.205.94 port 36584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.114.250
country_id: 1643084
description:
Dec  1 14:40:40 host2 sshd[614393]: Disconnected from invalid user frappe 103.52.114.250 port 39776 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.78
country_id: 2510769
description:
2025-12-01 14:43:43 dovecot_login authenticator failed for (ADMIN) [212.102.49.78]:33233: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.114.250
country_id: 1643084
description:
Dec  1 14:44:56 host2 sshd[619087]: Disconnected from invalid user vendas 103.52.114.250 port 58630 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.3
country_id: 1269750
description:
Dec  1 14:46:18 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.51.223.3, lip=66.85.158.91, TLS, session=<zh9tbeBEd6xnM98D>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.114.250
country_id: 1643084
description:
Dec  1 14:46:19 host2 sshd[621149]: Disconnected from invalid user ts2 103.52.114.250 port 58002 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.168
country_id: 1269750
description:
Dec  1 14:46:39 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.18.166.168, lip=66.85.158.91, TLS, session=<lMe3buBEB91nEqao>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.38
country_id: 617790
description:
2025-12-01 14:47:44 dovecot_login authenticator failed for (ADMIN) [178.175.128.38]:22099: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.114.250
country_id: 1643084
description:
Dec  1 14:51:33 host2 sshd[626110]: Disconnected from invalid user retag 103.52.114.250 port 38534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.114.250
country_id: 1643084
description:
Dec  1 14:52:51 host2 sshd[627263]: Disconnected from invalid user root1 103.52.114.250 port 40192 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - yash "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yash (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec  1 15:02:32 host2 sshd[638993]: Disconnected from invalid user admin1 83.229.122.23 port 46276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.20.136
country_id: 2750405
description:
2025-12-01 15:03:07 dovecot_login authenticator failed for (ADMIN) [158.173.20.136]:11079: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.58.18
country_id: 2029969
description:
2025-12-01 15:05:02 dovecot_login authenticator failed for (ADMIN) [173.244.58.18]:54266: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec  1 15:05:10 host2 sshd[643198]: Disconnected from invalid user sahil 5.182.26.99 port 33870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec  1 15:05:51 host2 sshd[644061]: Disconnected from invalid user admin1234 83.229.122.23 port 53674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec  1 15:07:15 host2 sshd[645708]: Disconnected from invalid user vendas 5.182.26.99 port 49778 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec  1 15:07:20 host2 sshd[645807]: Disconnected from invalid user cacti 190.181.25.210 port 56455 [preauth]


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 45.121.88.28
country_id: 1227603
description:
[2025-12-01 15:07:34 +0530] info [cpaneld] 45.121.88.28 NEW veneelk:qvZUPzvIMMAkLjDQ address=45.121.88.28,app=cpaneld,creator=veneelk,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Dec  1 15:09:33 host2 sshd[648436]: Disconnected from invalid user intell 83.229.122.23 port 51444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec  1 15:10:54 host2 sshd[650305]: Disconnected from invalid user user1 83.229.122.23 port 60052 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec  1 15:11:08 host2 sshd[650605]: Disconnected from invalid user admin 36.255.223.75 port 41494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 5.182.26.99
country_id: 1512440
description:
Dec  1 15:12:10 host2 sshd[651733]: Disconnected from invalid user gits 5.182.26.99 port 38440 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.223.75
country_id: 1880251
description:
Dec  1 15:12:25 host2 sshd[651985]: Disconnected from invalid user user 36.255.223.75 port 13432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Dec  1 15:13:15 host2 sshd[652846]: Disconnected from invalid user luis 83.229.122.23 port 51274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-12-01 15:13:10 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (culers) [73.199.161.144]:52862: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec  1 15:14:41 host2 sshd[654290]: Disconnected from invalid user user6 190.181.25.210 port 38945 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.223.75
country_id: 1880251
description:
Dec  1 15:14:49 host2 sshd[654421]: Disconnected from invalid user qw 36.255.223.75 port 12292 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.25.210
country_id: 3923057
description:
Dec  1 15:16:00 host2 sshd[655671]: Disconnected from invalid user oscar 190.181.25.210 port 53914 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-12-01 15:16:05 dovecot_plain authenticator failed for (excus) [65.20.133.208]:54689: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 15:15:34 host2 sshd[655334]: Disconnected from invalid user admin 2.57.121.112 port 42667 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.228
country_id: 718075
description:
2025-12-01 15:19:00 dovecot_login authenticator failed for (ADMIN) [185.225.28.228]:51704: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.25.210
country_id: 3923057
description:
Dec  1 15:18:49 host2 sshd[658740]: Disconnected from invalid user victor 190.181.25.210 port 55615 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.47
country_id: 6252001
description:
2025-12-01 15:23:05 dovecot_login authenticator failed for (ADMIN) [212.32.50.47]:45544: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 15:23:36 host2 sshd[663722]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - ceylon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylon (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Dec  1 15:25:39 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<yVxM++BEiOkD7r/l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-01 15:29:32 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (prosteria) [174.166.153.20]:59394: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.40
country_id: 2589581
description:
2025-12-01 15:33:28 dovecot_login authenticator failed for (ADMIN) [176.125.228.40]:42690: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 15:32:57 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<rqJBFeFEaK4XXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 15:34:54 host2 sshd[674640]: Disconnected from invalid user user 2.57.121.25 port 51944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 15:36:31 host2 sshd[676567]: Disconnected from invalid user user 2.57.121.25 port 6879 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.58.87.108
country_id: 6252001
description:
2025-12-01 15:40:05 dovecot_plain authenticator failed for c-174-58-87-108.hsd1.fl.comcast.net (lares) [174.58.87.108]:53946: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.20.122
country_id: 2750405
description:
2025-12-01 15:45:22 dovecot_login authenticator failed for (ADMIN) [158.173.20.122]:18816: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.122.128.234
country_id: 3865483
description:
Dec  1 15:46:22 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=190.122.128.234, lip=66.85.158.91, TLS, session=<Tz82ROFEKcu+eoDq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Dec  1 15:45:53 host2 sshd[687482]: Disconnected from invalid user docker 54.38.52.18 port 34890 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.114.0
country_id: 3469034
description:
Dec  1 15:46:42 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.87.114.0, lip=66.85.158.91, TLS, session=<XxV+ReFEAdaxV3IA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.39
country_id: 6252001
description:
2025-12-01 15:47:34 dovecot_login authenticator failed for (ADMIN) [173.244.56.39]:25283: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 54.38.52.18
country_id: 798544
description:
Dec  1 15:48:04 host2 sshd[689608]: Disconnected from invalid user ansible 54.38.52.18 port 51902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Dec  1 15:49:10 host2 sshd[690721]: Disconnected from invalid user test3 54.38.52.18 port 48214 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.38.52.18
country_id: 798544
description:
Dec  1 15:51:24 host2 sshd[693442]: Disconnected from invalid user arkserver 54.38.52.18 port 54672 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 15:51:45 host2 sshd[693851]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 15:58:34 host2 sshd[701054]: Disconnected from invalid user sade 62.60.131.157 port 13326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 16:00:34 host2 sshd[703246]: Disconnected from invalid user sade 62.60.131.157 port 53382 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.133
country_id: 6252001
description:
Dec  1 16:01:30 host2 pure-ftpd[704118]: (?@66.132.153.133) [INFO] New connection from 66.132.153.133


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 16:02:28 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Xg/DfuFEKtkXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Dec  1 16:04:25 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.91, session=<brfqheFE4qk2rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-12-01 16:04:46 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:54895: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.162.25
country_id: 146669
description:
2025-12-01 16:04:51 dovecot_login authenticator failed for (ADMIN) [185.253.162.25]:59498: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Dec  1 16:04:36 host2 sshd[708012]: Disconnected from invalid user production 186.38.26.5 port 47046 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.42
country_id: 2542007
description:
2025-12-01 16:05:38 dovecot_login authenticator failed for (ADMIN) [95.181.232.42]:51229: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.38.26.5
country_id: 3865483
description:
Dec  1 16:06:19 host2 sshd[709996]: Disconnected from invalid user support 186.38.26.5 port 48416 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.167.153
country_id: 6252001
description:
2025-12-01 16:07:33 dovecot_login authenticator failed for ([127.0.0.1]) [70.174.167.153]:34749: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.181.46.30
country_id: 6252001
description:
2025-12-01 16:07:40 dovecot_login authenticator failed for ([127.0.0.1]) [98.181.46.30]:40749: 535 Incorrect authentication data (set_id=arts)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Dec  1 16:07:56 host2 sshd[712513]: Disconnected from invalid user testftp 186.38.26.5 port 49784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.38.26.5
country_id: 3865483
description:
Dec  1 16:09:32 host2 sshd[714423]: Disconnected from invalid user kingbase 186.38.26.5 port 51150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-01 16:11:54 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49941: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - yashih "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashih (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:16:27 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<iFX9sOFEqq8DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.15
country_id: 2186224
description:
2025-12-01 16:17:25 dovecot_login authenticator failed for ([121.73.162.15]) [121.73.162.15]:34810: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:17:09 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5il4s+FEBtUDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:17:37 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tVMeteFEos4DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-01 16:17:40 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:48299: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Dec  1 16:17:51 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.91, session=<2uryteFEqHdAPpze>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:19:03 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<77NCuuFEyq4DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:20:47 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<mSx1wOFEbJcDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:22:31 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vGWrxuFEgrQDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:23:17 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<BK5eyeFEOJcDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:23:56 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Ffm6y+FEcpIDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.11
country_id: 6252001
description:
2025-12-01 16:24:33 dovecot_login authenticator failed for (ADMIN) [95.181.238.11]:34862: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Dec  1 16:24:40 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<BMhczuFEVuEDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.24
country_id: 1819730
description:
Dec  1 16:25:11 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.142.154.24, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0mUu0OFE+BYtjpoY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-12-01 16:26:42 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:42988: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.154.175
country_id: 6252001
description:
Dec  1 16:32:54 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.154.175, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9o3O6+FExJUUQZqv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 16:34:08 host2 sshd[739300]: Disconnected from invalid user admin 2.57.121.112 port 9403 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Dec  1 16:37:52 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<yryO/eFEuIgDU5En>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.54
country_id: 2510769
description:
Dec  1 16:38:24 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=139.28.190.54, lip=66.85.158.91, TLS, session=<2Epv/uFE0tiLHL42>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - ceylondi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.22.88.3
country_id: 3469034
description:
Dec  1 16:38:44 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.22.88.3, lip=66.85.158.91, TLS, session=<5wyS/+FEI8ixFlgD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.108.174.24
country_id: 1269750
description:
2025-12-01 16:42:13 dovecot_login authenticator failed for (ADMIN) [103.108.174.24]:41020: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 16:47:21 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sobaherbal.com>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<FuhcH+JEeSNRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.98.41
country_id: 3469034
description:
2025-12-01 16:47:38 dovecot_login authenticator failed for (ADMIN) [146.70.98.41]:17216: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.84
country_id: 6252001
description:
Dec  1 16:48:36 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=135.237.126.84, lip=66.85.158.91, TLS, session=<e6ruI+JEKtiH7X5U>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-12-01 16:52:05 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:34719: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.235.173
country_id: 2750405
description:
Dec  1 16:51:47 host2 sshd[756321]: Disconnected from invalid user jrodrig 62.60.235.173 port 47296 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.206.14
country_id: 1269750
description:
2025-12-01 16:51:58 dovecot_login authenticator failed for ([203.129.206.14]) [203.129.206.14]:35752: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 16:54:04 host2 sshd[758915]: Disconnected from invalid user user 2.57.121.25 port 40842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.235.173
country_id: 2750405
description:
Dec  1 16:55:16 host2 sshd[760941]: Disconnected from invalid user devuser 62.60.235.173 port 47038 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.230.80.50
country_id: 3865483
description:
Dec  1 16:57:24 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=45.230.80.50, lip=66.85.158.91, TLS, session=<cbQ0QuJE4uot5lAy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.162
country_id: 2635167
description:
2025-12-01 16:56:51 dovecot_login authenticator failed for (ADMIN) [98.159.234.162]:42484: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.235.173
country_id: 2750405
description:
Dec  1 16:57:59 host2 sshd[763931]: Disconnected from invalid user ventas01 62.60.235.173 port 37004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.37
country_id: 933860
description:
Dec  1 16:57:48 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<amila>, method=PLAIN, rip=41.216.213.37, lip=66.85.158.91, TLS, session=<NaSfQ+JEKbgp2NUl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.235.173
country_id: 2750405
description:
Dec  1 16:59:25 host2 sshd[765362]: Disconnected from invalid user hamed 62.60.235.173 port 39326 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.235.173
country_id: 2750405
description:
Dec  1 17:00:52 host2 sshd[766854]: Disconnected from invalid user dspace 62.60.235.173 port 35262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.71
country_id: 298795
description:
2025-12-01 17:08:28 dovecot_login authenticator failed for (ADMIN) [188.213.34.71]:44216: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.153.132
country_id: 6252001
description:
2025-12-01 17:11:18 dovecot_login authenticator failed for (ADMIN) [158.173.153.132]:46393: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-12-01 17:18:16 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:59114: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-12-01 17:18:30 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:34784: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-01 17:20:58 +0530] info [cpaneld] 43.245.222.27 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.97.161.137
country_id: 3144096
description:
2025-12-01 17:24:17 dovecot_login authenticator failed for ([127.0.0.1]) [62.97.161.137]:51417: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2025-12-01 17:24:25 dovecot_login authenticator failed for ([127.0.0.1]) [128.185.253.122]:53200: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 17:26:03 host2 sshd[792213]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.107
country_id: 2921044
description:
2025-12-01 17:27:58 dovecot_login authenticator failed for (ADMIN) [191.101.157.107]:4286: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.231
country_id: 6252001
description:
2025-12-01 17:27:15 dovecot_login authenticator failed for (ADMIN) [102.129.235.231]:41352: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  1 17:28:13 host2 sshd[794315]: Disconnected from invalid user default 198.12.114.232 port 56452 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  1 17:30:40 host2 sshd[796918]: Disconnected from invalid user esuser 198.12.114.232 port 47668 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  1 17:31:53 host2 sshd[798257]: Disconnected from invalid user developer 198.12.114.232 port 54002 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.113.253
country_id: 2510769
description:
2025-12-01 17:31:55 dovecot_login authenticator failed for (253.pool90-160-113.dynamic.orange.es) [90.160.113.253]:51683: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-12-01 17:32:12 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:53830: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  1 17:33:03 host2 sshd[799335]: Disconnected from invalid user aaa 198.12.114.232 port 33288 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Dec  1 17:34:10 host2 sshd[800407]: Disconnected from invalid user tidb 198.12.114.232 port 52646 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.129.153.176
country_id: 6252001
description:
Dec  1 17:35:25 host2 pure-ftpd[801963]: (?@102.129.153.176) [INFO] New connection from 102.129.153.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.51
country_id: 390903
description:
2025-12-01 17:42:09 dovecot_login authenticator failed for (ADMIN) [79.127.181.51]:49828: 535 Incorrect authentication data (set_id=info@2s-travels.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.69
country_id: 798544
description:
Dec  1 17:43:31 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=46.227.39.69, lip=66.85.158.91, TLS, session=<iRRM5+JETbYu4ydF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.174.243
country_id: 1269750
description:
Dec  1 17:43:42 host2 sshd[810504]: Disconnected from invalid user nexus 64.227.174.243 port 47258 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.16
country_id: 3175395
description:
Dec  1 17:43:49 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.169.16, lip=66.85.158.91, TLS, session=<1uBx6OJE6eu5D6kQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-01 17:44:25 +0530] info [cpaneld] 43.245.222.27 - ceylondigest "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.129.153.176
country_id: 6252001
description:
Dec  1 17:46:08 host2 pure-ftpd[813962]: (?@102.129.153.176) [INFO] New connection from 102.129.153.176


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 102.129.153.176
country_id: 6252001
description:
Dec  1 17:46:09 host2 pure-ftpd[813977]: (?@102.129.153.176) [INFO] New connection from 102.129.153.176


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.174.243
country_id: 1269750
description:
Dec  1 17:46:19 host2 sshd[814150]: Disconnected from invalid user gpadmin 64.227.174.243 port 43986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.174.243
country_id: 1269750
description:
Dec  1 17:47:32 host2 sshd[815137]: Disconnected from invalid user radio 64.227.174.243 port 52768 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-12-01 17:48:29 dovecot_plain authenticator failed for (redefize) [102.53.15.18]:38874: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.52
country_id: 2629691
description:
2025-12-01 17:48:15 dovecot_login authenticator failed for (ADMIN) [45.133.193.52]:22901: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.217.231
country_id: 3469034
description:
Dec  1 17:49:35 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=177.87.217.231, lip=66.85.158.91, TLS, session=<+nf0/OJE7dixV9nn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 17:49:44 host2 sshd[817407]: Disconnected from invalid user alexandro 62.60.131.157 port 45614 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.7
country_id: 1269750
description:
Dec  1 17:50:06 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.51.223.7, lip=66.85.158.91, TLS, session=<ugXE/uJE/9ZnM98H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.88.160.82
country_id: 6252001
description:
Dec  1 17:49:32 host2 sshd[817261]: Disconnected from invalid user ubuntu 166.88.160.82 port 32926 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.88.160.82
country_id: 6252001
description:
Dec  1 17:50:44 host2 sshd[818445]: Disconnected from invalid user ts3 166.88.160.82 port 35842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.88.160.82
country_id: 6252001
description:
Dec  1 17:53:04 host2 sshd[820935]: Disconnected from invalid user lch 166.88.160.82 port 39876 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 17:54:21 host2 sshd[822317]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 18:01:27 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<mXpPKONEDtxRvaKO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Dec  1 18:02:13 host2 sshd[831773]: Disconnected from invalid user local 202.184.134.84 port 58702 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.52
country_id: 6252001
description:
Dec  1 18:05:49 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.52, lip=66.85.158.92, TLS: Connection closed, session=<bZ0cOONETOqnXpI0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-12-01 18:07:00 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:63691: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-01 18:07:26 dovecot_login authenticator failed for ([27.123.104.142]) [27.123.104.142]:53000: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.8
country_id: 2750405
description:
Dec  1 18:09:03 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=31.14.32.8, lip=66.85.158.91, TLS: Connection closed, session=<ns6mQ+NEL8cfDiAI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.8
country_id: 2750405
description:
Dec  1 18:09:21 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=31.14.32.8, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<T3i+RONEaoQfDiAI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.184.134.84
country_id: 1733045
description:
Dec  1 18:09:47 host2 sshd[840618]: Disconnected from invalid user usuario 202.184.134.84 port 33136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.57
country_id: 2658434
description:
2025-12-01 18:11:36 dovecot_login authenticator failed for (ADMIN) [158.173.152.57]:30696: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.184.134.84
country_id: 1733045
description:
Dec  1 18:12:18 host2 sshd[842958]: Disconnected from invalid user ubuntu 202.184.134.84 port 36598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 18:14:32 host2 sshd[845199]: Disconnected from invalid user user 2.57.121.25 port 24787 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.2
country_id: 1269750
description:
2025-12-01 18:30:03 dovecot_login authenticator failed for ([125.19.156.2]) [125.19.156.2]:52594: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-12-01 18:30:47 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:56949: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.27.43
country_id: 2802361
description:
2025-12-01 18:31:12 dovecot_login authenticator failed for (ADMIN) [154.47.27.43]:37112: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.136
country_id: 6252001
description:
Dec  1 18:34:22 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.136, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<B5E1nuNEhm1ChJmI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-12-01 18:38:49 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:39098: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-12-01 18:43:01 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:5881: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-12-01 18:43:22 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:44320: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.137.240
country_id: 690791
description:
Dec  1 18:46:02 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=91.234.137.240, lip=66.85.158.91, TLS, session=<EHrcxuNEzZRb6onw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.237
country_id: 3469034
description:
Dec  1 18:46:23 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.53.107.237, lip=66.85.158.91, TLS, session=<tlcKyONEGpy/NWvt>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.185.98.251
country_id: 6252001
description:
2025-12-01 18:47:34 dovecot_login authenticator failed for 47-185-98-251.fdr03.kllr.tx.ip.frontiernet.net [47.185.98.251]:52691: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-12-01 18:47:51 dovecot_login authenticator failed for ([182.95.115.70]) [182.95.115.70]:59596: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 18:48:11 host2 sshd[879166]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-12-01 18:52:10 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:34880: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-12-01 18:52:17 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:35806: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec  1 18:52:53 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.91, TLS handshaking: Connection closed, session=<54dk4ONEwo258uIh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.45
country_id: 1880251
description:
2025-12-01 18:53:59 dovecot_login authenticator failed for (ADMIN) [156.146.57.45]:25760: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-12-01 18:54:25 dovecot_plain authenticator failed for (allamy) [92.62.243.174]:59678: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.33
country_id: 6252001
description:
Dec  1 18:59:26 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=185.242.226.33, lip=66.85.158.92, TLS handshaking: Connection closed, session=<e6PY9+NE0sG58uIh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 38.105.25.194
country_id: 6252001
description:
Dec  1 19:02:21 host2 sshd[890468]: Disconnected from invalid user mailuser 38.105.25.194 port 45932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Dec  1 19:03:33 host2 sshd[891748]: Disconnected from invalid user ts1 38.105.25.194 port 54598 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Dec  1 19:05:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<n5IUDORE9K+SOC+J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.105.25.194
country_id: 6252001
description:
Dec  1 19:06:58 host2 sshd[894235]: Disconnected from invalid user pzuser 38.105.25.194 port 38468 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec  1 19:10:07 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.80, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qP0JHuREBolAPpxQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Dec  1 19:10:02 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<KEG8HeREPM5BMQFQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.80
country_id: 6252001
description:
Dec  1 19:10:27 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.80, lip=66.85.158.92, TLS handshaking: Connection closed, session=<a8c4H+REIvBAPpxQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.80
country_id: 6252001
description:
Dec  1 19:10:22 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.80, lip=66.85.158.91, TLS handshaking: Connection closed, session=<nSjqHuREhKxBMQFQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-12-01 19:11:48 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:60120: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-12-01 19:11:08 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:39728: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.240.34
country_id: 2186224
description:
2025-12-01 19:14:24 dovecot_login authenticator failed for (ADMIN) [179.61.240.34]:51337: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-01 19:16:10 +0530] info [cpaneld] 43.245.222.27 - ceyl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.131.131.43
country_id: 1269750
description:
Dec  1 19:16:49 host2 sshd[901785]: Disconnected from invalid user ubuntu 34.131.131.43 port 58134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.131.131.43
country_id: 1269750
description:
Dec  1 19:20:41 host2 sshd[904780]: Disconnected from invalid user lch 34.131.131.43 port 53056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 19:26:16 host2 sshd[908980]: Disconnected from invalid user  2.57.121.112 port 63622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-01 19:27:17 dovecot_plain authenticator failed for (stalaps) [12.150.243.22]:41647: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 19:29:35 host2 sshd[911333]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.236.199.102
country_id: 6252001
description:
2025-12-01 19:29:52 dovecot_plain authenticator failed for ec2-54-236-199-102.compute-1.amazonaws.com (EC2AMAZ-SNCQLK3.ec2.internal) [54.236.199.102]:57395: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 19:31:14 host2 sshd[914626]: Disconnected from invalid user user 2.57.121.25 port 16945 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.2
country_id: 3175395
description:
2025-12-01 19:32:52 dovecot_login authenticator failed for (ADMIN) [156.146.41.2]:60170: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  1 19:36:05 host2 sshd[926133]: User agentallianz from 62.60.135.104 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  1 19:39:50 host2 sshd[928425]: Disconnected from invalid user dario 62.60.131.157 port 48983 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  1 19:45:02 host2 sshd[932715]: User agentallianz from 62.60.135.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.180.35
country_id: 99237
description:
Dec  1 19:49:00 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@jrdc.lk>, method=PLAIN, rip=65.20.180.35, lip=66.85.158.91, TLS, session=<jPoKqOREGqtBFLQj>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.33.70
country_id: 3865483
description:
Dec  1 19:49:22 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=45.227.33.70, lip=66.85.158.91, TLS, session=<jzU8qeREG9wt4yFG>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  1 19:49:56 host2 sshd[935567]: User agentallianz from 62.60.135.108 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.236.199.102
country_id: 6252001
description:
2025-12-01 19:51:02 dovecot_plain authenticator failed for ec2-54-236-199-102.compute-1.amazonaws.com (EC2AMAZ-SNCQLK3.ec2.internal) [54.236.199.102]:61241: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.236.199.102
country_id: 6252001
description:
2025-12-01 19:51:08 dovecot_login authenticator failed for ec2-54-236-199-102.compute-1.amazonaws.com (EC2AMAZ-SNCQLK3.ec2.internal) [54.236.199.102]:61241: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.155
country_id: 2782113
description:
2025-12-01 19:53:47 dovecot_login authenticator failed for (ADMIN) [156.146.60.155]:34134: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.159
country_id: 3865483
description:
Dec  1 19:55:43 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=45.238.106.159, lip=66.85.158.91, TLS, session=<aqjrv+REhuwt7mqf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.212
country_id: 2510769
description:
Dec  1 19:55:20 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@systemtec.lk>, method=PLAIN, rip=139.28.190.212, lip=66.85.158.91, TLS, session=<5a++vuRE96WLHL7U>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 19:57:54 host2 sshd[941443]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  1 19:58:07 host2 sshd[941714]: User agentallianz from 62.60.135.107 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec  1 19:57:30 host2 sshd[941180]: Disconnected from invalid user syncuser 102.210.149.121 port 53802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.45.194
country_id: 6252001
description:
Dec  1 19:59:57 host2 sshd[942701]: Disconnected from invalid user ubuntu 172.245.45.194 port 49442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec  1 20:00:08 host2 sshd[942970]: Disconnected from invalid user dixi 102.210.149.121 port 39710 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 142.93.116.178
country_id: 6252001
description:
Dec  1 20:01:37 host2 sshd[943807]: User agentallianz from 142.93.116.178 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.45.194
country_id: 6252001
description:
Dec  1 20:03:16 host2 sshd[945308]: Disconnected from invalid user valheim 172.245.45.194 port 49720 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.210.149.121
country_id: 953987
description:
Dec  1 20:03:11 host2 sshd[945148]: Disconnected from invalid user hu 102.210.149.121 port 44998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec  1 20:04:44 host2 sshd[946057]: Disconnected from invalid user soporte 102.210.149.121 port 47638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.236.199.102
country_id: 6252001
description:
2025-12-01 20:05:23 dovecot_plain authenticator failed for ec2-54-236-199-102.compute-1.amazonaws.com (EC2AMAZ-SNCQLK3.ec2.internal) [54.236.199.102]:55890: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-01 20:05:49 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:60619: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.45.194
country_id: 6252001
description:
Dec  1 20:06:42 host2 sshd[947269]: Disconnected from invalid user desliga 172.245.45.194 port 50008 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.45.194
country_id: 6252001
description:
Dec  1 20:07:46 host2 sshd[947791]: Disconnected from invalid user qwerty 172.245.45.194 port 50100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.236.199.102
country_id: 6252001
description:
2025-12-01 20:08:12 dovecot_login authenticator failed for ec2-54-236-199-102.compute-1.amazonaws.com (EC2AMAZ-SNCQLK3.ec2.internal) [54.236.199.102]:55890: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.210.149.121
country_id: 953987
description:
Dec  1 20:09:17 host2 sshd[948891]: Disconnected from invalid user tecnopos 102.210.149.121 port 55572 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-01 20:12:27 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (obilene) [87.103.126.54]:13666: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.74.183
country_id: 6252001
description:
2025-12-01 20:12:31 dovecot_plain authenticator failed for c-98-192-74-183.hsd1.ga.comcast.net (hypers) [98.192.74.183]:50450: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.170
country_id: 3041565
description:
2025-12-01 20:14:09 dovecot_login authenticator failed for (ADMIN) [173.239.217.170]:54992: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.185
country_id: 6252001
description:
Dec  1 20:16:58 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.185, lip=66.85.158.91, TLS handshaking: Connection closed, session=<JPQXDeVEs0tAPsW5>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.82.93.75
country_id: 1643084
description:
Dec  1 20:16:33 host2 sshd[953786]: User agentallianz from 103.82.93.75 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.182
country_id: 6252001
description:
Dec  1 20:17:16 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3+woDuVEzGtAPsW2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.70.45.179
country_id: 1269750
description:
2025-12-01 20:18:15 dovecot_plain authenticator failed for (6MB1PQ8V7O8RZW8) [103.70.45.179]:52416: 535 Incorrect authentication data (set_id=arts@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-12-01 20:18:19 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (untogrago) [68.46.148.180]:33952: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.60.230.139
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 75.60.230.139 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.169
country_id: 1269750
description:
2025-12-01 20:23:14 dovecot_plain authenticator failed for (JKJEX) [49.37.32.169]:56932: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-12-01 20:24:23 dovecot_plain authenticator failed for (ulvarthing) [64.72.74.162]:34922: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec  1 20:24:39 host2 sshd[958692]: Disconnected from invalid user system 190.111.211.81 port 41412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.241.45.120
country_id: 1269750
description:
Dec  1 20:26:14 host2 sshd[959864]: Disconnected from invalid user free 103.241.45.120 port 34696 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  1 20:26:22 host2 sshd[959949]: User agentallianz from 162.0.224.38 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 212.19.117.204
country_id: 3175395
description:
Dec  1 20:27:41 host2 sshd[960858]: Disconnected from invalid user bob 212.19.117.204 port 47941 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.19.117.204
country_id: 3175395
description:
Dec  1 20:28:43 host2 sshd[961561]: Disconnected from invalid user radio 212.19.117.204 port 33114 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec  1 20:29:47 host2 sshd[962231]: Disconnected from invalid user qiyuesuo 190.111.211.81 port 45368 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.19.117.204
country_id: 3175395
description:
Dec  1 20:29:47 host2 sshd[962242]: Disconnected from invalid user free 212.19.117.204 port 46524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Dec  1 20:29:58 host2 sshd[962373]: Disconnected from invalid user usuario1 138.68.104.233 port 39918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.241.45.120
country_id: 1269750
description:
Dec  1 20:30:29 host2 sshd[962914]: Disconnected from invalid user username 103.241.45.120 port 49322 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  1 20:30:33 host2 sshd[962992]: User agentallianz from 62.60.135.104 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Dec  1 20:31:11 host2 sshd[963262]: Disconnected from invalid user john 190.111.211.81 port 42386 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.111.211.81
country_id: 3865483
description:
Dec  1 20:32:32 host2 sshd[963893]: Disconnected from invalid user user1 190.111.211.81 port 42414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Dec  1 20:32:54 host2 sshd[964080]: Disconnected from invalid user nominatim 138.68.104.233 port 42704 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.175.128.41
country_id: 617790
description:
2025-12-01 20:34:53 dovecot_login authenticator failed for (ADMIN) [178.175.128.41]:7797: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.241.45.120
country_id: 1269750
description:
Dec  1 20:35:02 host2 sshd[965213]: Disconnected from invalid user kapsch 103.241.45.120 port 48982 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-12-01 20:36:07 dovecot_login authenticator failed for ([61.95.198.138]) [61.95.198.138]:44576: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.148.10.116
country_id: 1210997
description:
2025-12-01 20:36:29 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.116]:49972: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.94
country_id: 6252001
description:
Dec  1 20:36:44 host2 pure-ftpd[966736]: (?@147.185.132.94) [INFO] New connection from 147.185.132.94


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 138.68.104.233
country_id: 2921044
description:
Dec  1 20:37:19 host2 sshd[967009]: Disconnected from invalid user liyang 138.68.104.233 port 38846 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 69.62.65.113
country_id: 597427
description:
Dec  1 20:37:26 host2 sshd[967099]: User agentallianz from 69.62.65.113 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 138.68.104.233
country_id: 2921044
description:
Dec  1 20:38:25 host2 sshd[967653]: Disconnected from invalid user rstudio 138.68.104.233 port 45192 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  1 20:38:48 host2 sshd[967834]: User agentallianz from 62.60.135.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.241.45.120
country_id: 1269750
description:
Dec  1 20:38:11 host2 sshd[967518]: Disconnected from invalid user admin1 103.241.45.120 port 35282 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Dec  1 20:40:49 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<lsxuYuVEsKsv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.219.168.69
country_id: 1880251
description:
Dec  1 20:40:19 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=8.219.168.69, lip=66.85.158.91, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<R3CeYOVEwG8I26hF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Dec  1 20:41:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<A+iHY+VEuOUv+zWT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-12-01 20:43:42 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:51797: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  1 20:44:19 host2 sshd[971204]: User agentallianz from 62.60.135.108 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-01 20:45:03 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (saulate) [71.230.228.16]:53224: 535 Incorrect authentication data (set_id=administrator@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.81.157.110
country_id: 3865483
description:
Dec  1 20:45:10 host2 sshd[971852]: Disconnected from invalid user david 191.81.157.110 port 41535 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.195.99
country_id: 3865483
description:
Dec  1 20:47:50 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=181.225.195.99, lip=66.85.158.91, TLS, session=<UvtzeuVEi+G14cNj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec  1 20:49:05 host2 sshd[974382]: Disconnected from invalid user zmarin 213.6.203.226 port 57040 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.247.239
country_id: 3469034
description:
Dec  1 20:48:11 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.92.247.239, lip=66.85.158.91, TLS, session=<vRmie+VEUYexXPfv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 20:49:10 host2 sshd[974405]: Disconnected from invalid user user 2.57.121.25 port 53574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.88.2.70
country_id: 1694008
description:
Dec  1 20:49:29 host2 sshd[974550]: Disconnected from invalid user admin1 154.88.2.70 port 36474 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Dec  1 20:50:24 host2 sshd[975152]: Disconnected from invalid user exx 213.6.203.226 port 33716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 20:50:51 host2 sshd[975329]: Disconnected from invalid user user 2.57.121.25 port 46331 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec  1 20:51:32 host2 sshd[975802]: Disconnected from invalid user dolphinscheduler 213.6.203.226 port 41183 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  1 20:52:31 host2 sshd[976728]: User agentallianz from 62.60.135.107 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Dec  1 20:52:39 host2 sshd[976780]: Disconnected from invalid user builder 213.6.203.226 port 56290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-12-01 20:53:28 dovecot_plain authenticator failed for (roanal) [65.20.133.4]:54214: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.88.2.70
country_id: 1694008
description:
Dec  1 20:54:02 host2 sshd[977986]: Disconnected from invalid user kiosk 154.88.2.70 port 44218 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.90.198
country_id: 2802361
description:
2025-12-01 20:54:37 dovecot_login authenticator failed for (ADMIN) [149.22.90.198]:31990: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.88.2.70
country_id: 1694008
description:
Dec  1 20:55:40 host2 sshd[979680]: Disconnected from invalid user admin1 154.88.2.70 port 46806 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  1 21:03:00 host2 sshd[983767]: User agentallianz from 43.164.1.102 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-12-01 21:02:42 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (suggly) [174.169.224.27]:45042: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.179
country_id: 6252001
description:
Dec  1 21:06:25 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.179, lip=66.85.158.91, session=<2z3wveVEzVFBMQGz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.172
country_id: 6252001
description:
Dec  1 21:06:35 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.172, lip=66.85.158.91, TLS: Connection closed, session=<eSWQvuVEtLVBMQGs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec  1 21:15:43 host2 sshd[994214]: Disconnected from invalid user server 193.123.68.117 port 27024 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Dec  1 21:18:21 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, session=<WQ6e6OVE0P8t4/6c>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-12-01 21:19:19 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:51382: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.123.68.117
country_id: 290557
description:
Dec  1 21:19:29 host2 sshd[997094]: Disconnected from invalid user ubuntu 193.123.68.117 port 12049 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 45.77.227.57
country_id: 2635167
description:
Dec  1 21:20:07 host2 sshd[997633]: User agentallianz from 45.77.227.57 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Dec  1 21:20:38 host2 sshd[998008]: Disconnected from invalid user minecraft 103.210.22.17 port 48568 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 193.123.68.117
country_id: 290557
description:
Dec  1 21:20:44 host2 sshd[998070]: Disconnected from invalid user cinema 193.123.68.117 port 10871 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.157.16.105
country_id: 1227603
description:
Dec  1 21:21:27 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=445) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=175.157.16.105, lip=66.85.158.91, TLS: read(size=445) failed: Connection reset by peer, session=<YuS28+VEKfavnRBp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.210.22.17
country_id: 1880251
description:
Dec  1 21:22:05 host2 sshd[999014]: Disconnected from invalid user hamed 103.210.22.17 port 58846 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  1 21:23:13 host2 sshd[999779]: User agentallianz from 162.0.224.38 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  1 21:23:53 host2 sshd[1000172]: User agentallianz from 62.60.135.104 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.12
country_id: 6252001
description:
Dec  1 21:24:59 host2 pure-ftpd[1001380]: (?@147.185.132.12) [INFO] New connection from 147.185.132.12


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.210.22.17
country_id: 1880251
description:
Dec  1 21:26:13 host2 sshd[1002330]: Disconnected from invalid user qwerty 103.210.22.17 port 43874 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.74.195
country_id: 2661886
description:
2025-12-01 21:31:33 dovecot_plain authenticator failed for 217-215-74-195-no2620.tbcn.telia.com (dunres) [217.215.74.195]:51405: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.105
country_id: 130758
description:
Dec  1 21:31:41 host2 sshd[1004926]: User agentallianz from 62.60.135.105 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.127
country_id: 6252001
description:
Dec  1 21:32:24 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.132.127, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<6breGuZE4uGTuYR/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.153.101
country_id: 6251999
description:
2025-12-01 21:33:40 dovecot_login authenticator failed for (ADMIN) [181.214.153.101]:40445: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.227.90.185
country_id: 6252001
description:
Dec  1 21:34:13 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=64.227.90.185, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<lTxdIeZEVstA41q5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.127
country_id: 6252001
description:
Dec  1 21:34:22 host2 dovecot[3366265]: pop3-login: Disconnected: Inactivity (no auth attempts in 180 secs): user=<>, rip=147.185.132.127, lip=66.85.158.91, TLS handshaking, session=<ijjmIeZEZNaTuYR/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.127
country_id: 6252001
description:
Dec  1 21:37:38 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.127, lip=66.85.158.91, TLS, session=<GQigLeZE4OmTuYR/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 21:37:38 host2 sshd[1008815]: Disconnected from invalid user admin 2.57.121.112 port 53277 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.179
country_id: 6252001
description:
Dec  1 21:41:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=162.216.150.179, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<A4UjOuZEwt6i2Jaz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.179
country_id: 6252001
description:
Dec  1 21:42:09 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=162.216.150.179, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<wVe9PeZEDvqi2Jaz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-12-01 21:44:02 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (previass) [71.230.228.16]:35608: 535 Incorrect authentication data (set_id=api@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  1 21:45:40 host2 sshd[1063708]: User agentallianz from 62.60.135.107 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.163.38.190
country_id: 3077311
description:
Dec  1 21:46:52 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@jrdc.lk>, method=PLAIN, rip=85.163.38.190, lip=66.85.158.91, TLS, session=<fOmoTeZEUOxVoya+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.168.9.94
country_id: 3996063
description:
Dec  1 21:47:11 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=201.168.9.94, lip=66.85.158.91, TLS, session=<7t25TuZEaunJqAle>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.179
country_id: 6252001
description:
Dec  1 21:48:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.179, lip=66.85.158.92, TLS, session=<gCwtU+ZEnuKi2Jaz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 21:49:49 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<pYoJWeZEPJAXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2025-12-01 21:50:15 dovecot_plain authenticator failed for c-76-16-7-82.hsd1.il.comcast.net (prepuncy) [76.16.7.82]:54244: 535 Incorrect authentication data (set_id=alert@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.48
country_id: 3042225
description:
2025-12-01 21:51:25 dovecot_login authenticator failed for (ADMIN) [91.90.124.48]:48735: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.87.74
country_id: 226074
description:
Dec  1 21:53:05 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@systemtec.lk>, method=PLAIN, rip=196.0.87.74, lip=66.85.158.91, TLS, session=<HI+kY+ZEI9LEAFdK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.234.135.219
country_id: 6290252
description:
Dec  1 21:53:22 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.234.135.219, lip=66.85.158.91, TLS, session=<mYnqZOZEHoVb6ofb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.134.231
country_id: 1819730
description:
Dec  1 21:53:36 host2 sshd[1070708]: Disconnected from invalid user deamon 152.32.134.231 port 39294 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.28
country_id: 130758
description:
Dec  1 21:55:42 host2 sshd[1082818]: User agentallianz from 62.60.135.28 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.134.231
country_id: 1819730
description:
Dec  1 21:56:25 host2 sshd[1084510]: Disconnected from invalid user server 152.32.134.231 port 36692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.134.231
country_id: 1819730
description:
Dec  1 21:57:43 host2 sshd[1085548]: Disconnected from invalid user postgres 152.32.134.231 port 47772 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 22:01:02 host2 sshd[1088100]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-01 22:05:44 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (bulars) [87.103.126.54]:57682: 535 Incorrect authentication data (set_id=backup@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 22:06:45 host2 sshd[1093400]: Disconnected from invalid user user 2.57.121.25 port 25804 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 22:08:56 host2 sshd[1095034]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.194.82
country_id: 2077456
description:
2025-12-01 22:11:31 dovecot_login authenticator failed for (ADMIN) [173.239.194.82]:47918: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.228.248.80
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 140.228.248.80 - lezzarotechcom "GET /login/?login_only=1&user=lezzarotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.199.15.207
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.199.15.207 - lezzarote "GET /login/?login_only=1&user=lezzarote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.90.7.32
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.90.7.32 - lezzar "GET /login/?login_only=1&user=lezzar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.167.157.63
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.167.157.63 - lezz "GET /login/?login_only=1&user=lezz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.118.181.0
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.118.181.0 - lezza "GET /login/?login_only=1&user=lezza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezza (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.20.99.21
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 76.20.99.21 - lezzarotech "GET /login/?login_only=1&user=lezzarotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.140.221.62
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 24.140.221.62 - lezzaro1 "GET /login/?login_only=1&user=lezzaro1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.48.90.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.48.90.53 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.188.152.219
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 67.188.152.219 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-12-01 22:13:05 dovecot_plain authenticator failed for (pompra) [12.150.243.22]:3106: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.71.42.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 97.71.42.181 - lez "GET /login/?login_only=1&user=lez&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lez (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.52.94.165
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 66.52.94.165 - lezzaro2 "GET /login/?login_only=1&user=lezzaro2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro2 (has_cpuser_file failed)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 45.77.227.57
country_id: 2635167
description:
Dec  1 22:12:42 host2 sshd[1097795]: User agentallianz from 45.77.227.57 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.18.49.199
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.18.49.199 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.102.187.53
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 199.102.187.53 - lezzarot "GET /login/?login_only=1&user=lezzarot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.131.150.20
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 73.131.150.20 - lezzaro "GET /login/?login_only=1&user=lezzaro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 32.223.248.69
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 32.223.248.69 - lezzarotec "GET /login/?login_only=1&user=lezzarotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotec (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.88.147.82
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 75.88.147.82 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Dec  1 22:18:59 host2 sshd[1102092]: Disconnected from invalid user zjw 185.202.207.17 port 49942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-12-01 22:20:09 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:40614: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Dec  1 22:20:51 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.114, lip=66.85.158.92, TLS: Connection closed, session=<YWclyOZE8PhChJly>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Dec  1 22:21:21 host2 sshd[1104162]: Disconnected from invalid user dmdba 185.202.207.17 port 56044 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2025-12-01 22:22:07 dovecot_plain authenticator failed for (shnes) [192.81.229.181]:58506: 535 Incorrect authentication data (set_id=hostmaster@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.202.207.17
country_id: 2510769
description:
Dec  1 22:22:38 host2 sshd[1105111]: Disconnected from invalid user astra 185.202.207.17 port 53332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Dec  1 22:25:07 host2 sshd[1107290]: Disconnected from invalid user ubuntu 185.202.207.17 port 37574 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.82.93.75
country_id: 1643084
description:
Dec  1 22:25:13 host2 sshd[1107508]: User agentallianz from 103.82.93.75 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.57.49
country_id: 6252001
description:
Dec  1 22:26:07 host2 sshd[1108302]: Disconnected from invalid user dbadmin 107.172.57.49 port 44730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.57.49
country_id: 6252001
description:
Dec  1 22:27:08 host2 sshd[1109228]: Disconnected from invalid user pdx 107.172.57.49 port 45216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.57.49
country_id: 6252001
description:
Dec  1 22:28:09 host2 sshd[1110075]: Disconnected from invalid user nextcloud 107.172.57.49 port 58736 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Dec  1 22:28:34 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.92, session=<Qru84+ZEgKtBMRRC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 22:29:45 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<H+3S5+ZEkrIXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.204
country_id: 3077311
description:
2025-12-01 22:31:08 dovecot_login authenticator failed for (ADMIN) [212.102.39.204]:59942: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.233.195.143
country_id: 6252001
description:
Dec  1 22:32:46 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.233.195.143, lip=66.85.158.92, session=<w9vE8uZEsJqs6cOP>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.233.195.143
country_id: 6252001
description:
Dec  1 22:32:46 host2 pure-ftpd[1114287]: (?@172.233.195.143) [INFO] New connection from 172.233.195.143


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  1 22:37:03 host2 sshd[1118137]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.113.83
country_id: 3469034
description:
2025-12-01 22:36:13 dovecot_plain authenticator failed for 189.115.113.83.dynamic.adsl.gvt.net.br ([89.116.164.85]) [189.115.113.83]:52948: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.230
country_id: 298795
description:
Dec  1 22:38:45 host2 sshd[1119156]: Disconnected from invalid user vpnuser 45.94.4.230 port 38586 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.139.70
country_id: 6252001
description:
Dec  1 22:42:19 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.139.70, lip=66.85.158.92, TLS handshaking: Connection closed, session=<mIzwFOdE1Hy4aYtG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-12-01 22:42:31 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (lesic) [81.225.30.107]:50670: 535 Incorrect authentication data (set_id=help@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.145
country_id: 3469034
description:
Dec  1 22:43:08 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=177.44.71.145, lip=66.85.158.91, TLS, session=<hBbPFudEPJixLEeR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec  1 22:43:13 host2 sshd[1122570]: Disconnected from invalid user dolphinscheduler 102.176.81.29 port 42692 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.198.36
country_id: 3865483
description:
Dec  1 22:43:37 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<info>, method=PLAIN, rip=181.225.198.36, lip=66.85.158.91, TLS, session=<bxsBGOdEebK14cYk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec  1 22:44:39 host2 sshd[1123789]: Disconnected from invalid user steam 102.176.81.29 port 45160 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.94.4.230
country_id: 298795
description:
Dec  1 22:44:20 host2 sshd[1123482]: Disconnected from invalid user postgres 45.94.4.230 port 40992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.230
country_id: 298795
description:
Dec  1 22:45:57 host2 sshd[1125352]: Disconnected from invalid user user 45.94.4.230 port 37800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec  1 22:47:15 host2 sshd[1126199]: Disconnected from invalid user casaos 102.176.81.29 port 49642 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.213.81
country_id: 3017382
description:
2025-12-01 22:49:02 dovecot_login authenticator failed for vps-6c8bd293.vps.ovh.net ([127.0.0.1]) [51.77.213.81]:57524: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.176.81.29
country_id: 2300660
description:
Dec  1 22:48:31 host2 sshd[1126909]: Disconnected from invalid user tibero 102.176.81.29 port 51914 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.230
country_id: 298795
description:
Dec  1 22:48:56 host2 sshd[1127114]: Disconnected from invalid user seafile 45.94.4.230 port 44786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.176.81.29
country_id: 2300660
description:
Dec  1 22:49:49 host2 sshd[1127759]: Disconnected from invalid user webuser 102.176.81.29 port 54136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-01 22:49:11 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.226.118]:40348: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  1 22:49:12 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<VbRxLedEnLtRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-12-01 22:50:20 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (prify) [87.103.126.54]:30507: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  1 22:52:44 host2 sshd[1130372]: Disconnected from invalid user admin 2.57.121.112 port 57787 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - yashiholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Dec  1 22:55:10 host2 sshd[1133373]: Disconnected from invalid user marvin 68.183.93.67 port 43356 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.165.130.233
country_id: 6252001
description:
2025-12-01 22:55:46 dovecot_plain authenticator failed for ([89.116.164.85]) [24.165.130.233]:34320: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.141
country_id: 6252001
description:
Dec  1 22:56:03 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.141, lip=66.85.158.92, session=</oMJRudE7YRBMQGN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec  1 22:56:03 host2 sshd[1134302]: Disconnected from invalid user user2 152.32.238.146 port 35920 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.132
country_id: 6252001
description:
Dec  1 22:56:15 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.132, lip=66.85.158.92, TLS: Connection closed, session=<0gfIRudEBJdBMQGE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Dec  1 22:57:51 host2 sshd[1136054]: Disconnected from invalid user ubuntu 68.183.93.67 port 45826 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec  1 22:58:04 host2 sshd[1136269]: Disconnected from invalid user roots 152.32.238.146 port 40156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.238.146
country_id: 6252001
description:
Dec  1 22:59:08 host2 sshd[1136992]: Disconnected from invalid user rahul 152.32.238.146 port 43132 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.238.146
country_id: 6252001
description:
Dec  1 23:01:09 host2 sshd[1138535]: Disconnected from invalid user backend 152.32.238.146 port 34516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Dec  1 23:01:56 host2 sshd[1139112]: Disconnected from invalid user autcom 68.183.93.67 port 38806 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.93.67
country_id: 1269750
description:
Dec  1 23:04:35 host2 sshd[1141035]: Disconnected from invalid user exx 68.183.93.67 port 51888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.106.164.74
country_id: 1733045
description:
Dec  1 23:04:10 host2 sshd[1140846]: Disconnected from invalid user ubuntu 203.106.164.74 port 53922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  1 23:05:25 host2 sshd[1141695]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 58569


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-12-01 23:05:29 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:45025: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.2.158.207
country_id: 3608932
description:
2025-12-01 23:05:33 dovecot_plain authenticator failed for (398XN2FAL8) [186.2.158.207]:12300: 535 Incorrect authentication data (set_id=com587hr@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 45.77.227.57
country_id: 2635167
description:
Dec  1 23:05:47 host2 sshd[1142042]: User agentallianz from 45.77.227.57 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.0.144
country_id: 2077456
description:
2025-12-01 23:05:54 dovecot_login authenticator failed for 121-44-0-144.tpgi.com.au [121.44.0.144]:39352: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-12-01 23:07:18 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net (c-73-128-151-92.hsd1.de.comcast.net) [98.161.232.9]:58072: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.64
country_id: 1733045
description:
2025-12-01 23:07:51 dovecot_login authenticator failed for ([49.124.152.172]) [49.125.201.64]:34386: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  1 23:09:10 host2 sshd[1144455]: User agentallianz from 43.164.1.102 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.112.140
country_id: 1210997
description:
2025-12-01 23:10:49 dovecot_login authenticator failed for (ADMIN) [64.64.112.140]:31458: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.106.164.74
country_id: 1733045
description:
Dec  1 23:11:37 host2 sshd[1146284]: Disconnected from invalid user localhost 203.106.164.74 port 60480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.106.164.74
country_id: 1733045
description:
Dec  1 23:13:30 host2 sshd[1148147]: Disconnected from invalid user alma 203.106.164.74 port 33888 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.238
country_id: 1269750
description:
Dec  1 23:17:50 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=103.70.126.238, lip=66.85.158.91, TLS, session=<j5ewkudE9bZnRn7u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.10.18
country_id: 226074
description:
Dec  1 23:18:11 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=196.0.10.18, lip=66.85.158.91, TLS, session=<1OAZlOdENsbEAAoS>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-01 23:18:21 +0530] info [cpaneld] 43.245.222.27 - ceylondigest "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.127
country_id: 6252001
description:
Dec  1 23:20:14 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.64.105.127, lip=66.85.158.91, session=<KA2AnOdEhq8UQGl/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.80.88.209
country_id: 6252001
description:
Dec  1 23:20:46 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.80.88.209, lip=66.85.158.91, session=<w4tynudETJoUUFjR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  1 23:25:17 host2 sshd[1155369]: Disconnected from invalid user user 2.57.121.25 port 30173 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.133.47.13
country_id: 1522867
description:
2025-12-01 23:32:45 dovecot_login authenticator failed for (ADMIN) [62.133.47.13]:31822: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.1.201.32
country_id: 2464461
description:
2025-12-01 23:32:56 dovecot_plain authenticator failed for (PMAJ2FF461FCD) [197.1.201.32]:59741: 535 Incorrect authentication data (set_id=com587hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.80
country_id: 6252001
description:
Dec  1 23:35:17 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.80, lip=66.85.158.92, session=<yzVf0udEdooUQcJQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.250
country_id: 798544
description:
Dec  1 23:37:47 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=178.216.29.250, lip=66.85.158.91, TLS, session=<xhU/2udEJ6my2B36>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.26
country_id: 1269750
description:
Dec  1 23:37:28 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@systemtec.lk>, method=PLAIN, rip=45.118.34.26, lip=66.85.158.91, TLS, session=<axMY2edEiuctdiIa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.163.73
country_id: 6252001
description:
Dec  1 23:39:43 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.15.163.73, lip=66.85.158.92, session=<aic54udEyuAUD6NJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  1 23:42:08 host2 sshd[1165675]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 65450


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.222.93.199
country_id: 6252001
description:
2025-12-01 23:45:44 dovecot_plain authenticator failed for c-98-222-93-199.hsd1.il.comcast.net (hyper) [98.222.93.199]:40046: 535 Incorrect authentication data (set_id=hostmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.28.30
country_id: 192950
description:
2025-12-01 23:46:02 dovecot_plain authenticator failed for ([89.116.164.85]) [102.210.28.30]:45184: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.182.125.210
country_id: 6252001
description:
2025-12-01 23:46:15 dovecot_plain authenticator failed for (ceotter) [12.182.125.210]:46064: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.90.206
country_id: 2802361
description:
2025-12-01 23:53:29 dovecot_login authenticator failed for (ADMIN) [149.22.90.206]:49874: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.132.163.75
country_id: 2921044
description:
2025-12-01 23:56:25 dovecot_plain authenticator failed for (unism) [91.132.163.75]:42746: 535 Incorrect authentication data (set_id=dev@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 14.194.122.130
country_id: 1269750
description:
Dec  1 23:58:34 host2 sshd[1177171]: User agentallianz from 14.194.122.130 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  1 23:58:54 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<sSCoJuhEyssXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  2 00:05:13 host2 sshd[1181403]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 51047


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  2 00:05:33 host2 sshd[1181709]: User agentallianz from 62.60.135.104 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.246.43.225
country_id: 3996063
description:
2025-12-02 00:05:32 dovecot_plain authenticator failed for ([89.116.164.85]) [177.246.43.225]:16731: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  2 00:06:50 host2 sshd[1182433]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 60681


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-02 00:07:08 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64090: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  2 00:08:28 host2 sshd[1183454]: User agentallianz from 103.160.212.28 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 00:10:36 host2 sshd[1185192]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.230.242.69
country_id: 1880251
description:
[2025-12-02 00:11:26 +0530] info [whostmgrd] 157.230.242.69 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 00:15:19 host2 sshd[1188574]: Disconnected from invalid user user 2.57.121.112 port 63355 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.6
country_id: 3042225
description:
2025-12-02 00:16:32 dovecot_login authenticator failed for (ADMIN) [91.90.124.6]:45934: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Dec  2 00:16:23 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.137, lip=66.85.158.92, TLS: Connection closed, session=<H09dZehElqNChJmJ>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.108
country_id: 130758
description:
Dec  2 00:17:34 host2 sshd[1189934]: User agentallianz from 62.60.135.108 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.249
country_id: 6252001
description:
Dec  2 00:20:01 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.249, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<q4RacuhEw8KTuYT5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 00:20:22 host2 sshd[1192176]: Disconnected from invalid user user 2.57.121.112 port 64075 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-02 00:20:51 +0530] info [cpaneld] 43.245.222.27 - yashihol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashihol (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.40
country_id: 6251999
description:
Dec  2 00:21:30 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=86.54.31.40, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<FvWfd+hE2MBWNh8o>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2025-12-02 00:25:15 dovecot_plain authenticator failed for (damoss) [65.20.160.107]:35174: 535 Incorrect authentication data (set_id=help@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.82.93.75
country_id: 1643084
description:
Dec  2 00:31:23 host2 sshd[1199646]: User agentallianz from 103.82.93.75 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.65
country_id: 2635167
description:
2025-12-02 00:34:57 dovecot_login authenticator failed for (ADMIN) [45.133.172.65]:43114: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 00:35:20 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<SyH8qOhEpMcXXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 00:38:30 host2 sshd[1204562]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Dec  2 00:40:11 host2 sshd[1205868]: Disconnected from invalid user user 2.57.121.25 port 10927 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 00:45:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<+WULzOhEEN8XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.197.236.163
country_id: 6252001
description:
2025-12-02 00:45:11 dovecot_plain authenticator failed for c-73-197-236-163.hsd1.nj.comcast.net (scalatiled) [73.197.236.163]:35254: 535 Incorrect authentication data (set_id=media@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  2 00:47:27 host2 sshd[1210935]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 50862


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.245.194.14
country_id: 6252001
description:
[2025-12-02 00:50:41 +0530] info [cpaneld] 24.245.194.14 - lezzarotechcom "GET /login/?login_only=1&user=lezzarotechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.189.63.171
country_id: 6252001
description:
[2025-12-02 00:50:45 +0530] info [cpaneld] 72.189.63.171 - lezzarotec "GET /login/?login_only=1&user=lezzarotec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotec (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.66
country_id: 6252001
description:
Dec  2 00:51:08 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.66, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<odGW4ehEr8TN0h9C>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.115.214.172
country_id: 6252001
description:
[2025-12-02 00:50:31 +0530] info [cpaneld] 146.115.214.172 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.121.15.108
country_id: 6252001
description:
[2025-12-02 00:50:33 +0530] info [cpaneld] 70.121.15.108 - lezzarotech "GET /login/?login_only=1&user=lezzarotech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.154.40
country_id: 6252001
description:
[2025-12-02 00:50:51 +0530] info [cpaneld] 35.151.154.40 - lezzarot "GET /login/?login_only=1&user=lezzarot&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.244.104.114
country_id: 6252001
description:
[2025-12-02 00:51:00 +0530] info [cpaneld] 69.244.104.114 - lezz "GET /login/?login_only=1&user=lezz&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezz (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.196.234.53
country_id: 6252001
description:
[2025-12-02 00:50:36 +0530] info [whostmgrd] 73.196.234.53 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.41.160.108
country_id: 6252001
description:
[2025-12-02 00:50:48 +0530] info [cpaneld] 47.41.160.108 - lezzarote "GET /login/?login_only=1&user=lezzarote&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarote (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.104.219.252
country_id: 6252001
description:
[2025-12-02 00:51:06 +0530] info [cpaneld] 73.104.219.252 - le "GET /login/?login_only=1&user=le&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user le (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.201.12.246
country_id: 6252001
description:
[2025-12-02 00:50:23 +0530] info [cpaneld] 73.201.12.246 - 587hr "GET /login/?login_only=1&user=587hr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.113.85.243
country_id: 6252001
description:
[2025-12-02 00:50:54 +0530] info [cpaneld] 172.113.85.243 - lezzaro "GET /login/?login_only=1&user=lezzaro&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.224.44.114
country_id: 6252001
description:
[2025-12-02 00:50:55 +0530] info [cpaneld] 98.224.44.114 - lezzar "GET /login/?login_only=1&user=lezzar&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzar (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.214.19.18
country_id: 6252001
description:
[2025-12-02 00:50:58 +0530] info [cpaneld] 67.214.19.18 - lezza "GET /login/?login_only=1&user=lezza&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezza (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.127.147.156
country_id: 6252001
description:
[2025-12-02 00:51:03 +0530] info [cpaneld] 73.127.147.156 - lez "GET /login/?login_only=1&user=lez&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lez (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.160.209.209
country_id: 6252001
description:
[2025-12-02 00:51:13 +0530] info [cpaneld] 70.160.209.209 - lezzaro2 "GET /login/?login_only=1&user=lezzaro2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro2 (has_cpuser_file failed)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 45.77.227.57
country_id: 2635167
description:
Dec  2 00:52:00 host2 sshd[1213661]: User agentallianz from 45.77.227.57 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.113.176
country_id: 6252001
description:
[2025-12-02 00:51:10 +0530] info [cpaneld] 172.56.113.176 - lezzaro1 "GET /login/?login_only=1&user=lezzaro1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzaro1 (has_cpuser_file failed)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  2 00:52:44 host2 sshd[1214042]: User agentallianz from 206.238.42.137 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-12-02 00:53:29 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.78
country_id: 6252001
description:
Dec  2 00:54:45 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.78, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<hceI7uhEm8bG6xhO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.163
country_id: 6252001
description:
Dec  2 00:55:04 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.193.163, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5RGv7+hEEsUUQcGj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.193.37
country_id: 2629691
description:
2025-12-02 00:54:18 dovecot_login authenticator failed for (ADMIN) [45.133.193.37]:62812: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-12-02 00:55:47 dovecot_login authenticator failed for ([103.220.91.130]) [152.52.236.158]:41676: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-02 00:55:19 +0530] info [cpaneld] 43.245.222.27 - ceyl "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceyl (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-12-02 00:55:25 dovecot_login authenticator failed for (n7-c210.client.tomica.ru) [45.194.26.149]:60222: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Dec  2 01:01:10 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<info@systemtec.lk>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<JNxEBelEsNJ283VD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.151.137.207
country_id: 130758
description:
Dec  2 01:06:53 host2 sshd[1224221]: Invalid user lankaherbalsolutions from 193.151.137.207 port 54326


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  2 01:07:12 host2 sshd[1224462]: User agentallianz from 162.0.224.38 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.209.110
country_id: 1269750
description:
2025-12-02 01:07:40 dovecot_login authenticator failed for ([127.0.0.1]) [152.52.209.110]:57876: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2025-12-02 01:07:49 dovecot_login authenticator failed for ([127.0.0.1]) [122.186.202.58]:39082: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.228.53.46
country_id: 6252001
description:
Dec  2 01:07:49 host2 dovecot[3366265]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=66.228.53.46, lip=66.85.158.92, session=<Lg5GHelEhNZC5DUu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.27
country_id: 1269750
description:
Dec  2 01:11:38 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=103.18.166.27, lip=66.85.158.91, TLS, session=<tpDIKelEMrBnEqYb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.106.87.118
country_id: 3469034
description:
Dec  2 01:11:58 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.106.87.118, lip=66.85.158.91, TLS, session=<0+wCK+lE7aizald2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.115
country_id: 6252001
description:
2025-12-02 01:14:14 dovecot_login authenticator failed for (ADMIN) [181.41.206.115]:35799: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.115
country_id: 6252001
description:
Dec  2 01:17:17 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.115, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<N1caP+lEz9HG6xhz>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  2 01:17:35 host2 sshd[1231790]: User agentallianz from 43.164.1.102 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-12-02 01:21:06 dovecot_plain authenticator failed for (wergris) [154.144.243.93]:47440: 535 Incorrect authentication data (set_id=monitoring@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 01:20:52 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<gZfNS+lEQooXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-12-02 01:21:09 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (houtive) [73.137.7.97]:47388: 535 Incorrect authentication data (set_id=monitoring@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.107
country_id: 130758
description:
Dec  2 01:21:47 host2 sshd[1234806]: User agentallianz from 62.60.135.107 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 01:22:14 host2 sshd[1235154]: Disconnected from invalid user admin 2.57.121.112 port 32659 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  2 01:26:59 host2 sshd[1237909]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 62652


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-12-02 01:27:11 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:53646: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2025-12-02 01:27:51 dovecot_login authenticator failed for (nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:47577: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.129.23
country_id: 6252001
description:
Dec  2 01:30:52 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=74.249.129.23, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DBW5b+lEeK5K+YEX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.62
country_id: 1814991
description:
2025-12-02 01:32:52 dovecot_login authenticator failed for (ADMIN) [188.241.80.62]:61900: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.28
country_id: 130758
description:
Dec  2 01:33:13 host2 sshd[1241559]: User agentallianz from 62.60.135.28 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-12-02 01:33:31 dovecot_login authenticator failed for ([195.158.14.232]) [125.19.156.46]:33742: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-12-02 01:34:02 dovecot_login authenticator failed for ([161.81.253.239]) [210.1.66.154]:51522: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.210
country_id: 953987
description:
Dec  2 01:36:54 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@jrdc.lk>, method=PLAIN, rip=102.129.61.210, lip=66.85.158.91, TLS, session=<9zMthOlEqb9mgT3S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.182
country_id: 3175395
description:
Dec  2 01:37:12 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.15.171.182, lip=66.85.158.91, TLS, session=<Us1jhelEs8m5D6u2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.100.62
country_id: 3175395
description:
Dec  2 01:39:00 host2 sshd[1245771]: Disconnected from invalid user root123 151.34.100.62 port 58836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.100.62
country_id: 3175395
description:
Dec  2 01:39:58 host2 sshd[1246659]: Disconnected from invalid user under 151.34.100.62 port 58227 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 151.34.100.62
country_id: 3175395
description:
Dec  2 01:40:57 host2 sshd[1247643]: Disconnected from invalid user syncuser 151.34.100.62 port 58898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.34.100.62
country_id: 3175395
description:
Dec  2 01:45:17 host2 sshd[1251975]: Disconnected from invalid user administrator 151.34.100.62 port 58523 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 45.77.227.57
country_id: 2635167
description:
Dec  2 01:45:33 host2 sshd[1252245]: User agentallianz from 45.77.227.57 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2025-12-02 01:52:40 dovecot_plain authenticator failed for (plate) [24.105.248.218]:53536: 535 Incorrect authentication data (set_id=media@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  2 01:56:17 host2 sshd[1260507]: User agentallianz from 206.238.42.137 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.239.7
country_id: 1227603
description:
2025-12-02 01:56:30 dovecot_login authenticator failed for (ADMIN) [95.181.239.7]:61968: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.36
country_id: 6252001
description:
Dec  2 01:56:51 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.36, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<W2+pzOlETNfG6xgk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.166.153.20
country_id: 6252001
description:
2025-12-02 02:00:14 dovecot_plain authenticator failed for c-174-166-153-20.hsd1.nj.comcast.net (woryox) [174.166.153.20]:55288: 535 Incorrect authentication data (set_id=noreply@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  2 02:02:08 host2 sshd[1263892]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 58197


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 162.0.224.38
country_id: 6252001
description:
Dec  2 02:04:01 host2 sshd[1265425]: User agentallianz from 162.0.224.38 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.122.102
country_id: 2921044
description:
Dec  2 02:09:53 host2 sshd[1269798]: Invalid user lankaherbalsolutions from 46.101.122.102 port 50470


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.109.48.63
country_id: 2589581
description:
2025-12-02 02:10:40 dovecot_plain authenticator failed for (738K4S3IJ) [105.109.48.63]:12307: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 02:11:45 host2 sshd[1271276]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.116
country_id: 1269750
description:
Dec  2 02:15:11 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@systemtec.lk>, method=PLAIN, rip=103.18.166.116, lip=66.85.158.91, TLS, session=<W5UTDepEf9FnEqZ0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.192.179.196
country_id: 798544
description:
Dec  2 02:15:29 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=193.192.179.196, lip=66.85.158.91, TLS, session=<j7FGDupEQ9/BwLPE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec  2 02:17:07 host2 pure-ftpd[1274797]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 207.90.244.28
country_id: 6252001
description:
Dec  2 02:17:23 host2 pure-ftpd[1275011]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 207.90.244.28
country_id: 6252001
description:
Dec  2 02:17:13 host2 pure-ftpd[1274910]: (?@207.90.244.28) [INFO] New connection from 207.90.244.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.113
country_id: 2661886
description:
2025-12-02 02:18:29 dovecot_login authenticator failed for (ADMIN) [212.112.19.113]:35446: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  2 02:21:21 host2 sshd[1277392]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 62682


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-02 02:23:31 +0530] info [cpaneld] 43.245.222.27 - ceylon "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylon (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  2 02:24:09 host2 sshd[1279166]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 60583


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-12-02 02:24:31 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (derus) [76.145.10.140]:52854: 535 Incorrect authentication data (set_id=postmaster@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.120.109
country_id: 6252001
description:
2025-12-02 02:26:19 dovecot_login authenticator failed for ([127.0.0.1]) [98.185.120.109]:36959: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.168.66
country_id: 1819730
description:
2025-12-02 02:26:38 dovecot_login authenticator failed for ([127.0.0.1]) [43.245.168.66]:39868: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.32.230.230
country_id: 2635167
description:
2025-12-02 02:27:36 dovecot_plain authenticator failed for uddi-29-b2-v4wan-166599-cust1765.vm12.cable.virginm.net (cozine) [82.32.230.230]:45199: 535 Incorrect authentication data (set_id=orders@lezzarotech.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  2 02:32:28 host2 sshd[1285642]: User agentallianz from 103.160.212.28 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 02:34:35 host2 sshd[1286714]: Disconnected from invalid user admin 2.57.121.112 port 64907 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.145
country_id: 3041565
description:
2025-12-02 02:37:38 dovecot_login authenticator failed for (ADMIN) [173.239.217.145]:59693: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 02:39:41 host2 sshd[1290162]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-12-02 02:39:09 dovecot_login authenticator failed for ([211.20.26.201]) [178.250.191.189]:35378: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-12-02 02:39:28 dovecot_login authenticator failed for ([107.181.168.150]) [85.117.232.42]:50064: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  2 02:41:09 host2 sshd[1291206]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 62051


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2025-12-02 02:42:21 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com (180.188.76.219.static.netvigator.com) [24.105.160.100]:35091: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-12-02 02:42:34 dovecot_login authenticator failed for c-85-225-19-144.bbcust.telenor.se ([142.54.231.33]) [85.225.19.144]:42836: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Dec  2 02:42:16 host2 sshd[1291837]: Disconnected from invalid user ben 103.161.207.2 port 42900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Dec  2 02:45:08 host2 sshd[1293626]: Disconnected from invalid user lab 103.161.207.2 port 59584 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
country_id: 6252001
description:
2025-12-02 02:49:07 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:7653: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.23.130.133
country_id: 6252001
description:
Dec  2 02:50:01 host2 sshd[1297022]: Invalid user lankaherbalsolutions from 64.23.130.133 port 35634


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-12-02 02:49:19 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:60916: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.43.4.34
country_id: 1269750
description:
2025-12-02 02:49:37 dovecot_plain authenticator failed for (UJZECE2W) [103.43.4.34]:55426: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.161.207.2
country_id: 1643084
description:
Dec  2 02:49:41 host2 sshd[1296844]: Disconnected from invalid user ubuntu 103.161.207.2 port 36846 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.184
country_id: 3175395
description:
Dec  2 02:50:31 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=217.26.179.184, lip=66.85.158.91, TLS, session=<p5uMi+pEHuLZGrO4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.98.100
country_id: 798544
description:
Dec  2 02:50:49 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=178.219.98.100, lip=66.85.158.91, TLS, session=<FVqijOpEH7Cy22Jk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.151.137.207
country_id: 130758
description:
Dec  2 02:50:20 host2 sshd[1297332]: Invalid user lankaherbalsolutions from 193.151.137.207 port 34730


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Dec  2 02:51:17 host2 sshd[1297903]: Disconnected from invalid user ubuntu 103.161.207.2 port 38670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.161.207.2
country_id: 1643084
description:
Dec  2 02:52:53 host2 sshd[1298860]: Disconnected from invalid user sonarqube 103.161.207.2 port 41506 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-12-02 02:53:16 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (chmiterae) [67.172.54.29]:56966: 535 Incorrect authentication data (set_id=root@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.7
country_id: 798549
description:
2025-12-02 03:00:25 dovecot_login authenticator failed for (ADMIN) [143.244.54.7]:44426: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 206.238.42.137
country_id: 1819730
description:
Dec  2 03:00:44 host2 sshd[1304595]: User agentallianz from 206.238.42.137 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.219
country_id: 3469034
description:
Dec  2 03:05:03 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<amila>, method=PLAIN, rip=177.8.251.219, lip=66.85.158.91, TLS, session=<ewtbv+pEgr6xCPvb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.228.32.43
country_id: 798544
description:
Dec  2 03:04:41 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=91.228.32.43, lip=66.85.158.91, TLS, session=<vJ8pvupEas9b5CAr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  2 03:05:55 host2 sshd[1308736]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 63748


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Dec  2 03:07:52 host2 sshd[1309787]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 59199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-12-02 03:08:19 dovecot_login authenticator failed for ([174.75.211.217]) [65.20.130.95]:42212: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-12-02 03:08:34 dovecot_login authenticator failed for (undefined.hostname.localhost) [27.123.104.142]:57074: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-02 03:09:04 +0530] info [cpaneld] 43.245.222.27 - yashih "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashih (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.60.126
country_id: 1269750
description:
2025-12-02 03:13:20 dovecot_login authenticator failed for ([127.0.0.1]) [122.187.60.126]:51938: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.122.102
country_id: 2921044
description:
Dec  2 03:13:27 host2 sshd[1313460]: Invalid user lankaherbalsolutions from 46.101.122.102 port 49874


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-12-02 03:20:00 dovecot_plain authenticator failed for (jactic) [24.93.140.162]:50108: 535 Incorrect authentication data (set_id=postmaster@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 81.189.162.142
country_id: 2782113
description:
Dec  2 03:19:14 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth service reported temporary failure): user=<info@simple-engineering.lk>, method=PLAIN, rip=81.189.162.142, lip=66.85.158.91, session=<lOAc8+pEn5JRvaKO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-12-02 03:24:19 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net (pretious) [74.90.213.28]:35786: 535 Incorrect authentication data (set_id=orders@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.163
country_id: 2328926
description:
2025-12-02 03:25:29 dovecot_login authenticator failed for (ADMIN) [146.70.65.163]:28828: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-12-02 03:27:37 dovecot_plain authenticator failed for (pless) [23.30.11.253]:42787: 535 Incorrect authentication data (set_id=office@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.50
country_id: 6252001
description:
Dec  2 03:27:41 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.50, lip=66.85.158.92, TLS, session=<GfdzEetE8unG6xgy>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-12-02 03:28:26 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (logely) [68.60.77.128]:58598: 535 Incorrect authentication data (set_id=root@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec  2 03:33:06 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<PzLZJOtEef/CpRCj>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-12-02 03:37:47 +0530] info [cpaneld] 43.245.222.27 - ceylondi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ceylondi (has_cpuser_file failed)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.82.93.75
country_id: 1643084
description:
Dec  2 03:38:56 host2 sshd[1337161]: User agentallianz from 103.82.93.75 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 03:40:20 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<OBSdPutE5OwXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-12-02 03:41:43 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:48245: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-12-02 03:41:59 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:45760: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.13
country_id: 289688
description:
2025-12-02 03:43:52 dovecot_login authenticator failed for (ADMIN) [95.181.234.13]:46627: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.145.163
country_id: 6252001
description:
Dec  2 03:44:31 host2 sshd[1342787]: Disconnected from invalid user ali 137.184.145.163 port 46816 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.169.174.59
country_id: 2921044
description:
[2025-12-02 03:45:56 +0530] info [cpaneld] 81.169.174.59 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.165
country_id: 1880251
description:
Dec  2 03:46:16 host2 sshd[1345171]: Disconnected from invalid user ahmed 157.245.55.165 port 34436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Dec  2 03:47:51 host2 sshd[1347838]: Disconnected from invalid user minecraft 103.137.194.125 port 37738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.165
country_id: 1880251
description:
Dec  2 03:48:53 host2 sshd[1348759]: Disconnected from invalid user bob 157.245.55.165 port 37512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec  2 03:49:14 host2 sshd[1349260]: Disconnected from invalid user administrator 104.223.85.124 port 54368 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.145.163
country_id: 6252001
description:
Dec  2 03:49:45 host2 sshd[1349721]: Disconnected from invalid user username 137.184.145.163 port 52960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Dec  2 03:50:38 host2 sshd[1350856]: Disconnected from invalid user tempuser 103.137.194.125 port 60020 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.165
country_id: 1880251
description:
Dec  2 03:50:11 host2 sshd[1350455]: Disconnected from invalid user under 157.245.55.165 port 60470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec  2 03:51:19 host2 sshd[1351697]: Disconnected from invalid user odoo17 104.223.85.124 port 54218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Dec  2 03:51:50 host2 sshd[1352297]: Disconnected from invalid user username 103.137.194.125 port 48762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  2 03:52:46 host2 sshd[1353256]: Disconnected from invalid user natalee 62.60.131.157 port 36823 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.137.194.125
country_id: 1269750
description:
Dec  2 03:52:59 host2 sshd[1353472]: Disconnected from invalid user ali 103.137.194.125 port 38026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec  2 03:52:15 host2 sshd[1352913]: Disconnected from invalid user production 104.223.85.124 port 34414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.165
country_id: 1880251
description:
Dec  2 03:52:36 host2 sshd[1353154]: Disconnected from invalid user ali 157.245.55.165 port 41148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.223.85.124
country_id: 6251999
description:
Dec  2 03:53:10 host2 sshd[1353747]: Disconnected from invalid user bob 104.223.85.124 port 39216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.245.55.165
country_id: 1880251
description:
Dec  2 03:53:45 host2 sshd[1354216]: Disconnected from invalid user bitnami 157.245.55.165 port 56308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-12-02 04:01:05 dovecot_login authenticator failed for (2-54-84-186.orange.net.il) [65.20.143.159]:55754: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-12-02 04:00:48 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:51970: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.55.140
country_id: 953987
description:
Dec  2 04:03:43 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<amila@euroentertainmentlk.com>, method=PLAIN, rip=102.129.55.140, lip=66.85.158.91, TLS, session=<EuwnketED5NmgTeM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.246.78
country_id: 3469034
description:
Dec  2 04:04:17 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<amila>, method=PLAIN, rip=186.209.246.78, lip=66.85.158.91, TLS, session=<a8Qsk+tEmdC60fZO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.154.74
country_id: 783754
description:
2025-12-02 04:07:20 dovecot_login authenticator failed for (ADMIN) [31.171.154.74]:56628: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-12-02 04:09:30 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (helize) [98.204.134.124]:37470: 535 Incorrect authentication data (set_id=operator@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 04:12:21 host2 sshd[1375313]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Dec  2 04:12:45 host2 sshd[1375753]: Disconnected from invalid user proradis 187.110.238.50 port 44082 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.50
country_id: 6252001
description:
Dec  2 04:14:32 host2 pure-ftpd[1377797]: (?@167.94.146.50) [INFO] New connection from 167.94.146.50


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Dec  2 04:16:34 host2 sshd[1380031]: Disconnected from invalid user vendas 187.110.238.50 port 44454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.192.46.45
country_id: 2542007
description:
Dec  2 04:16:40 host2 sshd[1380096]: Disconnected from invalid user sftp 81.192.46.45 port 40708 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.110.238.50
country_id: 3469034
description:
Dec  2 04:17:54 host2 sshd[1381059]: Disconnected from invalid user hello 187.110.238.50 port 45806 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 04:17:16 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Tc6twutEvtsXXz9j>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.28
country_id: 130758
description:
Dec  2 04:17:50 host2 sshd[1381011]: User agentallianz from 62.60.135.28 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Dec  2 04:17:25 host2 sshd[1380639]: Disconnected from invalid user ntps 116.193.191.159 port 47258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.126.7.35
country_id: 130758
description:
Dec  2 04:17:32 host2 sshd[1380726]: Disconnected from invalid user odoo 185.126.7.35 port 44358 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-12-02 04:18:35 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:43012: 535 Incorrect authentication data (set_id=vinod@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.0.4
country_id: 3469034
description:
Dec  2 04:18:50 host2 sshd[1381830]: Disconnected from invalid user sftp 170.80.0.4 port 46857 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.229
country_id: 2635167
description:
Dec  2 04:19:41 host2 dovecot[3366265]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.229, lip=66.85.158.92, TLS, session=<1Fdyy+tEb9m594nl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.245
country_id: 2635167
description:
Dec  2 04:19:42 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.245, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<dLiDy+tED+VX7LD1>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.126.7.35
country_id: 130758
description:
Dec  2 04:19:44 host2 sshd[1382668]: Disconnected from invalid user share 185.126.7.35 port 42302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Dec  2 04:19:11 host2 sshd[1382092]: Disconnected from invalid user nishant 187.110.238.50 port 47154 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.220
country_id: 2635167
description:
Dec  2 04:20:49 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.220, lip=66.85.158.92, TLS handshaking: Connection closed, session=<q3N6z+tE/5C594nc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.126.7.35
country_id: 130758
description:
Dec  2 04:20:50 host2 sshd[1384044]: Disconnected from invalid user ubuntu 185.126.7.35 port 45990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Dec  2 04:20:26 host2 sshd[1383611]: Disconnected from invalid user ali 116.193.191.159 port 33268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Dec  2 04:20:34 host2 sshd[1383775]: Disconnected from invalid user ventas01 187.110.238.50 port 48494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Dec  2 04:20:39 host2 sshd[1383791]: Disconnected from invalid user john 45.78.223.11 port 60792 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.218.39.243
country_id: 2661886
description:
2025-12-02 04:20:17 dovecot_login authenticator failed for c77-218-39-243.bredband.tele2.se ([127.0.0.1]) [77.218.39.243]:41462: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.235
country_id: 2635167
description:
Dec  2 04:20:15 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.235, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<ghN/zetEYZe594nr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec  2 04:20:20 host2 sshd[1383514]: Disconnected from invalid user apacher 103.186.1.120 port 46068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.185.121.249
country_id: 6252001
description:
2025-12-02 04:20:23 dovecot_login authenticator failed for ([127.0.0.1]) [98.185.121.249]:59507: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.0.4
country_id: 3469034
description:
Dec  2 04:21:11 host2 sshd[1384388]: Disconnected from invalid user taiga 170.80.0.4 port 38023 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.248
country_id: 2635167
description:
Dec  2 04:21:22 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.248, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<If160etEUaRX7LD4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.247
country_id: 2635167
description:
Dec  2 04:21:56 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=185.247.137.247, lip=66.85.158.92, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<6lV20+tE47C594n3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.126.7.35
country_id: 130758
description:
Dec  2 04:21:58 host2 sshd[1385126]: Disconnected from invalid user proradis 185.126.7.35 port 59432 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.193.59
country_id: 3996063
description:
Dec  2 04:22:22 host2 sshd[1385706]: Disconnected from invalid user tmp 187.140.193.59 port 43346 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec  2 04:22:24 host2 sshd[1385673]: Disconnected from invalid user test1 103.186.1.120 port 34698 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.222
country_id: 2635167
description:
Dec  2 04:22:29 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.222, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<q85v1etEgdtX7LDe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.220
country_id: 2635167
description:
Dec  2 04:23:02 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.220, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<cDht1+tE19ZX7LDc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.175.123.90
country_id: 1821275
description:
2025-12-02 04:23:36 dovecot_login authenticator failed for z123l90.static.ctm.net ([127.0.0.1]) [202.175.123.90]:46470: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.31.39.66
country_id: 1643084
description:
Dec  2 04:24:05 host2 sshd[1386797]: Disconnected from invalid user airflow 103.31.39.66 port 33274 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.118
country_id: 1269750
description:
2025-12-02 04:23:27 dovecot_login authenticator failed for ([127.0.0.1]) [182.95.226.118]:34716: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.225
country_id: 2635167
description:
Dec  2 04:23:35 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.225, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<Gnxo2etEIbe594nh>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.140.193.59
country_id: 3996063
description:
Dec  2 04:23:48 host2 sshd[1386639]: Disconnected from invalid user postgres 187.140.193.59 port 42102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.0.4
country_id: 3469034
description:
Dec  2 04:24:25 host2 sshd[1387144]: Disconnected from invalid user user2 170.80.0.4 port 39842 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.246
country_id: 2635167
description:
Dec  2 04:24:42 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.246, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<mzFd3etE3+G594n2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.140.193.59
country_id: 3996063
description:
Dec  2 04:24:56 host2 sshd[1387691]: Disconnected from invalid user sftp 187.140.193.59 port 40874 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.218
country_id: 2635167
description:
Dec  2 04:24:08 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (disconnected before auth was ready, waited 0 secs): user=<>, rip=87.236.176.218, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<4Nxh2+tEt7xX7LDa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.120
country_id: 1643084
description:
Dec  2 04:25:24 host2 sshd[1388180]: Disconnected from invalid user user7 103.186.1.120 port 60474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Dec  2 04:25:48 host2 sshd[1388561]: Disconnected from invalid user user2 116.193.191.159 port 42604 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.1.120
country_id: 1643084
description:
Dec  2 04:26:48 host2 sshd[1389548]: Disconnected from invalid user panda 103.186.1.120 port 41892 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.45
country_id: 6252001
description:
Dec  2 04:28:34 host2 pure-ftpd[1391160]: (?@198.235.24.45) [INFO] New connection from 198.235.24.45


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.227.226.100
country_id: 3057568
description:
Dec  2 04:29:55 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=91.227.226.100, lip=66.85.158.91, TLS, session=<xE8H7+tEAppb4+Jk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 170.80.0.4
country_id: 3469034
description:
Dec  2 04:29:59 host2 sshd[1392027]: Disconnected from invalid user john 170.80.0.4 port 43463 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.33
country_id: 614540
description:
2025-12-02 04:30:29 dovecot_login authenticator failed for (ADMIN) [95.181.236.33]:25202: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Dec  2 04:30:45 host2 sshd[1393047]: Disconnected from invalid user manager 116.193.191.159 port 49230 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.210.46
country_id: 933860
description:
Dec  2 04:30:17 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=41.216.210.46, lip=66.85.158.91, TLS, session=<zlov8OtEV84p2NIu>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 43.164.1.102
country_id: 1605651
description:
Dec  2 04:32:04 host2 sshd[1394203]: User agentallianz from 43.164.1.102 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Dec  2 04:32:59 host2 sshd[1394636]: Disconnected from invalid user ali 45.78.223.11 port 54726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.117
country_id: 3469034
description:
Dec  2 04:36:08 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<info@systemtec.lk>, method=PLAIN, rip=177.44.96.117, lip=66.85.158.91, TLS, session=<alfhBOxEANqxLGB1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.11
country_id: 1880251
description:
Dec  2 04:35:34 host2 sshd[1398685]: Disconnected from invalid user airflow 45.78.223.11 port 33848 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.194
country_id: 6252001
description:
Dec  2 04:36:13 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.194, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<xZCQBuxE1sbG6xjC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.46.82
country_id: 953987
description:
Dec  2 04:36:29 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=102.64.46.82, lip=66.85.158.91, TLS, session=<+Y5iBuxE/49mQC5S>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.104
country_id: 130758
description:
Dec  2 04:38:34 host2 sshd[1400327]: User agentallianz from 62.60.135.104 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 04:40:02 host2 sshd[1401237]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.152.102
country_id: 6252001
description:
2025-12-02 04:48:20 dovecot_login authenticator failed for (ADMIN) [102.129.152.102]:4702: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.245.222.27
country_id: 1819730
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 43.245.222.27 - ceylondigest "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 103.160.212.28
country_id: 1643084
description:
Dec  2 04:55:56 host2 sshd[1415735]: User agentallianz from 103.160.212.28 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.157.244
country_id: 2264397
description:
2025-12-02 05:02:17 dovecot_plain authenticator failed for bl23-157-244.dsl.telepac.pt (patect) [144.64.157.244]:42968: 535 Incorrect authentication data (set_id=service@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 05:07:17 host2 sshd[1427654]: Disconnected from invalid user telecomadmin 2.57.121.112 port 63238 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.133
country_id: 6252001
description:
2025-12-02 05:07:49 dovecot_login authenticator failed for (ADMIN) [212.32.50.133]:32984: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.157.144
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.209.157.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-12-02 05:21:29 dovecot_plain authenticator failed for (expreinal) [109.226.14.93]:56066: 535 Incorrect authentication data (set_id=sysadmin@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 191.53.128.251
country_id: 3469034
description:
Dec  2 05:25:25 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (client didn't finish SASL auth, waited 10 secs): user=<>, method=PLAIN, rip=191.53.128.251, lip=66.85.158.91, session=<ZevqtexE99e/NYD7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.234
country_id: 798544
description:
Dec  2 05:25:42 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@sivagnanamfoundation.com>, method=PLAIN, rip=46.20.58.234, lip=66.85.158.91, TLS, session=<zoCTtuxEMZwuFDrq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.38
country_id: 2802361
description:
2025-12-02 05:27:24 dovecot_login authenticator failed for (ADMIN) [181.214.218.38]:13711: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 05:28:11 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<eT1OwOxEyuwXXz9j>


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.106
country_id: 130758
description:
Dec  2 05:30:37 host2 sshd[1442925]: User agentallianz from 62.60.135.106 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.163
country_id: 2993457
description:
Dec  2 05:36:14 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.163, lip=66.85.158.91, session=<SVEw3exEx/7CpRCj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Dec  2 05:37:39 host2 sshd[1446547]: Disconnected from invalid user postgres 125.21.53.232 port 46944 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.209.157.144
country_id: 2921044
description:
[2025-12-02 05:37:57 +0530] info [cpaneld] 213.209.157.144 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.235
country_id: 6252001
description:
Dec  2 05:40:17 host2 pure-ftpd[1448329]: (?@205.210.31.235) [INFO] New connection from 205.210.31.235


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.222.164.230
country_id: 719819
description:
Dec  2 05:41:14 host2 sshd[1448792]: Disconnected from invalid user hadoop 213.222.164.230 port 56344 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.21.53.232
country_id: 1269750
description:
Dec  2 05:43:43 host2 sshd[1450039]: Disconnected from invalid user scanner 125.21.53.232 port 40242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Dec  2 05:44:56 host2 sshd[1450945]: Disconnected from invalid user deploy 125.21.53.232 port 45094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.222.164.230
country_id: 719819
description:
Dec  2 05:44:49 host2 sshd[1450900]: Disconnected from invalid user superman 213.222.164.230 port 55962 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.222.164.230
country_id: 719819
description:
Dec  2 05:45:56 host2 sshd[1451946]: Disconnected from invalid user kali 213.222.164.230 port 47536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.23.163
country_id: 2635167
description:
2025-12-02 05:46:57 dovecot_login authenticator failed for (ADMIN) [158.173.23.163]:47985: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.222.164.230
country_id: 719819
description:
Dec  2 05:48:09 host2 sshd[1453623]: Disconnected from invalid user scanner 213.222.164.230 port 39540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.222.164.230
country_id: 719819
description:
Dec  2 05:49:16 host2 sshd[1454220]: Disconnected from invalid user postgres 213.222.164.230 port 40040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-12-02 05:54:14 dovecot_plain authenticator failed for (fealle) [64.53.7.231]:49168: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Dec  2 05:54:22 host2 sshd[1457822]: Disconnected from invalid user admin 2.57.121.112 port 49764 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.138.42
country_id: 2510769
description:
Dec  2 05:56:50 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@jrdc.lk>, method=PLAIN, rip=185.214.138.42, lip=66.85.158.91, TLS, session=<VtXWJe1Emty51ooq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.84.202.144
country_id: 1269750
description:
Dec  2 05:57:11 host2 dovecot[3366265]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=103.84.202.144, lip=66.85.158.91, TLS, session=<2l8GJ+1EYZdnVMqQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.7
country_id: 2750405
description:
Dec  2 06:03:05 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=31.14.32.7, lip=66.85.158.92, TLS, session=<+JpCPe1EQeYfDiAH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec  2 06:02:30 host2 sshd[1462947]: Disconnected from invalid user aaa 179.125.24.202 port 59212 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-12-02 06:03:56 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (asubioless) [24.127.53.61]:39216: 535 Incorrect authentication data (set_id=service@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.162.232
country_id: 1880251
description:
Dec  2 06:04:13 host2 sshd[1464433]: Disconnected from invalid user john 101.47.162.232 port 56382 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 31.14.32.7
country_id: 2750405
description:
Dec  2 06:04:16 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=31.14.32.7, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<+JZ3Qe1EGO4fDiAH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-12-02 06:05:08 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:52317: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Dec  2 06:05:15 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<kE7ZRO1EpLsXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-12-02 06:05:29 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:45464: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec  2 06:07:55 host2 sshd[1466782]: Disconnected from invalid user ubadmin 186.87.166.141 port 34126 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.149.52.97
country_id: 6251999
description:
2025-12-02 06:09:06 dovecot_login authenticator failed for (ADMIN) [89.149.52.97]:53562: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 60.243.107.135
country_id: 1269750
description:
Dec  2 06:08:25 host2 sshd[1467049]: Disconnected from invalid user mike 60.243.107.135 port 52920 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  2 06:08:57 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<Qes8Uu1E4KMDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  2 06:09:40 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<ptXCVO1EbIgDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 60.243.107.135
country_id: 1269750
description:
Dec  2 06:09:53 host2 sshd[1467984]: Disconnected from invalid user server 60.243.107.135 port 44584 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec  2 06:09:13 host2 sshd[1467589]: Disconnected from invalid user tidb 186.87.166.141 port 60566 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.28
country_id: 130758
description:
Dec  2 06:09:34 host2 sshd[1467806]: User agentallianz from 62.60.135.28 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec  2 06:10:32 host2 sshd[1468558]: Disconnected from invalid user aaa 186.87.166.141 port 58762 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  2 06:11:28 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<xOkzW+1E3pwDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.87.166.141
country_id: 3686110
description:
Dec  2 06:11:47 host2 sshd[1469288]: Disconnected from invalid user john 186.87.166.141 port 56970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Dec  2 06:12:00 host2 sshd[1469383]: Disconnected from invalid user pearl 62.60.131.157 port 23522 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Dec  2 06:12:27 host2 sshd[1469638]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec  2 06:12:33 host2 sshd[1469673]: Disconnected from invalid user ubadmin 179.125.24.202 port 36444 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  2 06:12:32 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<aRQLX+1E9JwDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2025-12-02 06:13:43 dovecot_login authenticator failed for ([121.73.168.129]) [59.144.79.102]:39564: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec  2 06:13:48 host2 sshd[1470425]: Disconnected from invalid user userm 179.125.24.202 port 58432 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.197.82
country_id: 2186224
description:
2025-12-02 06:13:55 dovecot_login authenticator failed for 219-89-197-82.adsl.xtra.co.nz (ool-45701cb5.dyn.optonline.net) [219.89.197.82]:57118: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  2 06:13:56 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<GrsDZO1EHNoDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  2 06:14:11 host2 dovecot[3366265]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<IKj0ZO1EwJQDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.87.166.141
country_id: 3686110
description:
Dec  2 06:14:15 host2 sshd[1470666]: Disconnected from invalid user debianuser 186.87.166.141 port 53382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.125.24.202
country_id: 3469034
description:
Dec  2 06:15:03 host2 sshd[1471144]: Disconnected from invalid user mike 179.125.24.202 port 59414 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Dec  2 06:15:10 host2 dovecot[3366265]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<a9lvaO1E5qIDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 60.243.107.135
country_id: 1269750
description:
Dec  2 06:15:25 host2 sshd[1471422]: Disconnected from invalid user user01 60.243.107.135 port 41440 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.54
country_id: 6252001
description:
Dec  2 06:17:56 host2 dovecot[3366265]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.54, lip=66.85.158.91, TLS: Connection closed, session=<oq1Tcu1ElIKnXpI2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 60.243.107.135
country_id: 1269750
description:
Dec  2 06:18:12 host2 sshd[1472820]: Disconnected from invalid user aaa 60.243.107.135 port 48282 [preauth]


