# incident

plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.205.103
country_id: 1643084
description:
Nov 25 08:51:22 host2 sshd[2145850]: Disconnected from invalid user bitnami 103.172.205.103 port 42232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Nov 25 08:52:10 host2 sshd[2146337]: Disconnected from invalid user postgres 95.39.201.205 port 57112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.103
country_id: 1643084
description:
Nov 25 08:53:24 host2 sshd[2147078]: Disconnected from invalid user production 103.172.205.103 port 55716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.39.201.205
country_id: 2510769
description:
Nov 25 08:55:38 host2 sshd[2149289]: Disconnected from invalid user debian 95.39.201.205 port 43442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.21
country_id: 1880251
description:
Nov 25 08:55:43 host2 sshd[2149343]: Disconnected from invalid user es 101.47.142.21 port 55670 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.126
country_id: 1269750
description:
2025-11-25 08:57:32 dovecot_login authenticator failed for ([27.123.114.126]) [27.123.114.126]:42484: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 08:58:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<LDsb3mJEuJAvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-25 08:58:20 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:54396: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 09:02:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<6vBR7WJEqol2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.21
country_id: 1880251
description:
Nov 25 09:05:56 host2 sshd[2155879]: Disconnected from invalid user stperez 101.47.142.21 port 40516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.30
country_id: 1880251
description:
Nov 25 09:08:22 host2 sshd[2157430]: Disconnected from invalid user dspace 45.78.230.30 port 33572 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.142.21
country_id: 1880251
description:
Nov 25 09:11:04 host2 sshd[2159401]: Disconnected from invalid user abhi 101.47.142.21 port 33190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 09:12:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<S4TPD2NEIJ0v7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 09:13:26 host2 sshd[2160834]: Disconnected from invalid user leann 62.60.131.157 port 25004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 25 09:19:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<info@monarchdss.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<wn42KmNEJKM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 09:20:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<wBZ9LmNETmovTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.123
country_id: 2264397
description:
Nov 25 09:22:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.123, lip=66.85.158.91, TLS, session=<+uA4N2NEHawtnIF7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 25 09:23:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@monarchdss.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<pOlUOWNETJc+PIOI>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.25
country_id: 1605651
description:
Nov 25 09:23:47 host2 pure-ftpd[2167266]: (?@103.176.152.25) [INFO] New connection from 103.176.152.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 09:30:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<h0hiUWNEKN12wSaf>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.210.79
country_id: 2750405
description:
Nov 25 09:30:08 host2 pure-ftpd[2171278]: (?@158.94.210.79) [INFO] New connection from 158.94.210.79


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.222.81.115
country_id: 6252001
description:
Nov 25 09:32:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=44.222.81.115, lip=66.85.158.92, TLS, session=<Omp6WGNE7q4s3lFz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 09:33:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<u10DXGNEHMYv7bxd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 09:34:27 host2 sshd[2174152]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.183
country_id: 2300660
description:
Nov 25 09:34:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=41.139.11.183, lip=66.85.158.91, TLS, session=<UrP1YGNE/pgpiwu3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.252
country_id: 3469034
description:
Nov 25 09:35:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.209.251.252, lip=66.85.158.91, TLS, session=<+B5BYmNEupe60fv8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-25 09:41:19 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49964: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-11-25 09:41:30 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:56529: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-11-25 09:41:49 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:53179: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 09:43:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<v+Zff2NEdMwvTJuG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 09:52:21 host2 sshd[2188108]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 09:54:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<11e+qGNExtYv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.43.134
country_id: 953987
description:
Nov 25 09:57:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=102.64.43.134, lip=66.85.158.91, TLS, session=<fBrhsGNEBeFmQCuG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 09:57:33 host2 sshd[2192942]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.11.251.61
country_id: 3469034
description:
Nov 25 09:57:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=177.11.251.61, lip=66.85.158.91, TLS, session=<RDorsmNEGuexC/s9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 09:58:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<PRdqtmNENLV2wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Nov 25 10:03:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<Ico3yWNEEOQDWgzA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 10:05:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<n06+0GNE9AwvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 25 10:07:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<bt4d12NE+LU+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.122.95.15
country_id: 6252001
description:
2025-11-25 10:08:23 dovecot_plain authenticator failed for 15.95.122.34.bc.googleusercontent.com (bcone-vais-sharepoint-2-nov.bcone-vais2-shar.com) [34.122.95.15]:51053: 535 Incorrect authentication data (set_id=googlecloud)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.122.95.15
country_id: 6252001
description:
2025-11-25 10:08:32 dovecot_login authenticator failed for 15.95.122.34.bc.googleusercontent.com (bcone-vais-sharepoint-2-nov.bcone-vais2-shar.com) [34.122.95.15]:51053: 535 Incorrect authentication data (set_id=googlecloud)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 25 10:08:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<SjKR2mNEgMw+PIOK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.158.166
country_id: 6252001
description:
Nov 25 10:11:28 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=71.6.158.166, lip=66.85.158.92, session=<Jy+n5GNE3N5HBp6m>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 25 10:11:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@essenceceylontea.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<5/AI5GNEiNo+PIOK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.131
country_id: 6252001
description:
Nov 25 10:12:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=147.185.132.131, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<5dK06WNEDt+TuYSD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 25 10:13:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@melanifinefood.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<5HCc6mNE8Jw+PIOI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.131
country_id: 6252001
description:
Nov 25 10:13:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.132.131, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<ZY4m7WNEZuiTuYSD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.34
country_id: 6252001
description:
Nov 25 10:16:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.149.34, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<RVcs9WNEptCi2JUi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 10:16:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<SGzR9WNEgKcv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 10:15:33 host2 sshd[2206659]: Disconnected from invalid user admin 2.57.121.112 port 53368 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.34
country_id: 6252001
description:
Nov 25 10:17:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=162.216.149.34, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<I23d+GNEvPGi2JUi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.131
country_id: 6252001
description:
Nov 25 10:20:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.131, lip=66.85.158.92, TLS, session=<YF/NA2REVvSTuYSD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-11-25 10:21:21 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:38856: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 25 10:22:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<gqWbC2REBo42xDDo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.34
country_id: 6252001
description:
Nov 25 10:24:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.34, lip=66.85.158.91, TLS, session=<BeiMEmREQPei2JUi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 10:27:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<exrwHWRE2t52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 25 10:27:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.139, lip=66.85.158.91, session=<pkEWHmREHqM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 10:28:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<BXV6ImREFtsvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.76.242
country_id: 3469034
description:
Nov 25 10:30:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=187.120.76.242, lip=66.85.158.91, TLS, session=<1AhDKGREFrW7eEzy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.169
country_id: 798544
description:
Nov 25 10:30:58 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=91.238.166.169, lip=66.85.158.91, TLS, session=<5vtpKWRE2NRb7qap>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.136
country_id: 130758
description:
Nov 25 10:33:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@maximsholdings.com>, method=PLAIN, rip=62.60.131.136, lip=66.85.158.91, session=<krVxM2RErJU+PIOI>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.248
country_id: 6252001
description:
Nov 25 10:38:26 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.248, lip=66.85.158.92, session=<pSwPRWREouDG6xj4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 10:37:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<QYJBQ2RE5NIv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-25 10:49:27 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:45648: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 10:48:55 host2 sshd[2229513]: Disconnected from invalid user admin 2.57.121.112 port 23775 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 10:51:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<N2lZcmREfOgvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.87.18
country_id: 3865483
description:
Nov 25 10:53:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.181.87.18, lip=66.85.158.91, TLS, session=<0rXxeGREJ52+tVcS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.87.92
country_id: 3865483
description:
Nov 25 10:52:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=190.181.87.92, lip=66.85.158.91, TLS, session=<uW62d2RE/um+tVdc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 10:57:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<KisQiGRE7pR2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.188.75.249
country_id: 2750405
description:
Nov 25 10:58:17 host2 sshd[2236167]: Disconnected from invalid user grid 64.188.75.249 port 42520 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 10:59:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<78FXkGREmL4v7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Nov 25 11:01:54 host2 sshd[2238405]: Disconnected from invalid user admin 107.189.29.175 port 46678 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 25 11:03:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<OYpfnWREesCSOC+J>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.143.58.151
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 175.143.58.151 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 25 11:03:30 host2 sshd[2239598]: Disconnected from invalid user ahmed 190.111.211.81 port 39104 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.188.75.249
country_id: 2750405
description:
Nov 25 11:04:26 host2 sshd[2240145]: Disconnected from invalid user amssys 64.188.75.249 port 58062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.188.75.249
country_id: 2750405
description:
Nov 25 11:06:22 host2 sshd[2241864]: Disconnected from invalid user admin 64.188.75.249 port 43606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 25 11:06:29 host2 sshd[2241943]: Disconnected from invalid user sonarqube 190.111.211.81 port 46716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.189.29.175
country_id: 2960313
description:
Nov 25 11:05:52 host2 sshd[2241292]: Disconnected from invalid user grid 107.189.29.175 port 54466 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.189.29.175
country_id: 2960313
description:
Nov 25 11:07:02 host2 sshd[2242296]: Disconnected from invalid user gerrit 107.189.29.175 port 55268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 25 11:07:22 host2 sshd[2242581]: Disconnected from invalid user mcserver 152.32.185.214 port 56622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.91
country_id: 6252001
description:
2025-11-25 11:07:27 dovecot_login authenticator failed for ([70.174.168.91]) [70.174.168.91]:59092: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 25 11:07:53 host2 sshd[2242828]: Disconnected from invalid user amssys 190.111.211.81 port 36550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.188.75.249
country_id: 2750405
description:
Nov 25 11:08:18 host2 sshd[2243115]: Disconnected from invalid user ahmed 64.188.75.249 port 39660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.27.134.38
country_id: 1168579
description:
Nov 25 11:07:39 host2 sshd[2242724]: Disconnected from invalid user asterisk 58.27.134.38 port 16782 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2025-11-25 11:07:44 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:44117: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 25 11:08:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<ZyZDsWREBLwDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.138
country_id: 130758
description:
Nov 25 11:09:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@ceylondigest.com>, method=PLAIN, rip=62.60.131.138, lip=66.85.158.91, session=<Epuas2RE1N0+PIOK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.27.134.38
country_id: 1168579
description:
Nov 25 11:10:21 host2 sshd[2244508]: Disconnected from invalid user admin 58.27.134.38 port 49186 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.185.214
country_id: 1819730
description:
Nov 25 11:09:52 host2 sshd[2244016]: Disconnected from invalid user retag 152.32.185.214 port 53148 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.111.211.81
country_id: 3865483
description:
Nov 25 11:10:40 host2 sshd[2244657]: Disconnected from invalid user david 190.111.211.81 port 40598 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 25 11:11:49 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<cqV1vGREjJgDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 11:12:15 host2 sshd[2245664]: Disconnected from invalid user yessenia 62.60.131.157 port 28136 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 25 11:12:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<y3gsv2REmMcDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 25 11:12:35 host2 dovecot[3107204]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<gC80v2REtMcDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 11:13:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<UcotwWREIJIvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 25 11:13:40 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<zFkaw2REIpQDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-25 11:18:00 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:58086: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-25 11:18:14 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:40854: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 11:21:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<bJmw3WREiqsv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.104
country_id: 1880251
description:
Nov 25 11:27:00 host2 sshd[2254844]: Disconnected from invalid user zabbix 101.47.142.104 port 34164 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 11:27:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<wijh9GREBMd2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Nov 25 11:28:47 host2 sshd[2255789]: Disconnected from invalid user teste 202.157.176.165 port 54124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Nov 25 11:30:02 host2 sshd[2256531]: Disconnected from invalid user ftpuser 188.166.248.139 port 57708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Nov 25 11:30:09 host2 sshd[2256710]: Disconnected from invalid user gitlab-runner 202.157.176.165 port 53036 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.248.139
country_id: 1880251
description:
Nov 25 11:32:37 host2 sshd[2258189]: Disconnected from invalid user mqm 188.166.248.139 port 45712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.157.176.165
country_id: 1733045
description:
Nov 25 11:32:39 host2 sshd[2258201]: Disconnected from invalid user admin 202.157.176.165 port 34938 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 11:35:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<1m+3EGVEmiovTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.248.139
country_id: 1880251
description:
Nov 25 11:35:09 host2 sshd[2259888]: Disconnected from invalid user gg 188.166.248.139 port 43176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.104
country_id: 1880251
description:
Nov 25 11:36:15 host2 sshd[2260501]: Disconnected from invalid user ansible 101.47.142.104 port 40790 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.157.176.165
country_id: 1733045
description:
Nov 25 11:36:30 host2 sshd[2260610]: Disconnected from invalid user git 202.157.176.165 port 48004 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 81.230.11.165
country_id: 2661886
description:
Nov 25 11:38:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=81.230.11.165, lip=66.85.158.91, TLS, session=<2iGZGmVExNhR5gul>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.231.222.160
country_id: 130758
description:
Nov 25 11:39:22 host2 pure-ftpd[2262454]: (?@91.231.222.160) [INFO] New connection from 91.231.222.160


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.240.224
country_id: 2510769
description:
Nov 25 11:38:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=185.74.240.224, lip=66.85.158.91, TLS, session=<EV2sG2VEvLe5SvDg>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 196.251.100.114
country_id: 1819730
description:
Nov 25 11:39:14 host2 pure-ftpd[2262367]: (?@196.251.100.114) [INFO] New connection from 196.251.100.114


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 11:42:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<V1HKK2VE6Kov7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 11:44:23 host2 sshd[2265524]: Disconnected from invalid user  2.57.121.112 port 61177 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 25 11:48:05 host2 sshd[2268634]: Disconnected from invalid user tony 52.169.142.214 port 43736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 25 11:49:14 host2 sshd[2269620]: Disconnected from invalid user casaos 52.169.142.214 port 54344 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 25 11:50:26 host2 sshd[2270694]: Disconnected from invalid user user 52.169.142.214 port 34412 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-25 11:50:30 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:51331: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-11-25 11:50:43 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:50142: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 11:54:25 host2 sshd[2273867]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.169.142.214
country_id: 2963597
description:
Nov 25 11:54:19 host2 sshd[2273694]: Disconnected from invalid user zimbra 52.169.142.214 port 33808 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.69.10.175
country_id: 6252001
description:
Nov 25 11:55:35 host2 sshd[2275237]: Invalid user cloudtourssrilan_travel from 38.69.10.175 port 60204


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.104
country_id: 1880251
description:
Nov 25 11:56:58 host2 sshd[2276262]: Disconnected from invalid user toto 101.47.142.104 port 32924 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 11:57:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<d/ZxYWVEdEkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 11:58:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<DGedYmVEbKl2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.142.104
country_id: 1880251
description:
Nov 25 11:59:29 host2 sshd[2278358]: Disconnected from invalid user ftpuser 101.47.142.104 port 44798 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 12:05:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=</KaDemVEbMYv7bxd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 12:06:21 host2 sshd[2284742]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.172
country_id: 6252001
description:
Nov 25 12:08:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.172, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kZHniGVEJtPG6xis>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.106.194.74
country_id: 1269750
description:
Nov 25 12:09:31 host2 sshd[2287217]: Disconnected from invalid user sonarqube 103.106.194.74 port 43666 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov 25 12:11:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.92, TLS, session=<FeaRkGVEAroDU5En>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Nov 25 12:13:51 host2 sshd[2291505]: Disconnected from invalid user ansible 103.106.194.74 port 49296 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.106.194.74
country_id: 1269750
description:
Nov 25 12:15:12 host2 sshd[2292972]: Disconnected from invalid user arkserver 103.106.194.74 port 51156 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.8.179
country_id: 3077311
description:
Nov 25 12:15:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@saara.lk>, method=PLAIN, rip=31.222.8.179, lip=66.85.158.91, TLS, session=<AT+eoGVEk9Af3giz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.1.252.234
country_id: 798544
description:
Nov 25 12:16:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.1.252.234, lip=66.85.158.91, TLS, session=<LW2noWVEns3CAfzq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 12:20:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<UcM7smVE4I0vTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 25 12:23:33 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<sH8AvWVEfIksyhQX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 12:27:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<4kSlyWVE0NUv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 12:28:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<A1HozmVENMt2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-25 12:34:05 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:57318: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-25 12:33:58 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:33494: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-11-25 12:41:53 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:40974: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.3.11.128
country_id: 6252001
description:
2025-11-25 12:42:19 dovecot_login authenticator failed for 160-3-11-128.cpe.sparklight.net [160.3.11.128]:42808: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.18.200.242
country_id: 6252001
description:
2025-11-25 12:42:32 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:41684: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 12:43:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<eWcSBGZE7kAvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 12:49:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<kdDrGWZE0qMv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 12:52:32 host2 sshd[2317964]: Disconnected from invalid user admin 2.57.121.112 port 59809 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Nov 25 12:54:41 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.92, session=<t/ZWLGZEIKgDWgzA>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 12:58:31 host2 sshd[2321971]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 12:59:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<87eFPGZE7LB2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 13:06:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<H7GlVmZEeD8vTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 13:08:03 host2 sshd[2328011]: Disconnected from invalid user user 2.57.121.25 port 47948 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 13:12:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<dSriamZEdsQv7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.145
country_id: 6252001
description:
Nov 25 13:19:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.145, lip=66.85.158.91, session=<O4RHhmZEZJgUQGmR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.67.177.206
country_id: 6252001
description:
Nov 25 13:21:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.67.177.206, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uZWzimZEGLsoQ7HO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.55.198
country_id: 953987
description:
Nov 25 13:20:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=102.129.55.198, lip=66.85.158.91, TLS, session=<4Ccnh2ZEvNpmgTfG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.128
country_id: 798544
description:
Nov 25 13:20:42 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.125.247.128, lip=66.85.158.91, TLS, session=<GnpmiGZEApNtffeA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2025-11-25 13:24:34 dovecot_login authenticator failed for (187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:36893: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-25 13:24:43 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:45878: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov 25 13:25:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.91, session=<ADDZm2ZEYv/CpRCn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Nov 25 13:26:05 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, session=<ytqnnGZE6GlAPpx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.122
country_id: 6252001
description:
Nov 25 13:26:18 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.122, lip=66.85.158.92, TLS: Connection closed, session=<BLFlnWZE2h5APpx6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.3.40
country_id: 1819730
description:
Nov 25 13:26:26 host2 sshd[2340532]: Disconnected from invalid user huawei 103.144.3.40 port 37996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Nov 25 13:27:03 host2 sshd[2340937]: Disconnected from invalid user backend 45.197.145.10 port 40038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.218
country_id: 1880251
description:
Nov 25 13:27:42 host2 sshd[2341386]: Disconnected from invalid user alex 101.47.140.218 port 41920 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 13:28:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<WMq/pmZENrR2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Nov 25 13:29:36 host2 sshd[2342877]: Disconnected from invalid user bot 45.197.145.10 port 54054 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 13:29:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<JQdLqWZEphgvTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.144.3.40
country_id: 1819730
description:
Nov 25 13:30:14 host2 sshd[2343616]: Disconnected from invalid user test 103.144.3.40 port 46500 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Nov 25 13:31:08 host2 sshd[2344276]: Disconnected from invalid user admin 45.197.145.10 port 57182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.3.40
country_id: 1819730
description:
Nov 25 13:31:22 host2 sshd[2344439]: Disconnected from invalid user local 103.144.3.40 port 41190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.225.212.188
country_id: 1269750
description:
Nov 25 13:31:27 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=43.225.212.188, lip=66.85.158.91, TLS, session=<Yf2wrmZEP70r4dS8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.233
country_id: 2510769
description:
Nov 25 13:31:45 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=139.28.190.233, lip=66.85.158.91, TLS, session=<z1Lnr2ZEadSLHL7p>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-11-25 13:32:23 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:50580: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.144.3.40
country_id: 1819730
description:
Nov 25 13:32:29 host2 sshd[2345186]: Disconnected from invalid user victor 103.144.3.40 port 56482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.197.145.10
country_id: 1819730
description:
Nov 25 13:32:36 host2 sshd[2345250]: Disconnected from invalid user elemental 45.197.145.10 port 60202 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-25 13:32:56 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:43963: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.197.145.10
country_id: 1819730
description:
Nov 25 13:34:01 host2 sshd[2346381]: Disconnected from invalid user usuario2 45.197.145.10 port 34996 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 13:34:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 4 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<J5Q1uWZEOKEv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-25 13:36:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53693: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 25 13:36:40 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, session=<spB2wmZEQMo2xDDo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.218
country_id: 1880251
description:
Nov 25 13:38:51 host2 sshd[2349906]: Disconnected from invalid user node 101.47.140.218 port 41494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 13:41:05 host2 sshd[2352006]: Disconnected from invalid user user 2.57.121.25 port 18855 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 13:41:22 host2 sshd[2352287]: Disconnected from invalid user keanu 62.60.131.157 port 5701 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.140.218
country_id: 1880251
description:
Nov 25 13:43:57 host2 sshd[2354048]: Disconnected from invalid user temp 101.47.140.218 port 53258 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.92.247.172
country_id: 3469034
description:
Nov 25 13:47:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.92.247.172, lip=66.85.158.91, TLS, session=<z8nl5mZEuOaxXPes>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.209.75
country_id: 933860
description:
Nov 25 13:46:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=41.216.209.75, lip=66.85.158.91, TLS, session=<DoAF5WZE/+cp2NFL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.174
country_id: 6252001
description:
Nov 25 13:49:36 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.174, lip=66.85.158.92, TLS, session=<qILD8GZEFPWTuYSu>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.105.67.139
country_id: 3865483
description:
Nov 25 13:51:22 host2 sshd[2360696]: Disconnected from invalid user cumulus 181.105.67.139 port 32862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 13:52:47 host2 sshd[2361892]: Disconnected from invalid user  2.57.121.112 port 62365 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 13:52:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Gpsi/GZE4E0vTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.128.77.56
country_id: 1643084
description:
Nov 25 13:54:18 host2 sshd[2363138]: Disconnected from invalid user tony 34.128.77.56 port 52000 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.168.253
country_id: 6252001
description:
Nov 25 13:54:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() syscall failed: Invalid argument (no auth attempts in 0 secs): user=<>, rip=40.124.168.253, lip=66.85.158.91, TLS handshaking: SSL_accept() syscall failed: Invalid argument, session=<bJGcAmdExM8ofKj9>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.105.67.139
country_id: 3865483
description:
Nov 25 13:54:38 host2 sshd[2363839]: Disconnected from invalid user desliga 181.105.67.139 port 56924 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 13:56:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<+KPWB2dEhOcv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.128.77.56
country_id: 1643084
description:
Nov 25 13:56:53 host2 sshd[2365727]: Disconnected from invalid user info 34.128.77.56 port 40106 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.128.77.56
country_id: 1643084
description:
Nov 25 13:58:11 host2 sshd[2366629]: Disconnected from invalid user packer 34.128.77.56 port 44350 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 13:58:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<n2YPEGdEwp92wSaf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.162.254
country_id: 6252001
description:
Nov 25 13:59:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.235.162.254, lip=66.85.158.92, session=<H3PGE2dE+N5K66L+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.128.77.56
country_id: 1643084
description:
Nov 25 13:59:33 host2 sshd[2367581]: Disconnected from invalid user packer 34.128.77.56 port 44788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.105.67.139
country_id: 3865483
description:
Nov 25 14:00:13 host2 sshd[2368232]: Disconnected from invalid user packer 181.105.67.139 port 56876 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 14:01:28 host2 sshd[2369133]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.52.70
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 197.211.52.70 - dmch@fhb.health.gov.lk "GET /login/?user=dmch@fhb.health.gov.lk HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.52.70
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 197.211.52.70 - dmch@fhb.health.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.155
country_id: 3175395
description:
Nov 25 14:08:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=185.15.171.155, lip=66.85.158.91, TLS, session=<mtW1NGdENua5D6ub>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.38
country_id: 953987
description:
Nov 25 14:09:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=102.64.34.38, lip=66.85.158.91, TLS, session=<tp/qNWdESqJmQCIm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.4
country_id: 6252001
description:
Nov 25 14:13:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.230.168.4, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<EuwMRWdElcVb5qgE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.230.168.8
country_id: 6252001
description:
Nov 25 14:13:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.230.168.8, lip=66.85.158.92, TLS: Connection closed, session=<PW87RWdEDZpb5qgI>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Nov 25 14:14:26 host2 sshd[2380059]: Disconnected from invalid user appuser 152.32.144.167 port 33142 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 14:16:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<pWsST2dEOuovTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Nov 25 14:17:54 host2 sshd[2382854]: Disconnected from invalid user spark 152.32.144.167 port 45138 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 14:18:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<sO4JV2dE7pov7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.144.167
country_id: 1861060
description:
Nov 25 14:19:22 host2 sshd[2384004]: Disconnected from invalid user bkp 152.32.144.167 port 54434 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.228
country_id: 6252001
description:
Nov 25 14:23:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.228, lip=66.85.158.91, TLS, session=<ILxdaGdEcPXG6xjk>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 173.214.170.109
country_id: 6252001
description:
Nov 25 14:22:29 host2 sshd[2386646]: Disconnected from invalid user local 173.214.170.109 port 56314 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.144.167
country_id: 1861060
description:
Nov 25 14:23:28 host2 sshd[2387385]: Disconnected from invalid user mapr 152.32.144.167 port 60704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 14:23:49 host2 sshd[2387674]: Disconnected from invalid user user 2.57.121.25 port 51560 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.59.87
country_id: 1269750
description:
2025-11-25 14:24:00 dovecot_login authenticator failed for (abts-north-static-087.59.160.122.airtelbroadband.in) [122.160.59.87]:47550: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.162
country_id: 1733045
description:
2025-11-25 14:24:27 dovecot_login authenticator failed for ([49.124.155.162]) [49.124.155.162]:35640: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 173.214.170.109
country_id: 6252001
description:
Nov 25 14:26:11 host2 sshd[2389650]: Disconnected from invalid user spark 173.214.170.109 port 56260 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 14:27:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<1fjwd2dEDuN2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 173.214.170.109
country_id: 6252001
description:
Nov 25 14:28:31 host2 sshd[2391901]: Disconnected from invalid user support 173.214.170.109 port 55658 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 173.214.170.109
country_id: 6252001
description:
Nov 25 14:29:38 host2 sshd[2392738]: Disconnected from invalid user testing 173.214.170.109 port 33156 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 25 14:35:01 host2 pure-ftpd[2397039]: (?@66.132.153.114) [INFO] New connection from 66.132.153.114


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2025-11-25 14:39:23 dovecot_login authenticator failed for 40.ip-217-182-65.eu [217.182.65.40]:51496: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 14:39:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<e00Zo2dEWIIvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 14:40:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<BOe8pmdEEJEv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.127
country_id: 953987
description:
Nov 25 14:42:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@weeratrading.com>, method=PLAIN, rip=102.64.34.127, lip=66.85.158.91, TLS, session=<BIssrGdEj8hmQCJ/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.105
country_id: 3469034
description:
Nov 25 14:42:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=186.209.247.105, lip=66.85.158.91, TLS, session=<ou5UrmdEZpu60fdp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 14:43:36 host2 sshd[2404479]: Disconnected from invalid user  2.57.121.112 port 62762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 25 14:45:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<N07+tmdEGOkzTd4Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Nov 25 14:48:57 host2 sshd[2408435]: Disconnected from invalid user alma 118.193.38.207 port 50706 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 14:53:34 host2 sshd[2412297]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.202
country_id: 3017382
description:
Nov 25 14:55:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.202, lip=66.85.158.92, TLS: Connection closed, session=<s6HQ2mdEhYpb51nK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.205
country_id: 3017382
description:
Nov 25 14:54:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.205, lip=66.85.158.92, TLS handshaking: Connection closed, session=<iWhF2WdEI4hb51nN>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.129.246.55
country_id: 1819730
description:
Nov 25 14:55:41 host2 sshd[2414817]: Disconnected from invalid user desliga 43.129.246.55 port 56986 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.38.207
country_id: 1819730
description:
Nov 25 14:55:43 host2 sshd[2414863]: Disconnected from invalid user server 118.193.38.207 port 36744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 14:56:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<ldL24GdETMl2wSaf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Nov 25 14:56:55 host2 sshd[2415619]: Disconnected from invalid user webuser 118.193.38.207 port 60190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.207
country_id: 1819730
description:
Nov 25 14:58:08 host2 sshd[2416604]: Disconnected from invalid user fred 118.193.38.207 port 48440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.184.18.172
country_id: 130758
description:
Nov 25 14:57:32 host2 sshd[2416041]: Disconnected from invalid user john 94.184.18.172 port 34394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Nov 25 14:58:40 host2 sshd[2417000]: Disconnected from invalid user temp 206.189.130.118 port 54662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 25 14:59:42 host2 sshd[2418003]: Disconnected from invalid user supermaint 132.145.213.106 port 56048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.129.246.55
country_id: 1819730
description:
Nov 25 14:59:48 host2 sshd[2418103]: Disconnected from invalid user dangulo 43.129.246.55 port 58762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Nov 25 15:00:14 host2 sshd[2418702]: Disconnected from invalid user john 206.189.130.118 port 33100 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.184.18.172
country_id: 130758
description:
Nov 25 15:00:19 host2 sshd[2418794]: Disconnected from invalid user userb 94.184.18.172 port 59910 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.189.130.118
country_id: 1269750
description:
Nov 25 15:01:38 host2 sshd[2419724]: Disconnected from invalid user client 206.189.130.118 port 48062 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 25 15:01:16 host2 sshd[2419510]: Disconnected from invalid user marvin 132.145.213.106 port 59466 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 15:03:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<vIJ2+GdEbAYvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.129.246.55
country_id: 1819730
description:
Nov 25 15:03:31 host2 sshd[2421355]: Disconnected from invalid user valheim 43.129.246.55 port 57586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.184.18.172
country_id: 130758
description:
Nov 25 15:04:07 host2 sshd[2421921]: Disconnected from invalid user seafile 94.184.18.172 port 34134 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 15:03:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<hsdT+GdE9rEv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.189.130.118
country_id: 1269750
description:
Nov 25 15:04:25 host2 sshd[2422236]: Disconnected from invalid user victor 206.189.130.118 port 44768 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.53
country_id: 933860
description:
Nov 25 15:04:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=41.216.213.53, lip=66.85.158.91, TLS, session=<CN3P+2dEWpQp2NU1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.204
country_id: 953987
description:
Nov 25 15:04:58 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=102.129.56.204, lip=66.85.158.91, TLS, session=<vNos/WdEI8JmgTjM>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.200.182
country_id: 6251999
description:
Nov 25 15:05:22 host2 pure-ftpd[2423083]: (?@128.203.200.182) [INFO] New connection from 128.203.200.182


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Nov 25 15:06:31 host2 sshd[2423859]: Disconnected from invalid user dmdba 132.145.213.106 port 40080 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.184.18.172
country_id: 130758
description:
Nov 25 15:07:40 host2 sshd[2424777]: Disconnected from invalid user g 94.184.18.172 port 46426 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 25 15:08:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<DJHWCWhEsIozTd4Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.168.127.166
country_id: 1269750
description:
2025-11-25 15:09:57 dovecot_login authenticator failed for (abts-mp-static-166.127.168.122.airtelbroadband.in) [122.168.127.166]:41499: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-25 15:10:14 dovecot_login authenticator failed for ([200.148.171.233]) [189.56.0.19]:44115: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.246.15.94
country_id: 1819730
description:
Nov 25 15:14:31 host2 sshd[2430443]: Disconnected from invalid user solr 119.246.15.94 port 59149 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.246.15.94
country_id: 1819730
description:
Nov 25 15:16:57 host2 sshd[2432289]: Disconnected from invalid user tomcat 119.246.15.94 port 57484 [preauth]


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 197.146.22.230
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 197.146.22.230 - cloudtourssrilan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.146.22.230
country_id: 2542007
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 197.146.22.230 - info "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.246.15.94
country_id: 1819730
description:
Nov 25 15:24:13 host2 sshd[2438222]: Disconnected from invalid user admin1234 119.246.15.94 port 35241 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 15:26:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<K4kwS2hEJoQv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 15:26:43 host2 sshd[2440949]: Disconnected from invalid user kenyon 62.60.131.157 port 6215 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 25 15:27:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<pcZhTWhESMkzTd4Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 25 15:26:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@askinternationalconsortium.com>, method=PLAIN, rip=118.193.38.159, lip=66.85.158.91, session=<KArCSmhEztZ2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 15:27:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<7y+LT2hE1rgvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-11-25 15:29:02 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:47744: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-11-25 15:28:20 dovecot_login authenticator failed for (syn-024-104-225-201.res.spectrum.com) [24.104.225.201]:37547: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.246.15.94
country_id: 1819730
description:
Nov 25 15:31:42 host2 sshd[2444880]: Disconnected from invalid user admin 119.246.15.94 port 60699 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 25 15:31:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<OIxUXmhEBIQzTd4Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-11-25 15:34:24 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:41508: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-11-25 15:34:46 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:50884: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.0.0.46
country_id: 3469034
description:
Nov 25 15:37:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=143.0.0.46, lip=66.85.158.91, TLS, session=<0t7ecmhEMquPAAAu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.112.99.25
country_id: 3175395
description:
Nov 25 15:38:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.112.99.25, lip=66.85.158.91, TLS, session=<7cALdGhEBYTZcGMZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.159
country_id: 6252001
description:
Nov 25 15:44:30 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (disconnected before auth was ready, waited 0 secs): user=<>, rip=20.65.193.159, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CICri2hEAocUQcGf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.69.56.44
country_id: 1694008
description:
Nov 25 15:47:32 host2 sshd[2458161]: Disconnected from invalid user mark 58.69.56.44 port 50446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Nov 25 15:49:22 host2 sshd[2459632]: Disconnected from invalid user db2fenc1 181.188.172.6 port 56116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 15:50:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<C+R8n2hEprgv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 15:50:35 host2 sshd[2460676]: Disconnected from invalid user  2.57.121.112 port 62208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Nov 25 15:50:59 host2 sshd[2460906]: Disconnected from invalid user alice 181.188.172.6 port 54931 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.69.56.44
country_id: 1694008
description:
Nov 25 15:50:22 host2 sshd[2460507]: Disconnected from invalid user testuser 58.69.56.44 port 49012 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 25 15:50:34 host2 sshd[2460661]: Disconnected from invalid user tomcat 9.223.176.221 port 49900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 15:52:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<MHzYpmhExBgvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Nov 25 15:51:40 host2 sshd[2461569]: Disconnected from invalid user testftp 70.65.44.183 port 46390 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Nov 25 15:52:10 host2 sshd[2462098]: Disconnected from invalid user saas 27.254.137.144 port 37136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 25 15:52:32 host2 sshd[2462328]: Disconnected from invalid user root1 9.223.176.221 port 34966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.188.172.6
country_id: 3923057
description:
Nov 25 15:52:33 host2 sshd[2462364]: Disconnected from invalid user postgres 181.188.172.6 port 53752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 25 15:54:13 host2 sshd[2464146]: Disconnected from invalid user devuser 9.223.176.221 port 40858 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Nov 25 15:54:54 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, session=<jpjVsGhEjI82rEyT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Nov 25 15:55:17 host2 sshd[2465570]: Disconnected from invalid user bitnami 70.65.44.183 port 46644 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 25 15:55:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<0lcrsmhEfqAzTd4Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.245.4
country_id: 2921044
description:
Nov 25 15:55:27 host2 sshd[2465691]: Disconnected from invalid user share 91.108.245.4 port 55942 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Nov 25 15:55:57 host2 sshd[2466189]: Disconnected from invalid user dmdba 27.254.137.144 port 39596 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 15:56:26 host2 sshd[2466922]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.245.4
country_id: 2921044
description:
Nov 25 15:56:36 host2 sshd[2467097]: Disconnected from invalid user stperez 91.108.245.4 port 60266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.6
country_id: 226074
description:
Nov 25 15:57:04 host2 sshd[2467729]: Disconnected from invalid user radarr 196.0.120.6 port 41946 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.108.245.4
country_id: 2921044
description:
Nov 25 15:57:39 host2 sshd[2468335]: Disconnected from invalid user runner 91.108.245.4 port 54102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Nov 25 15:57:43 host2 sshd[2468409]: Disconnected from invalid user mailuser 70.65.44.183 port 46924 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Nov 25 15:57:44 host2 sshd[2468412]: Disconnected from invalid user vlad 103.55.36.22 port 59278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.245.4
country_id: 2921044
description:
Nov 25 15:58:40 host2 sshd[2469407]: Disconnected from invalid user testadmin 91.108.245.4 port 46828 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 70.65.44.183
country_id: 6251999
description:
Nov 25 15:58:51 host2 sshd[2469710]: Disconnected from invalid user ftpadmin 70.65.44.183 port 47068 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.97.180.94
country_id: 3469034
description:
Nov 25 16:00:05 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=138.97.180.94, lip=66.85.158.91, TLS, session=<2lFXwmhEda2KYbRe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.55.36.22
country_id: 1643084
description:
Nov 25 15:59:34 host2 sshd[2470384]: Disconnected from invalid user autcom 103.55.36.22 port 41590 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Nov 25 15:59:47 host2 sshd[2470564]: Disconnected from invalid user bitnami 27.254.137.144 port 35376 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.224.86
country_id: 3865483
description:
Nov 25 16:00:26 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=186.1.224.86, lip=66.85.158.91, TLS, session=<XQiIw2hEhIy6AeBW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.6
country_id: 226074
description:
Nov 25 16:00:35 host2 sshd[2471484]: Disconnected from invalid user shree 196.0.120.6 port 52828 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 9.223.176.221
country_id: 2661886
description:
Nov 25 16:00:38 host2 sshd[2471534]: Disconnected from invalid user a 9.223.176.221 port 60308 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.137.144
country_id: 1605651
description:
Nov 25 16:01:08 host2 sshd[2472069]: Disconnected from invalid user user 27.254.137.144 port 57512 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.55.36.22
country_id: 1643084
description:
Nov 25 16:01:30 host2 sshd[2472436]: Disconnected from invalid user maarch 103.55.36.22 port 52330 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.207.181
country_id: 6252001
description:
Nov 25 16:03:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.207.181, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<2qWkz2hEaNYtT8+1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.109.8
country_id: 6252001
description:
Nov 25 16:04:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=45.33.109.8, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<48Ya0mhE7KQtIW0I>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.234.217.129
country_id: 6252001
description:
Nov 25 16:09:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.234.217.129, lip=66.85.158.92, TLS, session=<akJW5WhEoiSs6tmB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov 25 16:09:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<wjdO5mhESsfUZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-25 16:11:45 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:49208: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov 25 16:12:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<dV+C7mhEwN3UZija>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-25 16:11:38 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:48308: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 16:14:19 host2 sshd[2485785]: Disconnected from invalid user user 2.57.121.25 port 42934 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 16:15:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<wPeA+mhE6uMvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 25 16:17:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=</u+6AGlE0LySOC+J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.69
country_id: 6252001
description:
Nov 25 16:17:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.69, lip=66.85.158.92, session=</L4tAWlE9p5BMRRF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 25 16:18:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<n6+OA2lEkMMzTd4Y>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.14.94.46
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 86.14.94.46 - isuru "GET /login/?login_only=1&user=isuru&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user isuru (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.96.179.183
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.96.179.183 - euroentertainmentlkcom "GET /login/?login_only=1&user=euroentertainmentlkcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainmentlkcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.160.101
country_id: 2921044
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 146.70.160.101 - euroentertainme "GET /login/?login_only=1&user=euroentertainme&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertainme (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.241.68.219
country_id: 2802361
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 81.241.68.219 - euroente "GET /login/?login_only=1&user=euroente&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroente (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.14.94.46
country_id: 2635167
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 86.14.94.46 - euroenter "GET /login/?login_only=1&user=euroenter&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroenter (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.97.206.228
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.97.206.228 - euroent8 "GET /login/?login_only=1&user=euroent8&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroent8 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.96.179.183
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.96.179.183 - euroentertai "GET /login/?login_only=1&user=euroentertai&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroentertai (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.218
country_id: 6252001
description:
Nov 25 16:22:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=172.236.228.218, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<8XwHFWlEID2s7OTa>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.97.206.228
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.97.206.228 - euroen10 "GET /login/?login_only=1&user=euroen10&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user euroen10 (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov 25 16:24:01 host2 sshd[2495269]: Disconnected from invalid user cgpexpert 196.204.240.61 port 56358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.1.224.40
country_id: 3865483
description:
Nov 25 16:27:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=186.1.224.40, lip=66.85.158.91, TLS, session=<Wpy+ImlE6Mu6AeAo>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.187.28.56
country_id: 1861060
description:
Nov 25 16:26:30 host2 sshd[2497728]: Disconnected from invalid user localhost 89.187.28.56 port 33762 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.218
country_id: 798544
description:
Nov 25 16:27:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=109.125.247.218, lip=66.85.158.91, TLS, session=<FVGVJGlErp5tfffa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.187.28.56
country_id: 1861060
description:
Nov 25 16:27:53 host2 sshd[2499064]: Disconnected from invalid user intel 89.187.28.56 port 40232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov 25 16:27:57 host2 sshd[2499111]: Disconnected from invalid user botuser 152.32.201.226 port 28324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.153
country_id: 1269750
description:
2025-11-25 16:28:29 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.153]:49700: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.16.91
country_id: 1880251
description:
2025-11-25 16:28:52 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:60100: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov 25 16:30:04 host2 sshd[2501263]: Disconnected from invalid user minecraft 196.204.240.61 port 37816 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.187.28.56
country_id: 1861060
description:
Nov 25 16:30:27 host2 sshd[2501742]: Disconnected from invalid user tuan 89.187.28.56 port 40472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.204.240.61
country_id: 357994
description:
Nov 25 16:31:15 host2 sshd[2502472]: Disconnected from invalid user valheim 196.204.240.61 port 57524 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.110.166.67
country_id: 1694008
description:
Nov 25 16:31:35 host2 sshd[2502803]: Disconnected from invalid user marvin 27.110.166.67 port 37662 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.175.118.185
country_id: 2510769
description:
Nov 25 16:31:38 host2 sshd[2502846]: Disconnected from invalid user mcserver 34.175.118.185 port 38900 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.204.240.61
country_id: 357994
description:
Nov 25 16:32:27 host2 sshd[2503872]: Disconnected from invalid user frontend 196.204.240.61 port 59800 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.175.118.185
country_id: 2510769
description:
Nov 25 16:33:44 host2 sshd[2505144]: Disconnected from invalid user test 34.175.118.185 port 45124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov 25 16:34:36 host2 sshd[2505954]: Disconnected from invalid user astra 152.32.201.226 port 23588 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.175.118.185
country_id: 2510769
description:
Nov 25 16:35:06 host2 sshd[2506627]: Disconnected from invalid user halo 34.175.118.185 port 44122 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 16:35:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<S9OSQGlEOKsv7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.175.213.4
country_id: 6252001
description:
Nov 25 16:35:09 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.175.213.4, lip=66.85.158.91, TLS, session=<mBHEQGlEqCZCr9UE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov 25 16:37:08 host2 sshd[2508877]: Disconnected from invalid user cgpexpert 152.32.201.226 port 23378 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 16:36:11 host2 sshd[2507767]: Disconnected from invalid user admin 2.57.121.112 port 23791 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.110.166.67
country_id: 1694008
description:
Nov 25 16:36:12 host2 sshd[2507804]: Disconnected from invalid user testadmin 27.110.166.67 port 45100 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.175.118.185
country_id: 2510769
description:
Nov 25 16:36:27 host2 sshd[2508035]: Disconnected from invalid user localhost 34.175.118.185 port 43114 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 25 16:38:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@agronatureholdings.com>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<LCYiTWlENo0zTd4Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.216
country_id: 1880251
description:
Nov 25 16:38:18 host2 sshd[2509481]: Disconnected from invalid user localhost 101.47.140.216 port 38382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.201.226
country_id: 1861060
description:
Nov 25 16:38:23 host2 sshd[2510169]: Disconnected from invalid user azureuser 152.32.201.226 port 50766 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 25 16:39:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<orders@bostonlanka.com>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<HKYiUGlE5sszTd4Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 16:39:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<FUUYT2lE5mUvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.110.166.67
country_id: 1694008
description:
Nov 25 16:41:04 host2 sshd[2513432]: Disconnected from invalid user devops 27.110.166.67 port 52596 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 16:40:19 host2 sshd[2512623]: Disconnected from invalid user breanne 62.60.131.157 port 32976 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 25 16:40:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<rPxsU2lEKLEDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.222.24
country_id: 3017382
description:
Nov 25 16:40:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=51.77.222.24, lip=66.85.158.91, session=<HTCKVWlEIJozTd4Y>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 16:41:10 host2 sshd[2513532]: Disconnected from invalid user  2.57.121.112 port 61913 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 18.222.201.82
country_id: 6252001
description:
Nov 25 16:42:31 host2 pure-ftpd[2515056]: (?@18.222.201.82) [INFO] New connection from 18.222.201.82


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.222.201.82
country_id: 6252001
description:
Nov 25 16:42:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=18.222.201.82, lip=66.85.158.91, session=<6gYgW2lEaucS3slS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.216
country_id: 1880251
description:
Nov 25 16:42:38 host2 sshd[2515141]: Disconnected from invalid user halo 101.47.140.216 port 56224 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.110.166.67
country_id: 1694008
description:
Nov 25 16:42:40 host2 sshd[2515178]: Disconnected from invalid user supermaint 27.110.166.67 port 55088 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 25 16:43:02 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<Q+v4XGlE3pcDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 25 16:43:29 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<DtiRXmlEFqoDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 25 16:44:38 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<EJmxYmlEDNEDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 25 16:46:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<kn4RaGlEjugDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 25 16:46:36 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, session=<ZqvDaWlEINUDhBfJ>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 25 16:47:16 host2 dovecot[3107204]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<dYcYbGlEOMgDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.216
country_id: 1880251
description:
Nov 25 16:47:25 host2 sshd[2521040]: Disconnected from invalid user taibabi 101.47.140.216 port 41872 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 16:48:35 host2 sshd[2522233]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.52.194
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 197.211.52.194 - dmch@fhb.health.gov.lk "GET /login/?user=dmch@fhb.health.gov.lk HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 25 16:49:38 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, session=<LN6UdGlECIMDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 16:51:09 host2 sshd[2525037]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.58
country_id: 1819730
description:
2025-11-25 16:53:05 dovecot_login authenticator failed for 058.151.48.116.static.netvigator.com [116.48.151.58]:58849: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-25 16:53:22 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:42690: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-25 16:53:36 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:56464: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-11-25 16:53:52 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:44782: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 25 16:54:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5HLfhGlEUI8DlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 25 16:55:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Sm3QiGlETtYDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 25 16:56:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, TLS handshaking: Connection closed, session=<6cf+i2lE+LsDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.64
country_id: 1819730
description:
Nov 25 16:57:40 host2 sshd[2532531]: Disconnected from invalid user postgres 123.58.212.64 port 49760 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 16:57:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<7goskmlE7tsv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 16:59:05 host2 sshd[2534138]: Disconnected from invalid user user 2.57.121.25 port 27017 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.64
country_id: 1819730
description:
Nov 25 17:01:48 host2 sshd[2537037]: Disconnected from invalid user vtatis 123.58.212.64 port 49876 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov 25 17:02:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<fo44o2lEaC5ChJl+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 17:03:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<3ofCpGlEiPAvTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.58.212.64
country_id: 1819730
description:
Nov 25 17:05:49 host2 sshd[2541895]: Disconnected from invalid user stperez 123.58.212.64 port 55402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 17:07:14 host2 sshd[2543353]: Disconnected from invalid user admin 2.57.121.112 port 6044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.212.64
country_id: 1819730
description:
Nov 25 17:08:17 host2 sshd[2544459]: Disconnected from invalid user builder 123.58.212.64 port 57694 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.210
country_id: 3175395
description:
Nov 25 17:19:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=194.60.212.210, lip=66.85.158.91, TLS, session=</y/B3WlEtJLCPNTS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.31.95.72
country_id: 798544
description:
Nov 25 17:19:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=78.31.95.72, lip=66.85.158.91, TLS, session=<8QbU3mlEz7hOH19I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 17:21:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<5/JS5WlEGNMv7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.166.179.34
country_id: 1880251
description:
Nov 25 17:24:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<env_eng>, method=PLAIN, rip=188.166.179.34, lip=66.85.158.91, TLS, session=<enVz8WlEtsm8prMi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.229.36
country_id: 1269750
description:
Nov 25 17:24:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 26 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=122.187.229.36, lip=66.85.158.91, TLS, session=<B6zD72lEq4J6u+Uk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 17:27:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<+59G+2lEGKsvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.73.88
country_id: 2635167
description:
Nov 25 17:36:06 host2 sshd[2571446]: Disconnected from invalid user toto 46.101.73.88 port 34642 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.107.234
country_id: 226074
description:
Nov 25 17:36:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=196.0.107.234, lip=66.85.158.91, TLS, session=<ocOyGWpEwr7EAGvq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.63.173
country_id: 953987
description:
Nov 25 17:35:45 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=102.129.63.173, lip=66.85.158.91, TLS, session=<vpBXGGpEsNNmgT+t>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.226.87
country_id: 3017382
description:
Nov 25 17:37:15 host2 sshd[2572698]: Disconnected from invalid user toto 51.68.226.87 port 33928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.73.88
country_id: 2635167
description:
Nov 25 17:38:50 host2 sshd[2574282]: Disconnected from invalid user huawei 46.101.73.88 port 46170 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.34.41
country_id: 3865483
description:
Nov 25 17:40:05 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=45.227.34.41, lip=66.85.158.91, TLS, session=<WzvZJ2pEodct4yIp>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.226.87
country_id: 3017382
description:
Nov 25 17:39:29 host2 sshd[2575047]: Disconnected from invalid user huawei 51.68.226.87 port 48708 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.174
country_id: 798544
description:
Nov 25 17:39:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@weeratrading.com>, method=PLAIN, rip=128.127.94.174, lip=66.85.158.91, TLS, session=<9OS3JmpEA52Af16u>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.73.88
country_id: 2635167
description:
Nov 25 17:39:57 host2 sshd[2575476]: Disconnected from invalid user jrodrig 46.101.73.88 port 37188 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Nov 25 17:40:22 host2 sshd[2576030]: Disconnected from invalid user userb 107.150.104.184 port 56136 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-25 17:41:19 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (halitatory) [71.62.34.216]:37802: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.226.87
country_id: 3017382
description:
Nov 25 17:41:51 host2 sshd[2577662]: Disconnected from invalid user jmarquez 51.68.226.87 port 53264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.73.88
country_id: 2635167
description:
Nov 25 17:42:10 host2 sshd[2578066]: Disconnected from invalid user oracle 46.101.73.88 port 54482 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.226.87
country_id: 3017382
description:
Nov 25 17:44:18 host2 sshd[2579990]: Disconnected from invalid user jenkins 51.68.226.87 port 57834 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 17:44:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<FOAuOWpEAu0v7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 25 17:49:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<osQBSWpE6NsDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 17:49:44 host2 sshd[2587045]: Disconnected from invalid user admin 2.57.121.112 port 34039 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-25 17:49:59 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:50201: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Nov 25 17:49:30 host2 sshd[2586840]: Disconnected from invalid user oracle 107.150.104.184 port 36746 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 25 17:49:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<vn8RS2pEKIcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 25 17:50:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<6RVgT2pEjLsDgmBb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 17:51:40 host2 sshd[2589372]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 17:51:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<FDWMUmpEZJAvTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.150.104.184
country_id: 6252001
description:
Nov 25 17:51:18 host2 sshd[2589029]: Disconnected from invalid user mc 107.150.104.184 port 32866 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 25 17:51:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<uh5cUWpEXrUDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-25 17:52:55 dovecot_login authenticator failed for (189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:41449: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.150.104.184
country_id: 6252001
description:
Nov 25 17:53:04 host2 sshd[2590699]: Disconnected from invalid user ahmed 107.150.104.184 port 57218 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 25 17:53:31 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<U5ATWWpEbKsDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 25 17:55:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<zUh3X2pEdNMDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-11-25 17:55:57 dovecot_login authenticator failed for ([125.23.235.136]) [128.185.252.110]:43940: 535 Incorrect authentication data (set_id=bostonlanka.com@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-11-25 17:56:37 dovecot_login authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:62752: 535 Incorrect authentication data (set_id=bostonlanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 25 17:56:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<quKkYmpEjrkDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 25 17:57:12 host2 sshd[2595195]: Disconnected from invalid user django 159.223.8.81 port 38848 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 25 17:58:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<6qsYaWpE/rIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 25 17:58:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<Gj0ta2pElo4DgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 25 17:58:19 host2 sshd[2596805]: Disconnected from invalid user casaos 159.223.8.81 port 51088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 25 17:59:22 host2 sshd[2598058]: Disconnected from invalid user bitwarden 159.223.8.81 port 46238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.225.201.50
country_id: 1269750
description:
Nov 25 18:00:00 host2 sshd[2598819]: Disconnected from invalid user manager 74.225.201.50 port 41034 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.45.118
country_id: 6252001
description:
Nov 25 18:00:11 host2 sshd[2599190]: Disconnected from invalid user user2 166.170.45.118 port 49957 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.223.8.81
country_id: 2750405
description:
Nov 25 18:00:25 host2 sshd[2599407]: Disconnected from invalid user vagrant 159.223.8.81 port 47478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.45.118
country_id: 6252001
description:
Nov 25 18:01:17 host2 sshd[2600568]: Disconnected from invalid user oracle 166.170.45.118 port 15157 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 74.225.201.50
country_id: 1269750
description:
Nov 25 18:01:33 host2 sshd[2600745]: Disconnected from invalid user debianuser 74.225.201.50 port 41190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.225.201.50
country_id: 1269750
description:
Nov 25 18:03:14 host2 sshd[2603226]: Disconnected from invalid user frappe 74.225.201.50 port 45194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.170.45.118
country_id: 6252001
description:
Nov 25 18:03:23 host2 sshd[2603540]: Disconnected from invalid user tecnopos 166.170.45.118 port 44335 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov 25 18:06:05 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS: Connection closed, session=<drsEhmpEwL1ChJl1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov 25 18:06:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<R4xThmpEKj1ChJl1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 18:08:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<hBapjmpEcLYv7bxd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.79.200.193
country_id: 2802361
description:
Nov 25 18:13:30 host2 pure-ftpd[2613904]: (?@34.79.200.193) [INFO] New connection from 34.79.200.193


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 18:16:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<op6zq2pEONsvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 18:16:59 host2 sshd[2617235]: Disconnected from invalid user user 2.57.121.25 port 25332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.219.81.129
country_id: 1880251
description:
Nov 25 18:17:47 host2 sshd[2617912]: Disconnected from invalid user blue 8.219.81.129 port 53310 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.224.32.138
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 68.224.32.138 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.228.242.57
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.228.242.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.17.41.31
country_id: 3437598
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.17.41.31 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.41.187.158
country_id: 3625428
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 154.41.187.158 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.202.98.20
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 112.202.98.20 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.70.164.243
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.70.164.243 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 18:20:39 host2 sshd[2621046]: Disconnected from invalid user admin 2.57.121.112 port 53433 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.3.203
country_id: 1269750
description:
Nov 25 18:22:06 host2 sshd[2622387]: Disconnected from invalid user sopuser 36.255.3.203 port 50479 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 36.255.3.203
country_id: 1269750
description:
Nov 25 18:26:27 host2 sshd[2626993]: Disconnected from invalid user gns3 36.255.3.203 port 42818 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.255.3.203
country_id: 1269750
description:
Nov 25 18:27:32 host2 sshd[2627974]: Disconnected from invalid user postgres 36.255.3.203 port 55018 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 25 18:28:17 host2 sshd[2628648]: Disconnected from invalid user laravel 186.237.143.246 port 50310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Nov 25 18:30:03 host2 sshd[2630408]: Disconnected from invalid user saas 182.93.7.194 port 35782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 25 18:31:32 host2 sshd[2631952]: Disconnected from invalid user ts1 186.237.143.246 port 43570 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 18:32:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<2aPk5WpEAsUv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 25 18:33:03 host2 sshd[2633790]: Disconnected from invalid user manager 186.237.143.246 port 46572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Nov 25 18:34:34 host2 sshd[2635168]: Disconnected from invalid user qwerty 27.254.152.90 port 42812 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 25 18:37:31 host2 sshd[2638207]: Disconnected from invalid user frappe 186.237.143.246 port 55560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 18:38:50 host2 sshd[2639473]: Disconnected from invalid user admin 2.57.121.112 port 61636 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.152.90
country_id: 1605651
description:
Nov 25 18:40:19 host2 sshd[2641235]: Disconnected from invalid user cinema 27.254.152.90 port 39084 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.237.143.246
country_id: 3469034
description:
Nov 25 18:40:31 host2 sshd[2641437]: Disconnected from invalid user django 186.237.143.246 port 33358 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 18:41:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<3yC3BWtE3tkvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Nov 25 18:41:55 host2 sshd[2642727]: Disconnected from invalid user retag 27.254.152.90 port 40708 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 18:44:06 host2 sshd[2645149]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.152.90
country_id: 1605651
description:
Nov 25 18:43:28 host2 sshd[2644575]: Disconnected from invalid user hu 27.254.152.90 port 42304 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 18:44:38 host2 sshd[2645723]: Disconnected from invalid user user 2.57.121.25 port 13374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.93.7.194
country_id: 1821275
description:
Nov 25 18:44:47 host2 sshd[2646030]: Disconnected from invalid user sopuser 182.93.7.194 port 62108 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.41.42
country_id: 2921044
description:
Nov 25 18:48:30 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.71.41.42, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<j5KvHWtEgYSnRykq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.22.187
country_id: 2921044
description:
Nov 25 18:49:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=104.248.22.187, lip=66.85.158.92, TLS handshaking: Connection closed, session=<JnbLH2tEjsFo+Ba7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.93.7.194
country_id: 1821275
description:
Nov 25 18:50:43 host2 sshd[2653184]: Disconnected from invalid user ftpadmin 182.93.7.194 port 64584 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.88.170.248
country_id: 1168579
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 111.88.170.248 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.104.86
country_id: 3175395
description:
Nov 25 18:55:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=185.208.104.86, lip=66.85.158.91, TLS, session=<6PNbNGtEScC50GhW>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.189.135.69
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 179.189.135.69 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.186.240.159
country_id: 1168579
description:
[2025-11-25 18:54:44 +0530] info [cpaneld] 182.186.240.159 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.230.137.125
country_id: 1605651
description:
[2025-11-25 18:54:50 +0530] info [cpaneld] 49.230.137.125 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.97.20.214
country_id: 3469034
description:
[2025-11-25 18:54:53 +0530] info [cpaneld] 138.97.20.214 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.51.69.26
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 50.51.69.26 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.58
country_id: 690791
description:
Nov 25 18:55:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=176.103.7.58, lip=66.85.158.91, TLS, session=<a8iINWtErrKwZwc6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Nov 25 18:56:25 host2 sshd[2660878]: Disconnected from invalid user opc 103.231.14.54 port 55332 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.177.94.124
country_id: 3017382
description:
Nov 25 18:58:09 host2 sshd[2662779]: Invalid user cloudtourssrilan_travel from 195.177.94.124 port 57083


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.177.94.124
country_id: 3017382
description:
[2025-11-25 18:58:10 +0530] info [cpaneld] 195.177.94.124 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 18:57:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<r7T7PWtEhOgv7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.231.14.54
country_id: 1819730
description:
Nov 25 18:59:15 host2 sshd[2663966]: Disconnected from invalid user devops 103.231.14.54 port 43024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.9.237.121
country_id: 6252001
description:
Nov 25 18:59:33 host2 sshd[2664277]: Disconnected from invalid user docker 192.9.237.121 port 41924 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.177.94.124
country_id: 3017382
description:
[2025-11-25 18:59:37 +0530] info [cpaneld] 195.177.94.124 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.177.94.124
country_id: 3017382
description:
Nov 25 18:59:36 host2 sshd[2664314]: Invalid user cloudtourssrilan_travel from 195.177.94.124 port 62298


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.231.14.54
country_id: 1819730
description:
Nov 25 19:00:40 host2 sshd[2665721]: Disconnected from invalid user maarch 103.231.14.54 port 40092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 19:02:49 host2 sshd[2667589]: Disconnected from invalid user admin 2.57.121.112 port 53418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Nov 25 19:04:48 host2 sshd[2669733]: Disconnected from invalid user user01 209.141.43.77 port 42146 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 19:07:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<iK69X2tEiocvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.43.77
country_id: 6252001
description:
Nov 25 19:07:26 host2 sshd[2672986]: Disconnected from invalid user roots 209.141.43.77 port 44988 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Nov 25 19:11:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.68, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ZpdbbmtEykvY2s5E>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.43.77
country_id: 6252001
description:
Nov 25 19:12:03 host2 sshd[2678510]: Disconnected from invalid user ubuntu 209.141.43.77 port 50672 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Nov 25 19:11:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.68, lip=66.85.158.92, TLS handshaking: Connection closed, session=<VyCbb2tEIjfY2s5E>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.9.237.121
country_id: 6252001
description:
Nov 25 19:11:32 host2 sshd[2677992]: Disconnected from invalid user bitwarden 192.9.237.121 port 41886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.246
country_id: 1880251
description:
Nov 25 19:13:45 host2 sshd[2680832]: Disconnected from invalid user roots 45.78.227.246 port 34562 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.203.84
country_id: 2921044
description:
Nov 25 19:14:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=209.38.203.84, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<JYehemtEcLDRJstU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.9.237.121
country_id: 6252001
description:
Nov 25 19:15:32 host2 sshd[2683379]: Disconnected from invalid user testftp 192.9.237.121 port 52422 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.9.237.121
country_id: 6252001
description:
Nov 25 19:17:31 host2 sshd[2685459]: Disconnected from invalid user dspace 192.9.237.121 port 47190 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.2.46.151
country_id: 1643084
description:
Nov 25 19:17:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=119.2.46.151, lip=66.85.158.91, TLS, session=<VSrUhGtE8Ld3Ai6X>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.168.129
country_id: 3469034
description:
Nov 25 19:17:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=177.130.168.129, lip=66.85.158.91, TLS, session=<uDYShmtEtICxgqiB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-11-25 19:18:09 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:50224: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.153
country_id: 1269750
description:
2025-11-25 19:18:53 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.153]:51438: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 19:21:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<Wfw6lWtEfKQv7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.92.254.53
country_id: 2921044
description:
Nov 25 19:23:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.92.254.53, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yicbmWtERLWkXP41>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-25 19:26:35 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:60720: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.232
country_id: 2186224
description:
2025-11-25 19:26:18 dovecot_login authenticator failed for ([121.73.163.232]) [121.73.163.232]:39720: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 19:32:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<K35LumtEBG8vTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.246
country_id: 1880251
description:
Nov 25 19:38:05 host2 sshd[2709572]: Disconnected from invalid user administrator 45.78.227.246 port 36560 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.22.64.44
country_id: 2921044
description:
Nov 25 19:40:06 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.22.64.44, lip=66.85.158.92, TLS, session=<ujI+1mtEItilFkAs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-25 19:46:27 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:48798: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-11-25 19:46:46 dovecot_login authenticator failed for (cm-84.210.192.240.get.no) [84.210.192.240]:52220: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 19:46:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<nDkM7mtE4MIv7bxd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 19:47:26 host2 sshd[2721652]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.227.246
country_id: 1880251
description:
Nov 25 19:52:36 host2 sshd[2727700]: Disconnected from invalid user kyt 45.78.227.246 port 41532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-25 19:54:50 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:43168: 535 Incorrect authentication data (set_id=v-deploy.com@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-25 19:55:16 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:40642: 535 Incorrect authentication data (set_id=v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 19:58:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<X3v6FmxEJDwvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.89.127
country_id: 6252001
description:
Nov 25 20:00:41 host2 sshd[2738616]: Disconnected from invalid user foundry 172.190.89.127 port 41172 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.190.89.127
country_id: 6252001
description:
Nov 25 20:03:10 host2 sshd[2741645]: Disconnected from invalid user vendas 172.190.89.127 port 49372 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.89.127
country_id: 6252001
description:
Nov 25 20:08:17 host2 sshd[2747558]: Disconnected from invalid user erpnext 172.190.89.127 port 45336 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.68
country_id: 6252001
description:
Nov 25 20:08:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=147.185.133.68, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<6azaPGxE1NyTuYVE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.68
country_id: 6252001
description:
Nov 25 20:09:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=147.185.133.68, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<F0odQGxE2PyTuYVE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.147
country_id: 3175395
description:
Nov 25 20:12:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=217.26.178.147, lip=66.85.158.91, TLS, session=<gxY3R2xEJaDZGrKT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 20:11:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<NGXPRmxEJs4v7bxd>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.31.88
country_id: 798544
description:
Nov 25 20:11:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=178.216.31.88, lip=66.85.158.91, TLS, session=<oyYeRmxEBKGy2B9Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.66
country_id: 6252001
description:
Nov 25 20:15:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.66, lip=66.85.158.91, session=<RX2qU2xEcnJBMRRC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 8.217.235.145
country_id: 1819730
description:
Nov 25 20:16:15 host2 sshd[2756239]: Disconnected from invalid user pivpn 8.217.235.145 port 50830 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.68
country_id: 6252001
description:
Nov 25 20:16:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.68, lip=66.85.158.92, TLS, session=<v/3pWWxEEOuTuYVE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 20:19:36 host2 sshd[2759699]: Disconnected from invalid user mandy 62.60.131.157 port 53745 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 20:22:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<FNX3bmxEPokvTJuG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.95.11.1
country_id: 2017370
description:
[2025-11-25 20:23:08 +0530] info [cpaneld] 77.95.11.1 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.195.86.31
country_id: 3469034
description:
[2025-11-25 20:23:13 +0530] info [cpaneld] 177.195.86.31 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 25 20:23:22 host2 sshd[2763805]: Disconnected from invalid user sonarqube 190.167.75.90 port 59141 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.6.8.11
country_id: 3625428
description:
[2025-11-25 20:23:26 +0530] info [cpaneld] 190.6.8.11 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.234.229.163
country_id: 3658394
description:
[2025-11-25 20:23:30 +0530] info [whostmgrd] 177.234.229.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.235.157.38
country_id: 3865483
description:
[2025-11-25 20:23:45 +0530] info [cpaneld] 201.235.157.38 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.208.65.153
country_id: 1694008
description:
[2025-11-25 20:23:49 +0530] info [cpaneld] 112.208.65.153 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.224.247.23
country_id: 1269750
description:
Nov 25 20:24:46 host2 sshd[2765289]: Disconnected from invalid user root2 103.224.247.23 port 45730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-11-25 20:25:52 dovecot_login authenticator failed for ([122.184.127.86]) [122.184.127.86]:38700: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-11-25 20:26:06 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:34752: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 191.85.24.229
country_id: 3865483
description:
Nov 25 20:27:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=191.85.24.229, lip=66.85.158.91, TLS, session=<TDVifmxE9cm/VRjl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.225.70.126
country_id: 3686110
description:
Nov 25 20:27:19 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=181.225.70.126, lip=66.85.158.91, TLS, session=<+L34fmxEiNu14UZ+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Nov 25 20:27:23 host2 sshd[2768074]: Disconnected from invalid user github 103.224.247.23 port 36776 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 116.206.193.45
country_id: 1327865
description:
Nov 25 20:27:47 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=116.206.193.45, lip=66.85.158.91, TLS, session=<k0aZgGxEtrB0zsEt>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.7.245
country_id: 3625428
description:
Nov 25 20:27:54 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=138.122.7.245, lip=66.85.158.91, TLS, session=<4EcPgWxEq8eKegf1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.81.62.136
country_id: 3865483
description:
Nov 25 20:27:56 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=181.81.62.136, lip=66.85.158.91, TLS, session=<mi8fgWxEtf21UT6I>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.84.114.7
country_id: 1655842
description:
Nov 25 20:27:14 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=115.84.114.7, lip=66.85.158.91, TLS, session=<24ucfmxEaw1zVHIH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.220.105.115
country_id: 953987
description:
Nov 25 20:27:32 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=102.220.105.115, lip=66.85.158.91, TLS, session=<BeCwf2xEpttm3Glz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.237.235.242
country_id: 192950
description:
Nov 25 20:27:37 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=197.237.235.242, lip=66.85.158.91, TLS, session=<BS0EgGxEovLF7evy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.210.185.2
country_id: 3686110
description:
Nov 25 20:28:10 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=38.210.185.2, lip=66.85.158.91, TLS, session=<IJD7gWxEgtkm0rkC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.224.247.23
country_id: 1269750
description:
Nov 25 20:28:44 host2 sshd[2769755]: Disconnected from invalid user mike 103.224.247.23 port 43408 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.121
country_id: 6252001
description:
Nov 25 20:30:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.121, lip=66.85.158.92, session=<Yt/AiGxEDbbDuEx5>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 25 20:30:03 host2 sshd[2771348]: Disconnected from invalid user localhost 190.167.75.90 port 51693 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.209.109.153
country_id: 226074
description:
Nov 25 20:29:11 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 3 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=102.209.109.153, lip=66.85.158.91, TLS, session=<Rn6ShWxELxlm0W2Z>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 203.81.91.110
country_id: 1327865
description:
Nov 25 20:29:18 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=203.81.91.110, lip=66.85.158.91, TLS, session=<YQkIhmxEUczLUVtu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.222.172.43
country_id: 2300660
description:
Nov 25 20:29:31 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (auth failed, 1 attempts in 2 secs): user=<hr@lezzarotech.com>, method=PLAIN, rip=102.222.172.43, lip=66.85.158.91, TLS, session=<yb3ahmxEavNm3qwr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.103
country_id: 6252001
description:
Nov 25 20:29:51 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.103, lip=66.85.158.92, session=<N5oliGxEoeHDuExn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.99
country_id: 6252001
description:
Nov 25 20:30:08 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.99, lip=66.85.158.92, session=<0BgtiWxEZ9/DuExj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.102
country_id: 6252001
description:
Nov 25 20:30:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.102, lip=66.85.158.92, session=<VQZdiWxEa47DuExm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.106.87.120
country_id: 3469034
description:
Nov 25 20:32:21 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@weeratrading.com>, method=PLAIN, rip=179.106.87.120, lip=66.85.158.91, TLS, session=<T4/Wj2xEOLWzald4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.145
country_id: 6252001
description:
Nov 25 20:32:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.145, lip=66.85.158.91, session=<UUjRkWxEY4NAPsWR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.229.98.81
country_id: 2510769
description:
Nov 25 20:32:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.229.98.81, lip=66.85.158.91, TLS, session=<6koukWxEZ+255WJR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.137
country_id: 6252001
description:
Nov 25 20:32:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.137, lip=66.85.158.91, TLS: Connection closed, session=<Z3F/kmxEEqpAPsWJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Nov 25 20:32:45 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.132, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zwqKkmxEKCZAPpyE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 25 20:32:55 host2 sshd[2774705]: Disconnected from invalid user mcserver 190.167.75.90 port 41324 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Nov 25 20:33:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.132, lip=66.85.158.91, TLS: Connection closed, session=<usdulGxEooxAPpyE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-11-25 20:34:56 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:37068: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 20:34:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<HuE1mWxEANsv7bxd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-25 20:35:15 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:39364: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 25 20:35:55 host2 sshd[2778193]: Disconnected from invalid user redmine 190.167.75.90 port 58790 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Nov 25 20:37:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.91, TLS: Connection closed, session=<Gk6Mo2xENN4iemm2>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.167.75.90
country_id: 3508796
description:
Nov 25 20:38:48 host2 sshd[2781264]: Disconnected from invalid user frontend 190.167.75.90 port 48110 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 20:40:06 host2 sshd[2782952]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov 25 20:41:38 host2 pure-ftpd[2784544]: (?@184.105.247.254) [INFO] New connection from 184.105.247.254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-11-25 20:43:09 dovecot_login authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:49647: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-25 20:42:38 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:37662: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 20:46:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<kXEhxWxE3q4vTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.65
country_id: 1880251
description:
Nov 25 20:47:27 host2 sshd[2791202]: Disconnected from invalid user admin1 45.78.203.65 port 47258 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.223
country_id: 2635167
description:
Nov 25 20:51:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 19 secs): user=<>, rip=35.203.210.223, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<q5SB1GxELdYjy9Lf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.223
country_id: 2635167
description:
Nov 25 20:52:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.223, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<mM0I2GxEHu8jy9Lf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 20:58:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<W/Hf7GxEdKcv7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.223
country_id: 2635167
description:
Nov 25 20:58:11 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.223, lip=66.85.158.91, TLS, session=<eGR17WxEhuIjy9Lf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 25 21:03:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1SipAW1Eyv8t4/6c>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 87.116.132.19
country_id: 6290252
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 87.116.132.19 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.102.206.254
country_id: 1210997
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.102.206.254 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.118.159.115
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 45.118.159.115 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 68.183.109.185
country_id: 6252001
description:
Nov 25 21:04:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=68.183.109.185, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<gPVkBW1EDs5Et225>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.177.221.8
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.177.221.8 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.110.216.161
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 181.110.216.161 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.44.139.254
country_id: 3175395
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 2.44.139.254 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.55.39.219
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 1.55.39.219 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-25 21:09:56 dovecot_login authenticator failed for ([189.56.191.126]) [189.44.133.238]:47258: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-25 21:10:40 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3405: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 21:11:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<FZ3lHG1EGJ8vTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.97.24
country_id: 6290252
description:
Nov 25 21:11:47 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@saara.lk>, method=PLAIN, rip=109.206.97.24, lip=66.85.158.91, TLS, session=<U0oiHW1EQN1tzmEY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.89.94
country_id: 226074
description:
Nov 25 21:12:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=196.0.89.94, lip=66.85.158.91, TLS, session=<8Ms+Hm1EPYzEAFle>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.133.223
country_id: 2921044
description:
Nov 25 21:13:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=46.101.133.223, lip=66.85.158.92, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<oVSQI21EgZIuZYXf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.60.212.150
country_id: 3175395
description:
Nov 25 21:13:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=194.60.212.150, lip=66.85.158.91, TLS, session=<5Kh5JG1EU4PCPNSW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.109.251
country_id: 2921044
description:
Nov 25 21:13:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=46.101.109.251, lip=66.85.158.92, TLS handshaking: Connection closed, session=<0hWqJW1EfLguZW37>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.74.181.102
country_id: 130758
description:
Nov 25 21:14:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=94.74.181.102, lip=66.85.158.91, TLS, session=<o4SjJW1E1p1eSrVm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 163.5.160.19
country_id: 3017382
description:
Nov 25 21:18:41 host2 sshd[2824720]: Invalid user cloudtourssrilan_travel from 163.5.160.19 port 50098


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 21:21:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<d5RsQG1E+rwv7bxd>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.234
country_id: 6252001
description:
Nov 25 21:25:35 host2 pure-ftpd[2832898]: (?@205.210.31.234) [INFO] New connection from 205.210.31.234


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.126.135
country_id: 6252001
description:
Nov 25 21:31:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.126.135, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<1eG5Y21ELKWH7X6H>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 21:32:11 host2 sshd[2840123]: Disconnected from invalid user dwight 62.60.131.157 port 34442 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.25
country_id: 3017382
description:
Nov 25 21:32:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.25, lip=66.85.158.92, session=<fUGxZ21Ex9FbxJgZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.115
country_id: 3017382
description:
Nov 25 21:32:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.115, lip=66.85.158.92, session=<I/xbaG1E0chbxJhz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.31
country_id: 3017382
description:
Nov 25 21:32:46 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.31, lip=66.85.158.92, session=<oe4jaW1EZ8ZbxJgf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.27
country_id: 3017382
description:
Nov 25 21:32:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.27, lip=66.85.158.92, session=<lXtWaW1EHeBbxJgb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 21:33:31 host2 sshd[2842602]: Disconnected from invalid user user 2.57.121.25 port 40074 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 25 21:34:34 host2 sshd[2844598]: Disconnected from invalid user dev 71.70.164.48 port 48494 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 21:35:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<5cBMc21ExIMvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 21:39:47 host2 sshd[2850253]: Disconnected from invalid user  2.57.121.112 port 62960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 25 21:43:04 host2 sshd[2853409]: Disconnected from invalid user db2inst1 71.70.164.48 port 44777 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.154.225.181
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 192.154.225.181 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 21:44:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<OAtPk21Eduov7bxd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 25 21:45:25 host2 sshd[2856017]: Disconnected from invalid user nagios 71.70.164.48 port 44321 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.200.49
country_id: 6251999
description:
Nov 25 21:47:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=128.203.200.49, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<T6yWnG1EZKKAy8gx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-25 21:49:27 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63494: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 25 21:49:47 host2 sshd[2866000]: Disconnected from invalid user gns3 71.70.164.48 port 42699 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 21:51:13 host2 sshd[2874816]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 71.70.164.48
country_id: 6252001
description:
Nov 25 21:56:37 host2 sshd[2881815]: Disconnected from invalid user test1 71.70.164.48 port 38660 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-25 21:59:12 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:53794: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-11-25 21:59:33 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:48603: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 21:59:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<jCKtyW1EZM8vTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.243.18
country_id: 1605651
description:
Nov 25 22:01:42 host2 sshd[2887311]: Disconnected from invalid user yhli 49.49.243.18 port 52884 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.32
country_id: 6252001
description:
Nov 25 22:02:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.32, lip=66.85.158.92, TLS handshaking: Connection closed, session=<j/TZ0m1Exu9APsUg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.49.243.18
country_id: 1605651
description:
Nov 25 22:05:24 host2 sshd[2891693]: Disconnected from invalid user info 49.49.243.18 port 52626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 25 22:06:45 host2 sshd[2893209]: Disconnected from invalid user ubuntu 187.174.238.116 port 58828 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 49.49.243.18
country_id: 1605651
description:
Nov 25 22:08:16 host2 sshd[2895093]: Disconnected from invalid user dixi 49.49.243.18 port 58188 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 22:07:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<JwlM5W1EUpIv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 25 22:09:20 host2 sshd[2896530]: Disconnected from invalid user angel 187.174.238.116 port 35476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 25 22:10:44 host2 sshd[2898609]: Disconnected from invalid user ubuntu 187.174.238.116 port 37912 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.174.238.116
country_id: 3996063
description:
Nov 25 22:12:10 host2 sshd[2899842]: Disconnected from invalid user dixi 187.174.238.116 port 40348 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.36.9
country_id: 3277605
description:
Nov 25 22:21:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=98.159.36.9, lip=66.85.158.91, TLS handshaking: Connection closed, session=<RUnVGG5ElNBinyQJ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.232.134
country_id: 2542007
description:
Nov 25 22:21:50 host2 pure-ftpd[2913419]: (?@95.181.232.134) [INFO] New connection from 95.181.232.134


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.233.148
country_id: 2993457
description:
Nov 25 22:21:49 host2 pure-ftpd[2913406]: (?@95.181.233.148) [INFO] New connection from 95.181.233.148


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.90.122.149
country_id: 3042058
description:
Nov 25 22:21:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=91.90.122.149, lip=66.85.158.91, session=<a/HUGG5ETItbWnqV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 22:23:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<4oJRH25EomgvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 22:25:15 host2 sshd[2918086]: Disconnected from invalid user admin 2.57.121.112 port 62056 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.161.174.170
country_id: 6251999
description:
Nov 25 22:25:33 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=51.161.174.170, lip=66.85.158.92, TLS, session=<DaToJW5EWI8zoa6q>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 22:29:46 host2 sshd[2922450]: Disconnected from invalid user user 2.57.121.25 port 38962 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 22:30:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<clMQN25Exq8v7bxd>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.97.101.70
country_id: 3017382
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 161.97.101.70 - lezzarotech "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarotech (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2025-11-25 22:32:37 dovecot_login authenticator failed for ([50.217.40.11]) [50.217.40.11]:38428: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-11-25 22:33:33 dovecot_login authenticator failed for ([154.118.162.194]) [154.118.162.194]:1163: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.16.86.40
country_id: 2215636
description:
Nov 25 22:34:47 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=165.16.86.40, lip=66.85.158.91, TLS, session=<tua/RW5ECdKlEFYo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.207.34.239
country_id: 6290252
description:
Nov 25 22:35:05 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.207.34.239, lip=66.85.158.91, TLS, session=<H+YBR25ECsxtzyLv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.242
country_id: 6252001
description:
Nov 25 22:40:38 host2 pure-ftpd[2933981]: (?@198.235.24.242) [INFO] New connection from 198.235.24.242


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 25 22:40:40 host2 sshd[2934001]: Disconnected from invalid user retag 51.222.106.104 port 54958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 25 22:40:43 host2 sshd[2934047]: Disconnected from invalid user ubuntu 27.111.32.174 port 43416 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 25 22:42:58 host2 sshd[2936295]: Disconnected from invalid user sonarqube 51.222.106.104 port 54558 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 22:44:06 host2 sshd[2937371]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 25 22:45:51 host2 sshd[2939557]: Disconnected from invalid user fan 27.111.32.174 port 33718 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov 25 22:45:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.91, session=<30mlbW5Elv/CpRCl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 22:46:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<gFZNcm5EGDovTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.222.106.104
country_id: 6251999
description:
Nov 25 22:47:15 host2 sshd[2941034]: Disconnected from invalid user radarr 51.222.106.104 port 34104 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.111.32.174
country_id: 1643084
description:
Nov 25 22:48:17 host2 sshd[2942026]: Disconnected from invalid user amssys 27.111.32.174 port 41324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-25 22:49:17 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:41296: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
country_id: 1831722
description:
2025-11-25 22:49:27 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:52694: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 22:53:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<e6QkiW5E/qcv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.228
country_id: 3625428
description:
Nov 25 22:54:26 host2 sshd[2948178]: Disconnected from invalid user kali 38.134.226.228 port 53008 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 22:54:58 host2 sshd[2949050]: Disconnected from invalid user user 2.57.121.25 port 5036 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.171
country_id: 3625428
description:
Nov 25 22:57:21 host2 sshd[2951598]: Disconnected from invalid user weblogic 38.134.226.171 port 34748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.14
country_id: 3625428
description:
Nov 25 22:58:48 host2 sshd[2953071]: Disconnected from invalid user smart 38.134.226.14 port 33718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.213
country_id: 3625428
description:
Nov 25 23:03:25 host2 sshd[2957680]: Disconnected from invalid user intell 38.134.226.213 port 39120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.213
country_id: 3625428
description:
Nov 25 23:04:51 host2 sshd[2959150]: Disconnected from invalid user node 38.134.226.213 port 60650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.110
country_id: 3625428
description:
Nov 25 23:06:17 host2 sshd[2960702]: Disconnected from invalid user ec2-user 38.134.226.110 port 55250 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.128.12
country_id: 6252001
description:
Nov 25 23:06:42 host2 pure-ftpd[2961060]: (?@172.105.128.12) [INFO] New connection from 172.105.128.12


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.39
country_id: 3625428
description:
Nov 25 23:07:48 host2 sshd[2962104]: Disconnected from invalid user postgres 38.134.226.39 port 51750 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.96
country_id: 6252001
description:
Nov 25 23:08:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.96, lip=66.85.158.91, TLS handshaking: Connection closed, session=<B3C2wG5EN9tBMQFg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.94
country_id: 6252001
description:
Nov 25 23:09:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.94, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QF+2wW5EjE9BMQFe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.63
country_id: 3625428
description:
Nov 25 23:09:17 host2 sshd[2963912]: Disconnected from invalid user alice 38.134.226.63 port 44798 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.94
country_id: 6252001
description:
Nov 25 23:09:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.94, lip=66.85.158.91, TLS: Connection closed, session=<UJ2Ewm5EmFVBMQFe>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.247
country_id: 3625428
description:
Nov 25 23:10:44 host2 sshd[2965519]: Disconnected from invalid user radio 38.134.226.247 port 42508 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 23:10:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<7c0TyG5EmOkvTJuG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.127
country_id: 3625428
description:
Nov 25 23:15:16 host2 sshd[2970477]: Disconnected from invalid user git 38.134.226.127 port 37154 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 23:16:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<Prrg3G5EPosv7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.148
country_id: 3625428
description:
Nov 25 23:16:46 host2 sshd[2972293]: Disconnected from invalid user deploy 38.134.226.148 port 33390 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.52
country_id: 6252001
description:
Nov 25 23:17:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.52, lip=66.85.158.91, TLS: Connection closed, session=<Pw80325EmKSnXpI0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.157
country_id: 3625428
description:
Nov 25 23:18:12 host2 sshd[2974251]: Disconnected from invalid user devops 38.134.226.157 port 39516 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.176
country_id: 1880251
description:
Nov 25 23:19:15 host2 sshd[2975633]: Disconnected from invalid user root123 154.91.81.176 port 33810 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.183
country_id: 3625428
description:
Nov 25 23:19:41 host2 sshd[2976202]: Disconnected from invalid user tom 38.134.226.183 port 48574 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Nov 25 23:19:51 host2 sshd[2976405]: Disconnected from invalid user nvidia 203.145.34.93 port 44062 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.242.96.43
country_id: 3355338
description:
Nov 25 23:20:58 host2 sshd[2977735]: Disconnected from invalid user superadmin 160.242.96.43 port 59480 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.145.34.93
country_id: 1643084
description:
Nov 25 23:21:25 host2 sshd[2978191]: Disconnected from invalid user seafile 203.145.34.93 port 44438 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.143
country_id: 3625428
description:
Nov 25 23:22:40 host2 sshd[2979587]: Disconnected from invalid user scanner 38.134.226.143 port 58150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Nov 25 23:22:55 host2 sshd[2979785]: Disconnected from invalid user public 203.145.34.93 port 49788 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.223
country_id: 6252001
description:
Nov 25 23:22:56 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.223, lip=66.85.158.91, session=<qL4h825EWustT7Xf>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.93
country_id: 1643084
description:
Nov 25 23:24:23 host2 sshd[2981539]: Disconnected from invalid user glenn 203.145.34.93 port 43434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 25 23:25:27 host2 sshd[2982824]: Disconnected from invalid user amina 62.60.131.157 port 29069 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.191
country_id: 3625428
description:
Nov 25 23:25:40 host2 sshd[2982998]: Disconnected from invalid user sistemas 38.134.226.191 port 35502 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.242.96.43
country_id: 3355338
description:
Nov 25 23:28:05 host2 sshd[2985364]: Disconnected from invalid user bitrix 160.242.96.43 port 60160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 25 23:28:07 host2 sshd[2985391]: Disconnected from invalid user  2.57.121.112 port 62251 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.247
country_id: 3625428
description:
Nov 25 23:28:43 host2 sshd[2985959]: Disconnected from invalid user superman 38.134.226.247 port 60778 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.242.96.43
country_id: 3355338
description:
Nov 25 23:29:28 host2 sshd[2986626]: Disconnected from invalid user lch 160.242.96.43 port 49746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.176
country_id: 1880251
description:
Nov 25 23:29:46 host2 sshd[2986849]: Disconnected from invalid user testuser 154.91.81.176 port 58216 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.242.96.43
country_id: 3355338
description:
Nov 25 23:30:51 host2 sshd[2988221]: Disconnected from invalid user es 160.242.96.43 port 60176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.251
country_id: 3625428
description:
Nov 25 23:31:40 host2 sshd[2988999]: Disconnected from invalid user usuario 38.134.226.251 port 41348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.81.176
country_id: 1880251
description:
Nov 25 23:31:52 host2 sshd[2989152]: Disconnected from invalid user jacob 154.91.81.176 port 56050 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.75
country_id: 6252001
description:
Nov 25 23:34:39 host2 pure-ftpd[2991992]: (?@195.184.76.75) [INFO] New connection from 195.184.76.75


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.79
country_id: 6252001
description:
Nov 25 23:34:39 host2 pure-ftpd[2991988]: (?@195.184.76.79) [INFO] New connection from 195.184.76.79


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.149
country_id: 3625428
description:
Nov 25 23:34:40 host2 sshd[2991994]: Disconnected from invalid user vpn 38.134.226.149 port 55720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.134.226.123
country_id: 3625428
description:
Nov 25 23:36:08 host2 sshd[2993770]: Disconnected from invalid user albert 38.134.226.123 port 34698 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 25 23:35:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Sd2qH29E+nYvTJuG>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.81.176
country_id: 1880251
description:
Nov 25 23:36:05 host2 sshd[2993695]: Disconnected from invalid user radio 154.91.81.176 port 51558 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 25 23:40:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<sales@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<NFlDMW9EPp4v7bxd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Nov 25 23:41:53 host2 sshd[2999637]: Disconnected from invalid user sales1 59.98.148.5 port 52848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov 25 23:42:29 host2 sshd[3000303]: Disconnected from invalid user socks 81.30.162.18 port 36134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Nov 25 23:43:22 host2 sshd[3001235]: Disconnected from invalid user pzuser 59.98.148.5 port 56106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 25 23:44:39 host2 sshd[3002485]: Invalid user visionsolutionshospital from 154.219.110.64 port 57114


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 59.98.148.5
country_id: 1269750
description:
Nov 25 23:44:51 host2 sshd[3002754]: Disconnected from invalid user sftpuser 59.98.148.5 port 47888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Nov 25 23:46:08 host2 sshd[3004710]: Disconnected from invalid user airflow 196.0.120.211 port 50174 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.254
country_id: 1819730
description:
Nov 25 23:46:10 host2 sshd[3004832]: Disconnected from invalid user zhangsan 154.221.17.254 port 52806 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 25 23:46:36 host2 sshd[3005273]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.207.9.246
country_id: 1269750
description:
Nov 25 23:47:11 host2 sshd[3005858]: Disconnected from invalid user tester 103.207.9.246 port 39626 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov 25 23:46:48 host2 sshd[3005437]: Disconnected from invalid user usuario1 103.157.25.60 port 49930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.98.148.5
country_id: 1269750
description:
Nov 25 23:47:39 host2 sshd[3006412]: Disconnected from invalid user ubuntu 59.98.148.5 port 41454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Nov 25 23:47:19 host2 sshd[3006044]: Disconnected from invalid user test1 94.254.0.234 port 52882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov 25 23:48:47 host2 sshd[3007447]: Disconnected from invalid user ubuntu 81.30.162.18 port 34661 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.254
country_id: 1819730
description:
Nov 25 23:50:12 host2 sshd[3008943]: Disconnected from invalid user user2 154.221.17.254 port 57522 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 25 23:50:18 host2 sshd[3009041]: Disconnected from invalid user user 2.57.121.25 port 16645 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.144.176.83
country_id: 6252001
description:
Nov 25 23:49:18 host2 sshd[3007945]: Disconnected from invalid user developer 198.144.176.83 port 37772 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-11-25 23:50:11 dovecot_login authenticator failed for ([59.145.84.25]) [103.251.31.154]:50608: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.0.120.211
country_id: 226074
description:
Nov 25 23:49:45 host2 sshd[3008335]: Disconnected from invalid user guest 196.0.120.211 port 57530 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.144.176.83
country_id: 6252001
description:
Nov 25 23:50:24 host2 sshd[3009155]: Disconnected from invalid user will 198.144.176.83 port 37378 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-25 23:50:41 dovecot_login authenticator failed for (187-50-194-182.customer.tdatabrasil.net.br) [187.50.194.182]:39634: 535 Incorrect authentication data (set_id=barbier.ch.agri)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.207.9.246
country_id: 1269750
description:
Nov 25 23:51:01 host2 sshd[3009720]: Disconnected from invalid user ubuntu 103.207.9.246 port 57536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov 25 23:52:07 host2 sshd[3011021]: Disconnected from invalid user ftpadmin 103.157.25.60 port 53872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.254
country_id: 1819730
description:
Nov 25 23:51:50 host2 sshd[3010739]: Disconnected from invalid user blue 154.221.17.254 port 33898 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov 25 23:52:01 host2 sshd[3010889]: Disconnected from invalid user ubuntu 81.30.162.18 port 45254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 25 23:53:00 host2 sshd[3011852]: Disconnected from invalid user odoo15 189.126.4.42 port 41260 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.144.176.83
country_id: 6252001
description:
Nov 25 23:52:38 host2 sshd[3011533]: Disconnected from invalid user student 198.144.176.83 port 37428 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.50.147
country_id: 3175395
description:
Nov 25 23:52:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=185.77.50.147, lip=66.85.158.91, TLS, session=<ovZdXW9EtqO5TTKT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.0.120.211
country_id: 226074
description:
Nov 25 23:52:58 host2 sshd[3011802]: Disconnected from invalid user oracle 196.0.120.211 port 33124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.30.162.18
country_id: 690791
description:
Nov 25 23:53:06 host2 sshd[3011999]: Disconnected from invalid user proradis 81.30.162.18 port 58193 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 202.136.85.48
country_id: 1269750
description:
Nov 25 23:53:16 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=202.136.85.48, lip=66.85.158.91, TLS, session=<IpqFXm9EbIfKiFUw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov 25 23:53:34 host2 sshd[3012418]: Disconnected from invalid user localhost 103.157.25.60 port 55882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Nov 25 23:54:17 host2 sshd[3013302]: Disconnected from invalid user kingbase 94.254.0.234 port 36088 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.254
country_id: 1819730
description:
Nov 25 23:53:26 host2 sshd[3012309]: Disconnected from invalid user myuser 154.221.17.254 port 60128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 25 23:54:23 host2 sshd[3013710]: Disconnected from invalid user laravel 189.126.4.42 port 44010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov 25 23:54:53 host2 sshd[3014356]: Disconnected from invalid user odoo15 103.157.25.60 port 57886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.17.254
country_id: 1819730
description:
Nov 25 23:54:58 host2 sshd[3014430]: Disconnected from invalid user master 154.221.17.254 port 38040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-25 23:55:09 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:48518: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Nov 25 23:55:12 host2 sshd[3014824]: Disconnected from invalid user odoo15 94.254.0.234 port 52384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.157.25.60
country_id: 1643084
description:
Nov 25 23:56:10 host2 sshd[3015852]: Disconnected from invalid user test1 103.157.25.60 port 59900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.254.0.234
country_id: 2661886
description:
Nov 25 23:56:13 host2 sshd[3015926]: Disconnected from invalid user in 94.254.0.234 port 35842 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-25 23:55:38 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:41652: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.126.4.42
country_id: 3469034
description:
Nov 25 23:55:43 host2 sshd[3015375]: Disconnected from invalid user usuario1 189.126.4.42 port 46864 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 26 00:00:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<37iMd29E/GEvTJuG>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2025-11-26 00:02:02 dovecot_login authenticator failed for 89-67-246-166.dynamic.play.pl [89.67.246.166]:32836: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.92.14
country_id: 1269750
description:
2025-11-26 00:02:30 dovecot_login authenticator failed for ([125.19.175.238]) [27.123.92.14]:54402: 535 Incorrect authentication data (set_id=barbier.ch.agri)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.164.107.4
country_id: 6252001
description:
Nov 26 00:03:07 host2 pure-ftpd[3023541]: (?@194.164.107.4) [INFO] New connection from 194.164.107.4


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 26 00:04:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<admin@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<kfJ4hm9EPqov7bxd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.194.250.60
country_id: 1605651
description:
Nov 26 00:04:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=118.194.250.60, lip=66.85.158.91, session=<pWWSiG9EjO12wvo8>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 118.194.250.60
country_id: 1605651
description:
Nov 26 00:04:44 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=118.194.250.60, lip=66.85.158.91, TLS, session=<+dejiG9EFO52wvo8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.14.197
country_id: 6252001
description:
Nov 26 00:07:12 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.33.14.197, lip=66.85.158.92, session=<dhZ1kW9EIestIQ7F>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.63.17
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 197.211.63.17 - dmch@fhb.health.gov.lk "GET /login/?user=dmch@fhb.health.gov.lk HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Nov 26 00:08:04 host2 sshd[3029579]: Disconnected from invalid user bodega 20.203.42.204 port 52558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.127
country_id: 1880251
description:
Nov 26 00:09:49 host2 sshd[3031254]: Disconnected from invalid user bodega 101.47.140.127 port 53044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.203.42.204
country_id: 290557
description:
Nov 26 00:09:56 host2 sshd[3031342]: Disconnected from invalid user copia 20.203.42.204 port 57078 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.203.42.204
country_id: 290557
description:
Nov 26 00:11:15 host2 sshd[3032968]: Disconnected from invalid user postgres 20.203.42.204 port 60830 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.144
country_id: 6252001
description:
Nov 26 00:11:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.144, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<bnkXoW9EOM7N0h+Q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.186
country_id: 6252001
description:
Nov 26 00:13:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.186, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<4/fAp29E8uRHBpK6>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.250.204.103
country_id: 1269750
description:
Nov 26 00:14:22 host2 sshd[3036513]: Disconnected from invalid user asterisk 160.250.204.103 port 36386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.127
country_id: 1880251
description:
Nov 26 00:14:48 host2 sshd[3036839]: Disconnected from invalid user ivan 101.47.140.127 port 42164 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 00:15:06 host2 sshd[3037237]: Disconnected from invalid user user 2.57.121.25 port 31515 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.22
country_id: 6252001
description:
Nov 26 00:16:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.22, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lORps29EldvN0h8W>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 00:17:39 host2 sshd[3039627]: Disconnected from invalid user marisol 2.57.121.112 port 62050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-26 00:21:58 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-26 00:22:08 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:59427: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.127
country_id: 1880251
description:
Nov 26 00:24:39 host2 sshd[3046188]: Disconnected from invalid user share 101.47.140.127 port 59038 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 26 00:25:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<xhhf0W9EVrkvTJuG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.237.188.93
country_id: 1880251
description:
Nov 26 00:28:26 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<news@anandaobauae.org>, method=PLAIN, rip=47.237.188.93, lip=66.85.158.91, session=<8I1I3W9E2usv7bxd>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 00:38:21 host2 sshd[3060402]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-11-26 00:48:05 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:49128: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-11-26 00:48:39 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:37532: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.63.17
country_id: 2328926
description:
[2025-11-26 00:50:40 +0530] info [webmaild] 197.211.63.17 - dmch@fhb.health.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 26 00:50:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<MuTNLHBEUosvTJuG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.63.17
country_id: 2328926
description:
[2025-11-26 00:51:55 +0530] info [webmaild] 197.211.63.17 - dmch@fhb.health.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.63.17
country_id: 2328926
description:
[2025-11-26 00:52:42 +0530] info [webmaild] 197.211.63.17 - dmch@fhb.health.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.211.63.17
country_id: 2328926
description:
[2025-11-26 00:56:31 +0530] info [webmaild] 197.211.63.17 - dmch@fhb.health.gov.lk "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.186
country_id: 6252001
description:
Nov 26 00:56:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.186, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<lwClQnBERrxHBpK6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-11-26 01:04:17 dovecot_login authenticator failed for ([152.52.199.126]) [152.52.199.126]:46012: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-11-26 01:04:40 dovecot_login authenticator failed for ([58.169.37.163]) [58.169.37.163]:46224: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2025-11-26 01:05:21 dovecot_login authenticator failed for (nsg-corporate-12.226.187.122.airtel.in) [122.187.226.12]:35018: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 01:07:06 host2 sshd[3092295]: Disconnected from invalid user jailyn 62.60.131.157 port 25662 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 01:09:27 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<4On1b3BEVKIXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 01:09:52 host2 sshd[3095395]: Disconnected from invalid user user 2.57.121.25 port 40707 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 26 01:16:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<store@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<xw2dh3BE3okvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov 26 01:16:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.92, TLS: Connection closed, session=<6srYiXBE/r1ChJl6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 01:22:36 host2 sshd[3108915]: Disconnected from invalid user vpn 2.57.121.112 port 62170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-26 01:29:11 dovecot_login authenticator failed for ([189.56.5.209]) [187.50.194.182]:51057: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.221.217.130
country_id: 6252001
description:
Nov 26 01:31:08 host2 pure-ftpd[3118082]: (?@13.221.217.130) [INFO] New connection from 13.221.217.130


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 13.221.217.130
country_id: 6252001
description:
Nov 26 01:31:08 host2 pure-ftpd[3118088]: (?@13.221.217.130) [INFO] New connection from 13.221.217.130


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 01:33:08 host2 sshd[3119970]: Disconnected from invalid user admin 2.57.121.112 port 52931 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 01:34:20 host2 sshd[3121088]: Disconnected from invalid user user 2.57.121.25 port 53015 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 01:34:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<XHs/yXBEKNcXXz9j>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 195.178.110.108
country_id: 732800
description:
Denial of Service (DoS) attack was discovered from 195.178.110.108: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 01:40:51 host2 sshd[3129876]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.76.155.134
country_id: 1819730
description:
Nov 26 01:41:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<orders@anandaobauae.org>, method=PLAIN, rip=47.76.155.134, lip=66.85.158.91, session=<Xdxw43BExLEvTJuG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Nov 26 01:43:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=704) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=66.132.153.121, lip=66.85.158.91, TLS: read(size=704) failed: Connection reset by peer, session=<7XV86HBEoGhChJl5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.121
country_id: 6252001
description:
Nov 26 01:43:09 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.121, lip=66.85.158.91, session=<SP+P6HBEomhChJl5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.38
country_id: 6252001
description:
Nov 26 01:48:15 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.38, lip=66.85.158.91, session=<nnnY+nBElhes7OQm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.36.74
country_id: 2921044
description:
Nov 26 01:55:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.36.74, lip=66.85.158.92, session=<wrokFHFEm1po+CRK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.44.176
country_id: 2921044
description:
Nov 26 01:55:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.248.44.176, lip=66.85.158.92, session=<j+ArFHFEdJFo+Cyw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.17.117
country_id: 2300660
description:
Nov 26 01:57:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=41.139.17.117, lip=66.85.158.91, TLS, session=<Qbw5HHFETpgpixF1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.17.108.124
country_id: 6290252
description:
Nov 26 01:58:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=217.17.108.124, lip=66.85.158.91, TLS, session=<BpJxHXFENK/ZEWx8>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 01:59:01 host2 sshd[3152301]: Disconnected from invalid user admin 2.57.121.112 port 33256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-26 02:06:40 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64690: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-26 02:07:37 dovecot_plain authenticator failed for (superfus) [46.8.245.34]:40150: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.48
country_id: 6252001
description:
Nov 26 02:07:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.48, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Xf5BQHFEi83N0h8w>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 02:11:53 host2 sshd[3167552]: Disconnected from invalid user  2.57.121.112 port 62405 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-11-26 02:10:58 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:35306: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-26 02:18:54 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:52522: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-26 02:19:04 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:40496: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.5.21.121
country_id: 3865483
description:
Nov 26 02:21:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@saara.lk>, method=PLAIN, rip=190.5.21.121, lip=66.85.158.91, TLS, session=<Ou3abnFEmJG+BRV5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.155.135.23
country_id: 3469034
description:
Nov 26 02:21:21 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=177.155.135.23, lip=66.85.158.91, TLS, session=<nxQtcHFENoKxm4cX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 02:28:44 host2 sshd[3184919]: Disconnected from invalid user user 2.57.121.25 port 11359 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 02:32:26 host2 sshd[3188844]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.41.206.147
country_id: 6252001
description:
Nov 26 02:32:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=181.41.206.147, lip=66.85.158.91, session=<vYa7mXFE4MO1Kc6T>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 02:40:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<tXW1tnFEssQXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-26 02:43:48 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:54834: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.37.210
country_id: 1269750
description:
2025-11-26 02:43:53 dovecot_plain authenticator failed for (D5USN7IUSI1V) [49.37.37.210]:65044: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-26 02:44:06 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:58890: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2025-11-26 02:48:29 dovecot_plain authenticator failed for c-68-52-119-193.hsd1.tn.comcast.net (tendenet) [68.52.119.193]:49594: 535 Incorrect authentication data (set_id=ruwini@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-26 02:49:16 dovecot_login authenticator failed for ([125.19.251.90]) [125.19.251.90]:56970: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.94.39.65
country_id: 1269750
description:
2025-11-26 02:49:35 dovecot_login authenticator failed for ([59.94.39.65]) [59.94.39.65]:32789: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Nov 26 02:51:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, TLS: Connection closed, session=<5nB63XFEip7CpGsG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 02:53:14 host2 sshd[3212898]: Disconnected from invalid user user 2.57.121.25 port 29400 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.122
country_id: 6252001
description:
Nov 26 02:53:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.122, lip=66.85.158.91, TLS: Connection closed, session=<1wXZ5HFEmNlChJl6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 181.16.144.100
country_id: 3865483
description:
Nov 26 02:55:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=181.16.144.100, lip=66.85.158.91, TLS, session=<rBb46XFE9Ka1EJBk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.156
country_id: 1269750
description:
Nov 26 02:55:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=103.18.166.156, lip=66.85.158.91, TLS, session=<MOmc6HFEL7NnEqac>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.241.212.143
country_id: 2802361
description:
Nov 26 02:56:17 host2 pure-ftpd[3217033]: (?@35.241.212.143) [INFO] New connection from 35.241.212.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-11-26 02:57:29 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:34394: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.228
country_id: 6252001
description:
Nov 26 02:57:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.228, lip=66.85.158.92, TLS, session=<ig0P83FElPTG6xjk>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.29
country_id: 2635167
description:
Nov 26 02:58:56 host2 pure-ftpd[3219588]: (?@185.247.137.29) [INFO] New connection from 185.247.137.29


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 03:05:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<CWHuDnJEeJUXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.8.177
country_id: 6252001
description:
Nov 26 03:10:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.8.177, lip=66.85.158.92, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<I0iAIHJEFKsv+wix>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Nov 26 03:10:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<G15LInJEOoAv+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Nov 26 03:10:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WYhqInJESIAv+zWT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 03:14:47 host2 sshd[3236501]: Disconnected from invalid user jayde 62.60.131.157 port 40025 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 26 03:14:49 host2 sshd[3236544]: Disconnected from invalid user tidb 103.218.240.181 port 55614 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.236
country_id: 6252001
description:
Nov 26 03:15:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.236, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<DIRqMnJEmsLN0h/s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 03:16:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<DiIpN3JEfMcXXz9j>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.236
country_id: 6252001
description:
Nov 26 03:17:00 host2 pure-ftpd[3238587]: (?@198.235.24.236) [INFO] New connection from 198.235.24.236


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.150.56
country_id: 99237
description:
Nov 26 03:17:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=65.20.150.56, lip=66.85.158.91, TLS, session=<wYCfOXJENu1BFJY4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 26 03:18:31 host2 sshd[3239935]: Disconnected from invalid user g 103.218.240.181 port 60794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.193
country_id: 3469034
description:
Nov 26 03:18:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=191.53.129.193, lip=66.85.158.91, TLS, session=<ZYvJOnJEjMG/NYHB>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 26 03:19:51 host2 sshd[3241103]: Disconnected from invalid user soporte 103.218.240.181 port 56446 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 26 03:21:12 host2 sshd[3242579]: Disconnected from invalid user aaa 103.218.240.181 port 46858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.218.240.181
country_id: 1819730
description:
Nov 26 03:22:29 host2 sshd[3243921]: Disconnected from invalid user test123 103.218.240.181 port 46584 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 26 03:31:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<fkMzanJEntKSOC+J>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 03:34:47 host2 sshd[3256804]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-26 03:35:44 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:36208: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-11-26 03:36:04 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:52604: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 03:41:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<VjZCj3JEKLkXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.86
country_id: 6252001
description:
Nov 26 03:49:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.171.8.86, lip=66.85.158.92, session=<cwu/q3JEOokUqwhW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-26 03:59:43 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:53832: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.46
country_id: 6252001
description:
2025-11-26 04:00:03 dovecot_login authenticator failed for ([70.174.168.46]) [70.174.168.46]:43387: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.1.180
country_id: 2635167
description:
Nov 26 04:04:02 host2 sshd[3294365]: Disconnected from invalid user developer 46.101.1.180 port 42754 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.203.224.88
country_id: 6252001
description:
Nov 26 04:05:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.203.224.88, lip=66.85.158.91, session=<beST5nJE9t6sy+BY>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 04:05:34 host2 sshd[3296361]: Disconnected from invalid user  2.57.121.112 port 61201 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.1.180
country_id: 2635167
description:
Nov 26 04:06:43 host2 sshd[3297935]: Disconnected from invalid user userroot 46.101.1.180 port 42764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Nov 26 04:08:42 host2 sshd[3300674]: Disconnected from invalid user odoo15 122.176.122.24 port 41078 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.1.180
country_id: 2635167
description:
Nov 26 04:08:58 host2 sshd[3300981]: Disconnected from invalid user ftptest 46.101.1.180 port 42790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.1.180
country_id: 2635167
description:
Nov 26 04:10:04 host2 sshd[3302509]: Disconnected from invalid user vlad 46.101.1.180 port 42804 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.176.122.24
country_id: 1269750
description:
Nov 26 04:10:16 host2 sshd[3302802]: Disconnected from invalid user deploy 122.176.122.24 port 43394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.128.70
country_id: 3469034
description:
Nov 26 04:10:22 host2 sshd[3302960]: Disconnected from invalid user lch 45.169.128.70 port 60946 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.1.180
country_id: 2635167
description:
Nov 26 04:11:08 host2 sshd[3303988]: Disconnected from invalid user admin123 46.101.1.180 port 42820 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.176.122.24
country_id: 1269750
description:
Nov 26 04:13:35 host2 sshd[3307265]: Disconnected from invalid user autcom 122.176.122.24 port 47996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.160.91
country_id: 1643084
description:
Nov 26 04:14:29 host2 sshd[3308479]: Disconnected from invalid user student 157.10.160.91 port 56862 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.128.70
country_id: 3469034
description:
Nov 26 04:14:35 host2 sshd[3308593]: Disconnected from invalid user bitnami 45.169.128.70 port 44360 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.23.17.75
country_id: 3469034
description:
Nov 26 04:16:42 host2 sshd[3311381]: Disconnected from invalid user ftptest 201.23.17.75 port 52542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 04:16:29 host2 sshd[3311028]: Disconnected from invalid user admin 2.57.121.112 port 9865 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.23.17.75
country_id: 3469034
description:
Nov 26 04:18:54 host2 sshd[3314271]: Disconnected from invalid user ts2 201.23.17.75 port 37904 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.10.160.91
country_id: 1643084
description:
Nov 26 04:19:32 host2 sshd[3315126]: Disconnected from invalid user redmine 157.10.160.91 port 49236 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.23.17.75
country_id: 3469034
description:
Nov 26 04:23:14 host2 sshd[3319775]: Disconnected from invalid user tempuser 201.23.17.75 port 48694 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.160.91
country_id: 1643084
description:
Nov 26 04:23:17 host2 sshd[3319838]: Disconnected from invalid user cds 157.10.160.91 port 41204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.160.91
country_id: 1643084
description:
Nov 26 04:24:31 host2 sshd[3321851]: Disconnected from invalid user hello 157.10.160.91 port 51666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.23.17.75
country_id: 3469034
description:
Nov 26 04:25:15 host2 sshd[3323048]: Disconnected from invalid user posiflex 201.23.17.75 port 40958 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 04:26:17 host2 sshd[3324709]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 04:31:25 host2 sshd[3331045]: Disconnected from invalid user jill 62.60.131.157 port 8324 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.75.222.69
country_id: 3077311
description:
Nov 26 04:34:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=217.75.222.69, lip=66.85.158.91, TLS, session=<oxDzSnNEyuXZS95F>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.13.140.178
country_id: 3175395
description:
Nov 26 04:34:27 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=31.13.140.178, lip=66.85.158.91, TLS, session=<h/M0THNEZcwfDYyy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.47.165
country_id: 953987
description:
Nov 26 04:34:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@saara.lk>, method=PLAIN, rip=102.64.47.165, lip=66.85.158.91, TLS, session=<YmuSTHNEWotmQC+l>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 38.10.70.126
country_id: 298795
description:
Nov 26 04:35:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=38.10.70.126, lip=66.85.158.91, TLS, session=<ijgkTnNEM9AmCkZ+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.116
country_id: 3469034
description:
Nov 26 04:52:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=179.189.201.116, lip=66.85.158.91, TLS, session=<0T0ujHNEfNKzvcl0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.157.43
country_id: 690791
description:
Nov 26 04:52:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=37.221.157.43, lip=66.85.158.91, TLS, session=<2HdyjXNE7O0l3Z0r>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.97.19.139
country_id: 6252001
description:
Nov 26 04:56:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=18.97.19.139, lip=66.85.158.92, TLS handshaking: Connection closed, session=<qTpynXNEMsgSYROL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.193
country_id: 1643084
description:
Nov 26 05:15:01 host2 sshd[3388342]: Disconnected from invalid user tester 182.8.228.193 port 44847 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Nov 26 05:15:11 host2 sshd[3388725]: Disconnected from invalid user ts3 103.186.0.68 port 48586 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.193
country_id: 1643084
description:
Nov 26 05:20:22 host2 sshd[3395130]: Disconnected from invalid user ftptest 182.8.228.193 port 42990 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.0.68
country_id: 1643084
description:
Nov 26 05:19:49 host2 sshd[3394339]: Disconnected from invalid user admin1234 103.186.0.68 port 41006 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.0.68
country_id: 1643084
description:
Nov 26 05:22:35 host2 sshd[3397754]: Disconnected from invalid user vagrant 103.186.0.68 port 51718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.228.193
country_id: 1643084
description:
Nov 26 05:23:14 host2 sshd[3398661]: Disconnected from invalid user administrator 182.8.228.193 port 51778 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.8.228.193
country_id: 1643084
description:
Nov 26 05:24:37 host2 sshd[3400547]: Disconnected from invalid user tecnopos 182.8.228.193 port 23708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.80.27.53
country_id: 1819730
description:
Nov 26 05:26:53 host2 sshd[3403696]: Disconnected from invalid user posiflex 103.80.27.53 port 37124 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.83.31
country_id: 2245662
description:
Nov 26 05:27:16 host2 sshd[3404149]: Disconnected from invalid user deploy 154.125.83.31 port 41841 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 05:28:38 host2 sshd[3406069]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 05:28:48 host2 sshd[3406234]: Disconnected from invalid user user 2.57.121.25 port 22418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.83.31
country_id: 2245662
description:
Nov 26 05:33:36 host2 sshd[3411884]: Disconnected from invalid user dixi 154.125.83.31 port 36934 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.80.27.53
country_id: 1819730
description:
Nov 26 05:34:56 host2 sshd[3413380]: Disconnected from invalid user deploy 103.80.27.53 port 44396 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.166
country_id: 2993457
description:
Nov 26 05:38:05 host2 pure-ftpd[3417530]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 05:38:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<finance@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<rhnLMXREyKkXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.83.31
country_id: 2245662
description:
Nov 26 05:38:47 host2 sshd[3418213]: Disconnected from invalid user foundry 154.125.83.31 port 33291 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.250
country_id: 2510769
description:
Nov 26 05:40:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=139.28.190.250, lip=66.85.158.91, TLS, session=<NG/xNnRERcqLHL76>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.2.0
country_id: 690791
description:
Nov 26 05:40:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=176.103.2.0, lip=66.85.158.91, TLS, session=<gSgXOHRE7pWwZwIA>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.80.27.53
country_id: 1819730
description:
Nov 26 05:40:49 host2 sshd[3420734]: Disconnected from invalid user guest 103.80.27.53 port 43186 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.15.96
country_id: 6252001
description:
Nov 26 05:41:54 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=20.163.15.96, lip=66.85.158.91, session=<g8twPnREHOIUow9g>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 1819730
description:
Nov 26 05:41:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ceylondigest.com>, method=PLAIN, rip=196.251.100.48, lip=66.85.158.91, session=<gDRJPnRE+MrE+2Qw>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 144.31.221.126
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 144.31.221.126 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.125.83.31
country_id: 2245662
description:
Nov 26 05:48:34 host2 sshd[3429035]: Disconnected from invalid user botuser 154.125.83.31 port 54129 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.235.121.84
country_id: 6252001
description:
Nov 26 05:49:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.235.121.84, lip=66.85.158.92, session=<tl9SWnRENrNK63lU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-26 05:53:25 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:56232: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 05:54:31 host2 sshd[3435449]: Disconnected from invalid user kaylan 62.60.131.157 port 7726 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 06:02:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<office@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<CG7ciHRE6tAXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.125.83.31
country_id: 2245662
description:
Nov 26 06:03:21 host2 sshd[3442994]: Disconnected from invalid user int 154.125.83.31 port 35370 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-11-26 06:05:19 dovecot_login authenticator failed for (223-197-145-141.static.imsbiz.com) [223.197.145.141]:56571: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-26 06:05:48 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:48749: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.108.42.241
country_id: 6252001
description:
2025-11-26 06:06:30 dovecot_login authenticator failed for ([75.108.42.241]) [75.108.42.241]:37248: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-11-26 06:06:55 dovecot_login authenticator failed for ([125.19.175.124]) [182.78.240.94]:50096: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.181
country_id: 6252001
description:
Nov 26 06:08:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.181, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<E4efnnREssbG6xi1>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 86.54.31.42
country_id: 6251999
description:
Nov 26 06:13:40 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=86.54.31.42, lip=66.85.158.92, session=<UkEGsHREBJ5WNh8q>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.42
country_id: 6251999
description:
Nov 26 06:13:42 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.42, lip=66.85.158.92, session=<Pm0jsHRETqZWNh8q>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.106.87.128
country_id: 3469034
description:
Nov 26 06:14:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@weeratrading.com>, method=PLAIN, rip=179.106.87.128, lip=66.85.158.91, TLS, session=<sb0Zs3RED7izaleA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.182.148.37
country_id: 3658394
description:
Nov 26 06:15:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=201.182.148.37, lip=66.85.158.91, TLS, session=<9JVXtHREIbDJtpQl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.154.194.5
country_id: 2921044
description:
Nov 26 06:15:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 29 secs): user=<>, rip=207.154.194.5, lip=66.85.158.92, TLS handshaking: Connection closed, session=<gatHuHREXkDPmsIF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 06:20:15 host2 sshd[3456614]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 06:22:12 host2 sshd[3457834]: Disconnected from invalid user user 2.57.121.25 port 10061 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2025-11-26 06:24:31 dovecot_login authenticator failed for ([117.247.239.202]) [122.160.142.194]:55582: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-11-26 06:24:45 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:36982: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.69.10.175
country_id: 6252001
description:
Nov 26 06:30:21 host2 sshd[3464018]: Invalid user cloudtourssrilan_travel from 38.69.10.175 port 63803


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.58
country_id: 6252001
description:
Nov 26 06:32:50 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.58, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<NH6Z9HREj82TuYQ6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.61.10.62
country_id: 3865483
description:
Nov 26 06:37:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=179.61.10.62, lip=66.85.158.91, TLS, session=<bOc6BHVE5q+zPQo+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.236
country_id: 690791
description:
Nov 26 06:37:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=176.103.5.236, lip=66.85.158.91, TLS, session=<JtxtBXVE9s+wZwXs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.179.135
country_id: 2921044
description:
Nov 26 06:42:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.197.179.135, lip=66.85.158.92, TLS, session=<dvDZFnVE+CaKxbOH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.99
country_id: 2635167
description:
Nov 26 06:42:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.99, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<7OZVF3VER8e594lj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.81
country_id: 2635167
description:
Nov 26 06:42:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.81, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<sptaFXVELYpX7LBR>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.242
country_id: 2635167
description:
Nov 26 06:41:59 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.242, lip=66.85.158.92, TLS, session=<fzFHFXVE+bxX7LDy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.60.193
country_id: 1819730
description:
Nov 26 06:42:44 host2 sshd[3473268]: Disconnected from invalid user update 43.154.60.193 port 41126 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.98
country_id: 2635167
description:
Nov 26 06:43:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.98, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<m0RRGXVEbY+594li>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 26 06:43:26 host2 sshd[3473806]: Disconnected from invalid user sinusbot 144.48.8.10 port 40342 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.105
country_id: 2635167
description:
Nov 26 06:43:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.105, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<K51MG3VE47y594lp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.89
country_id: 2635167
description:
Nov 26 06:44:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.89, lip=66.85.158.92, TLS handshaking: Connection closed, session=<9OFHHXVEddG594lZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.246
country_id: 6252001
description:
Nov 26 06:44:28 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.246, lip=66.85.158.91, TLS, session=<clA1HnVEpvTG6xj2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.81
country_id: 2635167
description:
Nov 26 06:44:46 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.81, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<CWJBH3VES4a594lR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.85
country_id: 2635167
description:
Nov 26 06:45:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.85, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<usg+IXVEr+q594lV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.82
country_id: 2635167
description:
Nov 26 06:46:26 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=185.247.137.82, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<CHMzJXVEf+2594lS>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.60.193
country_id: 1819730
description:
Nov 26 06:46:29 host2 sshd[3476397]: Disconnected from invalid user odoo 43.154.60.193 port 53234 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.85
country_id: 2635167
description:
Nov 26 06:45:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.85, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xQc6I3VEIcS594lV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 26 06:46:52 host2 sshd[3476720]: Disconnected from invalid user user01 144.48.8.10 port 35042 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.93
country_id: 2635167
description:
Nov 26 06:46:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.93, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<FsQuJ3VET7JX7LBd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.154.60.193
country_id: 1819730
description:
Nov 26 06:47:51 host2 sshd[3477362]: Disconnected from invalid user aa 43.154.60.193 port 58746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 26 06:48:05 host2 sshd[3477528]: Disconnected from invalid user soporte 144.48.8.10 port 33520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.60.193
country_id: 1819730
description:
Nov 26 06:50:30 host2 sshd[3479391]: Disconnected from invalid user Test 43.154.60.193 port 35234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 26 06:50:23 host2 sshd[3479335]: Disconnected from invalid user hu 144.48.8.10 port 58740 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.154.60.193
country_id: 1819730
description:
Nov 26 06:51:46 host2 sshd[3480267]: Disconnected from invalid user user01 43.154.60.193 port 41970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 144.48.8.10
country_id: 1861060
description:
Nov 26 06:52:41 host2 sshd[3480808]: Disconnected from invalid user devuser 144.48.8.10 port 55706 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.63
country_id: 1210997
description:
2025-11-26 06:53:02 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.63]:46877: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 06:54:43 host2 sshd[3483046]: Disconnected from invalid user admin 2.57.121.112 port 12040 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.114.21.51
country_id: 2328926
description:
2025-11-26 06:59:40 dovecot_plain authenticator failed for (lentelly) [105.114.21.51]:35369: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.79
country_id: 6252001
description:
Nov 26 06:59:54 host2 pure-ftpd[3486430]: (?@205.210.31.79) [INFO] New connection from 205.210.31.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.60.115
country_id: 6252001
description:
2025-11-26 07:00:39 dovecot_login authenticator failed for wsip-68-225-60-115.pn.at.cox.net [68.225.60.115]:51682: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 07:05:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Dh/SanVEQOcXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 26 07:10:21 host2 sshd[3495048]: Disconnected from invalid user user1 45.78.223.11 port 59956 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.100
country_id: 3175395
description:
Nov 26 07:11:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=185.15.171.100, lip=66.85.158.91, TLS, session=<klVsfXVE57+5D6tk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.246.73.51
country_id: 3277605
description:
Nov 26 07:11:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=188.246.73.51, lip=66.85.158.91, TLS, session=<JEaMfnVEK8289kkz>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.78.39
country_id: 6252001
description:
Nov 26 07:15:06 host2 sshd[3499224]: Disconnected from invalid user openbravo 107.172.78.39 port 59576 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.78.39
country_id: 6252001
description:
Nov 26 07:16:07 host2 sshd[3500021]: Disconnected from invalid user ubuntu 107.172.78.39 port 52238 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 26 07:16:42 host2 sshd[3500423]: Disconnected from invalid user castle 45.78.223.11 port 59646 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 26 07:19:23 host2 sshd[3502590]: Disconnected from invalid user ts3 45.78.223.11 port 60512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.78.39
country_id: 6252001
description:
Nov 26 07:20:31 host2 sshd[3503681]: Disconnected from invalid user redmine 107.172.78.39 port 39552 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 07:22:44 host2 sshd[3505384]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 07:30:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<DKdewXVEYpQXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 26 07:29:47 host2 sshd[3511143]: Disconnected from invalid user ionadmin 45.78.223.11 port 40882 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 26 07:30:15 host2 pure-ftpd[3511755]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.73
country_id: 2635167
description:
Nov 26 07:31:31 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.73, lip=66.85.158.92, TLS, session=<QOFwxnVEC5+594lJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.105.176
country_id: 3469034
description:
Nov 26 07:33:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=187.120.105.176, lip=66.85.158.91, TLS, session=<kPHvzXVEvpK7eGmw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.7
country_id: 1880251
description:
Nov 26 07:34:48 host2 sshd[3514858]: Disconnected from invalid user abhi 45.78.205.7 port 41374 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.107.76
country_id: 3865483
description:
Nov 26 07:34:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=45.238.107.76, lip=66.85.158.91, TLS, session=<BNlIz3VE3eAt7mtM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.74.192.200
country_id: 2186224
description:
2025-11-26 07:36:17 dovecot_login authenticator failed for ([202.74.192.200]) [202.74.192.200]:49819: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-11-26 07:36:59 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:59736: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.39.177
country_id: 1861060
description:
2025-11-26 07:37:20 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [138.199.39.177]:14627: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 26 07:39:04 host2 sshd[3518362]: Disconnected from invalid user user 2.57.121.25 port 49509 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 07:39:12 host2 sshd[3518511]: Disconnected from invalid user  2.57.121.112 port 62916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.223.11
country_id: 1880251
description:
Nov 26 07:42:51 host2 sshd[3521749]: Disconnected from invalid user hu 45.78.223.11 port 59140 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.137
country_id: 2635167
description:
Nov 26 07:51:11 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.137, lip=66.85.158.91, TLS, session=<rS7FDHZEv4O594mJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.83
country_id: 2635167
description:
Nov 26 07:51:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.83, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<lhtBDXZEUcdX7LBT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.90
country_id: 2635167
description:
Nov 26 07:51:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.90, lip=66.85.158.91, TLS handshaking: Connection closed, session=<uRVGD3ZEf8RX7LBa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.82
country_id: 2635167
description:
Nov 26 07:52:27 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.82, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<lgdJEXZE85VX7LBS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.78
country_id: 2635167
description:
Nov 26 07:52:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.78, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<4lk+E3ZEqYG594lO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.87
country_id: 2635167
description:
Nov 26 07:54:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.87, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<GgI1F3ZEA6RX7LBX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.80
country_id: 2635167
description:
Nov 26 07:53:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.80, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<9XY7FXZEj6q594lQ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.97
country_id: 2635167
description:
Nov 26 07:54:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.97, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<H8UyGXZEAZK594lh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.90
country_id: 2635167
description:
Nov 26 07:55:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=87.236.176.90, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<zgMuG3ZEn9tX7LBa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.105
country_id: 2635167
description:
Nov 26 07:56:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.105, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<PnskH3ZEkcG594lp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.65
country_id: 6252001
description:
Nov 26 08:01:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.65, lip=66.85.158.92, session=<uaG9MXZE5OnN0h9B>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.226.46
country_id: 1643084
description:
Nov 26 08:09:40 host2 sshd[3539559]: Invalid user cloudtourssrilan_travel from 182.8.226.46 port 40849


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.226.46
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.8.226.46 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-26 08:10:40 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:55116: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-11-26 08:11:34 dovecot_login authenticator failed for (cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:49430: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-26 08:11:49 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:53702: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-11-26 08:12:02 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:52358: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-26 08:12:26 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:47043: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 08:12:43 host2 sshd[3541673]: Disconnected from invalid user admin 2.57.121.112 port 40901 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:12:57 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<md2YWnZE0pkDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:13:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<eABQXHZEMOEDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 08:14:22 host2 sshd[3542783]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:14:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<j7qwYXZEBOgDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:15:24 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5VRnY3ZEcuMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:17:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<K6F+aXZEwOYDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:18:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<XUi8bnZEeJEDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.226.46
country_id: 1643084
description:
Nov 26 08:18:38 host2 sshd[3545290]: Invalid user cloudtourssrilan_travel from 182.8.226.46 port 61506


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:19:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<3OcWc3ZEltMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 26 08:20:25 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<GrtadXZEvqgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.74.240.230
country_id: 2510769
description:
Nov 26 08:21:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=185.74.240.230, lip=66.85.158.91, TLS, session=<ac57dnZEDrK5SvDm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.117.102
country_id: 226074
description:
Nov 26 08:21:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=196.0.117.102, lip=66.85.158.91, TLS, session=<etegd3ZE8a/EAHVm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.116
country_id: 6252001
description:
Nov 26 08:26:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=199.45.154.116, lip=66.85.158.91, TLS: Connection closed, session=<3vyGjHZEaMzHLZp0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.7
country_id: 1880251
description:
Nov 26 08:29:50 host2 sshd[3551955]: Disconnected from invalid user devuser 45.78.205.7 port 55918 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-11-26 08:33:20 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:56282: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-11-26 08:33:44 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:37082: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 74.249.178.45
country_id: 6252001
description:
Nov 26 08:33:55 host2 pure-ftpd[3554467]: (?@74.249.178.45) [INFO] New connection from 74.249.178.45


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 08:42:48 host2 sshd[3559913]: Disconnected from invalid user  2.57.121.112 port 61831 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-26 08:48:19 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:39033: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-11-26 08:50:38 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:54940: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.0.150
country_id: 690791
description:
Nov 26 08:51:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=176.103.0.150, lip=66.85.158.91, TLS, session=<yejR4XZE6LawZwCW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.5.197
country_id: 2300660
description:
Nov 26 08:51:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=41.139.5.197, lip=66.85.158.91, TLS, session=<EOb14nZENa4piwXF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 145.220.0.84
country_id: 2750405
description:
Nov 26 08:52:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141F7065:SSL routines:final_key_share:no suitable key share (no auth attempts in 0 secs): user=<>, rip=145.220.0.84, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141F7065:SSL routines:final_key_share:no suitable key share, session=<erT05nZEbMiR3ABU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.232
country_id: 6252001
description:
Nov 26 08:52:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.232, lip=66.85.158.91, session=<vIcx6XZETOzG6xjo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-11-26 08:57:34 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:42158: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2025-11-26 08:57:54 dovecot_login authenticator failed for (fabfibernet.com) [192.81.229.179]:51730: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.167.160
country_id: 99237
description:
Nov 26 09:06:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=65.20.167.160, lip=66.85.158.91, TLS, session=<hWkcGXdE8LdBFKeg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.20.58.112
country_id: 798544
description:
Nov 26 09:07:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<587hr>, method=PLAIN, rip=46.20.58.112, lip=66.85.158.91, TLS, session=<MImZGndEub4uFDpw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.182.223
country_id: 1282988
description:
2025-11-26 09:08:39 dovecot_plain authenticator failed for (Q171B58071) [103.163.182.223]:31326: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 09:16:54 host2 sshd[3584632]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.110.64
country_id: 1819730
description:
Nov 26 09:19:40 host2 sshd[3586187]: Invalid user visionsolutionshospital from 154.219.110.64 port 59378


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.61
country_id: 6252001
description:
Nov 26 09:30:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 43 secs): user=<>, rip=162.216.150.61, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<X09ubndEH8qi2JY9>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.61
country_id: 6252001
description:
Nov 26 09:30:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.150.61, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<zit2b3dE1vOi2JY9>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.183.187.95
country_id: 2510769
description:
Nov 26 09:33:59 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=5.183.187.95, lip=66.85.158.91, TLS, session=<okhse3dED40Ft7tf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.211
country_id: 3175395
description:
Nov 26 09:34:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=171.22.235.211, lip=66.85.158.91, TLS, session=<clWDfHdEMq2rFuvT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.61
country_id: 6252001
description:
Nov 26 09:35:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.61, lip=66.85.158.92, TLS, session=<r07SgHdEvOSi2JY9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-26 09:36:17 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54893: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.138
country_id: 2635167
description:
Nov 26 09:42:50 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.138, lip=66.85.158.92, TLS, session=<CrUOnHdEh8i594mK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Nov 26 09:47:20 host2 sshd[3605460]: Disconnected from invalid user steam 103.143.238.207 port 47274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 26 09:47:24 host2 sshd[3605479]: Disconnected from invalid user superadmin 45.78.200.2 port 47764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 26 09:48:04 host2 sshd[3605916]: Disconnected from invalid user jrodrig 92.207.4.157 port 32832 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 26 09:50:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.63, lip=66.85.158.92, TLS: Connection closed, session=</V7etXdESGanXpI/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 26 09:50:11 host2 sshd[3607592]: Disconnected from invalid user mc 92.207.4.157 port 42022 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 26 09:50:47 host2 sshd[3607980]: Disconnected from invalid user minecraft 45.78.200.2 port 39476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Nov 26 09:51:02 host2 sshd[3608224]: Disconnected from invalid user guest123 103.143.238.207 port 57316 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.63
country_id: 6252001
description:
Nov 26 09:50:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=167.94.146.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<sAQ9tndEimanXpI/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 26 09:51:22 host2 sshd[3608391]: Disconnected from invalid user guest123 92.207.4.157 port 41194 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Nov 26 09:53:12 host2 sshd[3609575]: Disconnected from invalid user qwerty 103.143.238.207 port 54660 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.207.4.157
country_id: 2635167
description:
Nov 26 09:53:34 host2 sshd[3609794]: Disconnected from invalid user debianuser 92.207.4.157 port 39542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Nov 26 09:54:28 host2 sshd[3610741]: Disconnected from invalid user gitea 165.154.1.18 port 53276 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 26 09:55:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9/cAyndEwNoDjyE/>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.1.18
country_id: 1819730
description:
Nov 26 09:56:16 host2 sshd[3612329]: Disconnected from invalid user es 165.154.1.18 port 35334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.207
country_id: 1819730
description:
Nov 26 09:56:26 host2 sshd[3612439]: Disconnected from invalid user teamspeak 103.143.238.207 port 50690 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 26 09:56:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<5NGyy3dEUqADjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Nov 26 09:59:31 host2 sshd[3614510]: Disconnected from invalid user github 165.154.1.18 port 53554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 26 10:01:29 host2 sshd[3615481]: Disconnected from invalid user gitea 45.78.200.2 port 56714 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.120.168
country_id: 3865483
description:
Nov 26 10:02:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=190.181.120.168, lip=66.85.158.91, TLS, session=<i1yP4ndEV5u+tXio>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.2
country_id: 1880251
description:
Nov 26 10:02:54 host2 sshd[3617221]: Disconnected from invalid user es 45.78.200.2 port 33922 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.136.75
country_id: 99237
description:
Nov 26 10:02:30 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=65.20.136.75, lip=66.85.158.91, TLS, session=<lNFb4XdEFaBBFIhL>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.231
country_id: 3017382
description:
Nov 26 10:03:41 host2 pure-ftpd[3618069]: (?@91.196.152.231) [INFO] New connection from 91.196.152.231


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.158
country_id: 3017382
description:
Nov 26 10:03:41 host2 pure-ftpd[3618064]: (?@91.196.152.158) [INFO] New connection from 91.196.152.158


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 10:08:40 host2 sshd[3621659]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Nov 26 10:09:10 host2 sshd[3621984]: Disconnected from invalid user shiny 103.176.79.117 port 33766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 26 10:09:52 host2 sshd[3622421]: Disconnected from invalid user stack 125.21.53.232 port 39840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Nov 26 10:09:55 host2 sshd[3622445]: Disconnected from invalid user stperez 101.36.119.50 port 60434 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.26.130
country_id: 6252001
description:
Nov 26 10:10:20 host2 sshd[3623043]: Disconnected from invalid user taibabi 107.174.26.130 port 44926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 26 10:11:52 host2 sshd[3624014]: Disconnected from invalid user tuan 190.167.237.191 port 58266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Nov 26 10:11:40 host2 sshd[3623764]: Disconnected from invalid user testuser 103.176.79.117 port 33324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.236.98.101
country_id: 3469034
description:
2025-11-26 10:11:51 dovecot_login authenticator failed for (186-236-98-101.ntelecom.com.br) [186.236.98.101]:38311: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 26 10:12:24 host2 sshd[3624324]: Disconnected from invalid user desliga 125.21.53.232 port 60054 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-26 10:12:30 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:46326: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 26 10:13:50 host2 sshd[3625255]: Disconnected from invalid user hadoop 190.167.237.191 port 47264 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 26 10:13:34 host2 sshd[3625088]: Disconnected from invalid user ubuntu 125.21.53.232 port 52508 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.38
country_id: 6252001
description:
Nov 26 10:14:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<8c+2DnhErMjN0h8m>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 26 10:15:05 host2 sshd[3626143]: Disconnected from invalid user taibabi 190.167.237.191 port 57710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 10:14:09 host2 sshd[3625433]: Disconnected from invalid user houston 62.60.131.157 port 14565 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.21.53.232
country_id: 1269750
description:
Nov 26 10:14:46 host2 sshd[3625815]: Disconnected from invalid user django 125.21.53.232 port 36602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Nov 26 10:15:49 host2 sshd[3626629]: Disconnected from invalid user amssys 103.63.25.203 port 60434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.119.50
country_id: 1819730
description:
Nov 26 10:16:05 host2 sshd[3626808]: Disconnected from invalid user ali 101.36.119.50 port 49704 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.174.26.130
country_id: 6252001
description:
Nov 26 10:16:32 host2 sshd[3627123]: Disconnected from invalid user django 107.174.26.130 port 45682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.176.79.117
country_id: 1643084
description:
Nov 26 10:17:17 host2 sshd[3627717]: Disconnected from invalid user samba 103.176.79.117 port 33234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.119.50
country_id: 1819730
description:
Nov 26 10:17:19 host2 sshd[3627784]: Disconnected from invalid user superadmin 101.36.119.50 port 41884 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.167.237.191
country_id: 3508796
description:
Nov 26 10:17:31 host2 sshd[3627909]: Disconnected from invalid user halo 190.167.237.191 port 45248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.63.25.203
country_id: 1643084
description:
Nov 26 10:19:11 host2 sshd[3629148]: Disconnected from invalid user dixi 103.63.25.203 port 43766 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Nov 26 10:19:34 host2 sshd[3629548]: Disconnected from invalid user nominatim 160.251.197.41 port 43870 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.63.25.203
country_id: 1643084
description:
Nov 26 10:20:48 host2 sshd[3630736]: Disconnected from invalid user runner 103.63.25.203 port 56492 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Nov 26 10:25:38 host2 sshd[3634327]: Disconnected from invalid user sens 160.251.197.41 port 59150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-11-26 10:26:23 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (forly) [73.208.81.125]:33468: 535 Incorrect authentication data (set_id=chris@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:26:41 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<YaPeOHhEwJoDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.197.41
country_id: 1861060
description:
Nov 26 10:27:42 host2 sshd[3635899]: Disconnected from invalid user deamon 160.251.197.41 port 47244 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.96.192.129
country_id: 3865483
description:
Nov 26 10:27:54 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=186.96.192.129, lip=66.85.158.91, TLS, session=<+wYbPHhEAoK6YMCB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.140.92
country_id: 99237
description:
Nov 26 10:28:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=65.20.140.92, lip=66.85.158.91, TLS, session=<1+BUPXhEXdBBFIxc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:30:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<a3UtRXhEOIoDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.197.41
country_id: 1861060
description:
Nov 26 10:29:44 host2 sshd[3637402]: Disconnected from invalid user dixi 160.251.197.41 port 50300 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:32:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YwR5THhE1r4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:33:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<wQVWUXhE4OMDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 10:33:55 host2 sshd[3640384]: Disconnected from invalid user moth3r 2.57.121.112 port 61611 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:35:34 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<wmKsWHhESNoDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:37:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<uycvXnhEZNADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:37:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wFO7YHhEhpEDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.172
country_id: 3175395
description:
Nov 26 10:38:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=185.197.8.172, lip=66.85.158.91, TLS, session=<IeGjYHhED+q5xQis>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.179.228.33
country_id: 798544
description:
Nov 26 10:38:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts2>, method=PLAIN, rip=31.179.228.33, lip=66.85.158.91, TLS, session=<xwHMYXhECd4fs+Qh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.34.57
country_id: 3865483
description:
Nov 26 10:39:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=45.227.34.57, lip=66.85.158.91, TLS, session=<6MQdZXhEBtMt4yI5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 10:39:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<rktxZnhEdrUDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.218
country_id: 3175395
description:
Nov 26 10:39:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts>, method=PLAIN, rip=185.15.170.218, lip=66.85.158.91, TLS, session=<rEKkZnhEuM65D6ra>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-11-26 10:41:21 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (acturs) [73.208.81.125]:45676: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.114
country_id: 6252001
description:
Nov 26 10:44:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.114, lip=66.85.158.91, TLS, session=<RPFCeHhEiOGTuYRy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.147.87
country_id: 690791
description:
Nov 26 10:49:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=37.221.147.87, lip=66.85.158.91, TLS, session=<qM/TinhE5cIl3ZNX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.58.65.156
country_id: 1269750
description:
Nov 26 10:50:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=103.58.65.156, lip=66.85.158.91, TLS, session=<YQbzi3hE6oVnOkGc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Nov 26 10:58:36 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.56, lip=66.85.158.91, TLS: Connection closed, session=<w34Gq3hEGgunXpI4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 11:07:09 host2 sshd[3663752]: Disconnected from invalid user lamont 62.60.131.157 port 34199 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-26 11:10:16 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (fulinostic) [73.195.211.98]:35444: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 11:11:32 host2 sshd[3667024]: Disconnected from invalid user admin 2.57.121.112 port 9792 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.21
country_id: 1733045
description:
2025-11-26 11:13:05 dovecot_login authenticator failed for ([49.124.152.21]) [49.124.152.21]:48774: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-26 11:12:35 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:47814: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 26 11:18:08 host2 sshd[3670905]: Disconnected from invalid user ubuntu 68.183.93.67 port 35052 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 26 11:19:31 host2 sshd[3671583]: Disconnected from invalid user abhi 68.183.93.67 port 38606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 26 11:22:03 host2 sshd[3673210]: Disconnected from invalid user halo 68.183.93.67 port 54046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.93.67
country_id: 1269750
description:
Nov 26 11:23:18 host2 sshd[3673912]: Disconnected from invalid user mcserver 68.183.93.67 port 55930 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.142
country_id: 3175395
description:
Nov 26 11:23:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info>, method=PLAIN, rip=185.197.9.142, lip=66.85.158.91, TLS, session=<Qh4wA3lEsZS5xQmO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.229.225.51
country_id: 1269750
description:
Nov 26 11:23:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=43.229.225.51, lip=66.85.158.91, TLS, session=<aZ4BAnlEu5Er5eEz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 11:30:48 host2 sshd[3678772]: Disconnected from invalid user lamont 62.60.131.157 port 64849 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 11:32:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<hWgwJXlEpIMXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.123
country_id: 2635167
description:
Nov 26 11:33:40 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.211.123, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<xIN3KHlEfdQjy9N7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.123
country_id: 2635167
description:
Nov 26 11:34:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.211.123, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<K1NALHlEzv8jy9N7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.123
country_id: 2635167
description:
Nov 26 11:35:13 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 25 secs): user=<>, rip=35.203.211.123, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<VWH6LXlE3P8jy9N7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-26 11:38:37 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:46764: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.149.211
country_id: 1522867
description:
2025-11-26 11:38:30 dovecot_login authenticator failed for (comp148-211.2day.kz) [85.29.149.211]:48836: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.123
country_id: 2635167
description:
Nov 26 11:41:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.123, lip=66.85.158.91, TLS, session=<7sn6QnlE7u0jy9N7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.123
country_id: 2635167
description:
Nov 26 11:41:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.211.123, lip=66.85.158.91, TLS, session=<6UqLRXlEGOcjy9N7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.66.6.92
country_id: 953987
description:
Nov 26 11:45:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.66.6.92, lip=66.85.158.91, TLS, session=<PAADU3lEH5NmQgZc>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.240.98.134
country_id: 3469034
description:
Nov 26 11:45:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=191.240.98.134, lip=66.85.158.91, TLS, session=<VHDIUXlECLe/8GKG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 11:52:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Ar1ZbXlE2qQXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 26 11:57:05 host2 sshd[3699042]: Disconnected from invalid user student 103.52.115.25 port 54782 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 11:59:08 host2 sshd[3700528]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.102
country_id: 1643084
description:
Nov 26 11:58:12 host2 sshd[3699858]: Disconnected from invalid user old 103.67.78.102 port 59696 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 26 11:58:34 host2 sshd[3700120]: Disconnected from invalid user hamed 103.52.115.25 port 47526 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.99
country_id: 6252001
description:
2025-11-26 12:00:17 dovecot_login authenticator failed for ([70.174.168.99]) [70.174.168.99]:47690: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-26 12:00:38 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:39340: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.102
country_id: 1643084
description:
Nov 26 12:00:49 host2 sshd[3702116]: Disconnected from invalid user sopuser 103.67.78.102 port 36526 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.67.78.102
country_id: 1643084
description:
Nov 26 12:02:03 host2 sshd[3703011]: Disconnected from invalid user fan 103.67.78.102 port 53542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 26 12:01:17 host2 sshd[3702458]: Disconnected from invalid user user 103.52.115.25 port 37822 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.115.25
country_id: 1668284
description:
Nov 26 12:02:48 host2 sshd[3703547]: Disconnected from invalid user testftp 103.52.115.25 port 35896 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.67.78.102
country_id: 1643084
description:
Nov 26 12:04:51 host2 sshd[3705781]: Disconnected from invalid user qwerty 103.67.78.102 port 58264 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.98.174
country_id: 798544
description:
Nov 26 12:16:08 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@weeratrading.com>, method=PLAIN, rip=178.219.98.174, lip=66.85.158.91, TLS, session=<IvpRv3lES7ey22Ku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.175
country_id: 3469034
description:
Nov 26 12:16:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=190.89.136.175, lip=66.85.158.91, TLS, session=<McNwwHlEupu+WYiv>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 44.220.188.117
country_id: 6252001
description:
Nov 26 12:21:47 host2 pure-ftpd[3719458]: (?@44.220.188.117) [INFO] New connection from 44.220.188.117


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-26 12:23:24 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (radays) [87.103.126.54]:36493: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 12:23:51 host2 sshd[3720781]: Disconnected from invalid user reuben 62.60.131.157 port 17423 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 12:28:29 host2 sshd[3723804]: Disconnected from invalid user admin 2.57.121.112 port 47335 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.241.212.143
country_id: 2802361
description:
Nov 26 12:31:30 host2 pure-ftpd[3725863]: (?@35.241.212.143) [INFO] New connection from 35.241.212.143


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.118
country_id: 6252001
description:
Nov 26 12:33:18 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.118, lip=66.85.158.92, TLS: Connection closed, session=<P/mt/XlEXH9ChJl2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 18.222.201.82
country_id: 6252001
description:
Nov 26 12:34:01 host2 pure-ftpd[3727399]: (?@18.222.201.82) [INFO] New connection from 18.222.201.82


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.222.201.82
country_id: 6252001
description:
Nov 26 12:34:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=18.222.201.82, lip=66.85.158.92, TLS handshaking: Connection closed, session=<38deAHpEmLAS3slS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-11-26 12:40:14 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:37412: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-11-26 12:40:49 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:50352: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:45:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<YB+hKXpERJUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:46:36 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<dSo+LXpEEtIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:47:54 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<BJLwMXpEzs8DgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.222
country_id: 1643084
description:
Nov 26 12:48:25 host2 sshd[3739297]: Disconnected from invalid user prueba 203.145.34.222 port 55394 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.93.140.162
country_id: 6252001
description:
2025-11-26 12:48:47 dovecot_plain authenticator failed for (nottante) [24.93.140.162]:35222: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:48:59 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<GLrENXpEUJsDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 203.145.34.222
country_id: 1643084
description:
Nov 26 12:49:48 host2 sshd[3740419]: Disconnected from invalid user ubuntu 203.145.34.222 port 35240 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:49:53 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<jVkFOXpEJJwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:51:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<flxNPnpE4MwDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.179.104
country_id: 3175395
description:
Nov 26 12:52:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=217.26.179.104, lip=66.85.158.91, TLS, session=<nNrHQXpEDJ3ZGrNo>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:52:56 host2 dovecot[3107204]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<UhDmQ3pEhrUDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.177
country_id: 3469034
description:
Nov 26 12:52:18 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=187.120.72.177, lip=66.85.158.91, TLS, session=<bd6PQHpEDd27eEix>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:52:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<7pbOQXpEkJcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:53:59 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<ftmuR3pEKIcDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.120.89
country_id: 1605651
description:
Nov 26 12:54:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.120.89, lip=66.85.158.92, session=<5t5ESHpEyKOlmnhZ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.120.89
country_id: 1605651
description:
Nov 26 12:54:10 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.120.89, lip=66.85.158.92, session=<oXpYSHpEmKSlmnhZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.222
country_id: 1643084
description:
Nov 26 12:53:37 host2 sshd[3743788]: Disconnected from invalid user www 203.145.34.222 port 44932 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:53:54 host2 dovecot[3107204]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<fX5fR3pEQsIDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 26 12:54:55 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<etX/SnpEBqEDgmBb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 13:12:33 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<PFvziXpENr0XXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.132
country_id: 6252001
description:
Nov 26 13:23:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.132, lip=66.85.158.92, session=<mbYTsnpEBCRAPpyE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-11-26 13:25:21 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (cagnetkis) [68.82.141.145]:33258: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-26 13:25:31 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52296: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 13:29:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<+Jc1xXpEFJwXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.222.34
country_id: 1269750
description:
Nov 26 13:33:49 host2 sshd[3778872]: Disconnected from invalid user django 202.137.222.34 port 48802 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.80.42.136
country_id: 3469034
description:
Nov 26 13:35:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=170.80.42.136, lip=66.85.158.91, TLS, session=<o7F92npEkoGqUCqI>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.33
country_id: 953987
description:
Nov 26 13:35:46 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info>, method=PLAIN, rip=102.129.60.33, lip=66.85.158.91, TLS, session=<+TDO23pEx9pmgTwh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.222.34
country_id: 1269750
description:
Nov 26 13:35:53 host2 sshd[3780823]: Disconnected from invalid user backend 202.137.222.34 port 54224 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.137.222.34
country_id: 1269750
description:
Nov 26 13:37:22 host2 sshd[3782148]: Disconnected from invalid user manager 202.137.222.34 port 51050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-26 13:37:31 dovecot_plain authenticator failed for (impureore) [64.72.74.162]:44868: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.137.222.34
country_id: 1269750
description:
Nov 26 13:40:19 host2 sshd[3784514]: Disconnected from invalid user casaos 202.137.222.34 port 34000 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.235
country_id: 6252001
description:
Nov 26 13:41:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.235, lip=66.85.158.91, TLS: Connection closed, session=<5a3t73pEsoJHBobr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.53
country_id: 6252001
description:
Nov 26 13:48:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.53, lip=66.85.158.92, TLS, session=<1+rjC3tEav3N0h81>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 13:50:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<support@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<+HfNEntEerQXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 14:03:30 host2 sshd[3804814]: Disconnected from invalid user antoinette 62.60.131.157 port 7235 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 14:06:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<MLDJSXtE9uMXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.135
country_id: 6252001
description:
Nov 26 14:18:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.135, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<aZopd3tEitmTuYSH>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.41.47
country_id: 1819730
description:
Nov 26 14:23:00 host2 pure-ftpd[3821119]: (?@165.154.41.47) [INFO] New connection from 165.154.41.47


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 14:23:05 host2 sshd[3821196]: Disconnected from invalid user demo 2.57.121.112 port 61999 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.217.231
country_id: 3469034
description:
Nov 26 14:26:38 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=177.87.217.231, lip=66.85.158.91, TLS, session=<IBPgkXtEY9mxV9nn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.160
country_id: 798544
description:
Nov 26 14:26:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=46.227.39.160, lip=66.85.158.91, TLS, session=<bcAYk3tE+dEu4yeg>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 14:28:11 host2 sshd[3824491]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-26 14:31:43 dovecot_plain authenticator failed for (anticingue) [178.250.191.189]:59260: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Nov 26 14:34:39 host2 sshd[3828778]: Disconnected from invalid user zjw 162.240.212.247 port 43620 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.240.212.247
country_id: 6252001
description:
Nov 26 14:38:19 host2 sshd[3831341]: Disconnected from invalid user free 162.240.212.247 port 59184 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Nov 26 14:39:43 host2 sshd[3832177]: Disconnected from invalid user ubuntu 162.240.212.247 port 33204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.240.212.247
country_id: 6252001
description:
Nov 26 14:41:04 host2 sshd[3833226]: Disconnected from invalid user postgres 162.240.212.247 port 35478 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.104
country_id: 1880251
description:
Nov 26 14:43:05 host2 sshd[3834635]: Disconnected from invalid user g 45.78.197.104 port 51102 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 152.32.154.182
country_id: 1643084
description:
Nov 26 14:43:13 host2 pure-ftpd[3834774]: (?@152.32.154.182) [INFO] New connection from 152.32.154.182


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.232.175
country_id: 1605651
description:
Nov 26 14:43:22 host2 pure-ftpd[3834933]: (?@165.154.232.175) [INFO] New connection from 165.154.232.175


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.197.104
country_id: 1880251
description:
Nov 26 14:45:29 host2 sshd[3836830]: Disconnected from invalid user ubuntu 45.78.197.104 port 51522 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-11-26 14:49:21 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (sessided) [67.173.58.47]:54080: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.197.104
country_id: 1880251
description:
Nov 26 14:55:07 host2 sshd[3843648]: Disconnected from invalid user free 45.78.197.104 port 37284 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.2
country_id: 3175395
description:
Nov 26 15:01:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<info@saara.lk>, method=PLAIN, rip=185.15.171.2, lip=66.85.158.91, TLS, session=<h9MrDXxEg+i5D6sC>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.141
country_id: 6252001
description:
Nov 26 15:01:44 host2 pure-ftpd[3847706]: (?@66.132.153.141) [INFO] New connection from 66.132.153.141


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.51.196
country_id: 953987
description:
Nov 26 15:01:35 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info>, method=PLAIN, rip=102.129.51.196, lip=66.85.158.91, TLS, session=<8YfJDnxE/uJmgTPE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.225
country_id: 6252001
description:
Nov 26 15:04:21 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.225, lip=66.85.158.92, session=<oznrGXxEE8jDuEzh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.1
country_id: 6252001
description:
Nov 26 15:04:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.1, lip=66.85.158.92, session=<dT+SGnxE053DuEwB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.227
country_id: 6252001
description:
Nov 26 15:04:38 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.227, lip=66.85.158.92, session=<tabsGnxEx+LDuEzj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 15:06:05 host2 sshd[3851353]: Disconnected from invalid user admin 2.57.121.112 port 8110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.137.51.181
country_id: 1269750
description:
2025-11-26 15:06:46 dovecot_plain authenticator failed for (6S73LVD8) [38.137.51.181]:26056: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.203.157.226
country_id: 357994
description:
2025-11-26 15:13:42 dovecot_plain authenticator failed for (E43HFC1) [156.203.157.226]:49323: 535 Incorrect authentication data (set_id=accounts.zoho.comsigninhr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 15:15:29 host2 sshd[3857451]: Disconnected from invalid user admin 2.57.121.112 port 61467 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 26 15:16:29 host2 sshd[3857927]: Disconnected from invalid user gg 43.163.123.45 port 54840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 15:19:13 host2 sshd[3859697]: Disconnected from invalid user rayna 62.60.131.157 port 10974 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-11-26 15:24:01 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:52128: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-11-26 15:23:34 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:41353: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 26 15:24:30 host2 sshd[3863309]: Disconnected from invalid user andy 43.163.123.45 port 38850 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.174
country_id: 3469034
description:
Nov 26 15:25:05 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=190.89.136.174, lip=66.85.158.91, TLS, session=<dGflYnxE+sa+WYiu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.36.21
country_id: 2395170
description:
Nov 26 15:25:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=154.127.36.21, lip=66.85.158.91, TLS, session=<Y/bOZXxEVoGafyQV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.116
country_id: 690791
description:
Nov 26 15:25:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=194.44.140.116, lip=66.85.158.91, TLS, session=<MR4gZHxEqdbCLIx0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.216.88.76
country_id: 3469034
description:
Nov 26 15:25:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info@saara.lk>, method=PLAIN, rip=186.216.88.76, lip=66.85.158.91, TLS, session=<P3yiZHxEhYC62FhM>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 26 15:25:41 host2 sshd[3864128]: Disconnected from invalid user cinema 43.163.123.45 port 37900 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.242.78.9
country_id: 3469034
description:
Nov 26 15:26:17 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=191.242.78.9, lip=66.85.158.91, TLS, session=<Z0czZ3xEsdS/8k4J>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.41
country_id: 3175395
description:
Nov 26 15:26:36 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=185.15.170.41, lip=66.85.158.91, TLS, session=<9pRuaHxECYO5D6op>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 26 15:26:58 host2 sshd[3864947]: Disconnected from invalid user astra 43.163.123.45 port 36958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.114
country_id: 1880251
description:
Nov 26 15:27:07 host2 sshd[3865052]: Disconnected from invalid user sipv 45.78.230.114 port 40206 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 15:29:13 host2 sshd[3866217]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.163.123.45
country_id: 1880251
description:
Nov 26 15:29:26 host2 sshd[3866279]: Disconnected from invalid user testuser 43.163.123.45 port 35072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.114
country_id: 1880251
description:
Nov 26 15:29:49 host2 sshd[3866459]: Disconnected from invalid user roots 45.78.230.114 port 56732 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 188.137.84.161
country_id: 798544
description:
Nov 26 15:30:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<info@weeratrading.com>, method=PLAIN, rip=188.137.84.161, lip=66.85.158.91, TLS, session=<GYcBd3xEh5e8iVSh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.205.247
country_id: 3469034
description:
Nov 26 15:31:01 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=179.189.205.247, lip=66.85.158.91, TLS, session=<dk4deHxE37Kzvc33>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 202.51.214.98
country_id: 1643084
description:
Nov 26 15:36:34 host2 sshd[3870248]: Disconnected from invalid user erpnext 202.51.214.98 port 53650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.114
country_id: 1880251
description:
Nov 26 15:40:25 host2 sshd[3872799]: Disconnected from invalid user casaos 45.78.230.114 port 47788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Nov 26 15:41:09 host2 sshd[3873252]: Disconnected from invalid user daniel 83.229.122.23 port 37380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Nov 26 15:45:08 host2 sshd[3875915]: Disconnected from invalid user andy 83.229.122.23 port 42168 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 83.229.122.23
country_id: 1819730
description:
Nov 26 15:46:29 host2 sshd[3876957]: Disconnected from invalid user student 83.229.122.23 port 36358 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.229.122.23
country_id: 1819730
description:
Nov 26 15:49:00 host2 sshd[3878708]: Disconnected from invalid user abhi 83.229.122.23 port 53794 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 26 15:53:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<yPeeyXxE8uiLonQW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 207.166.174.63
country_id: 1880251
description:
Nov 26 15:54:50 host2 sshd[3883241]: Disconnected from invalid user gerrit 207.166.174.63 port 59998 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 207.166.174.63
country_id: 1880251
description:
Nov 26 16:00:12 host2 sshd[3886469]: Disconnected from invalid user deployer 207.166.174.63 port 33638 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 16:11:19 host2 sshd[3894117]: Disconnected from invalid user sky 62.60.131.157 port 39670 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.230.114
country_id: 1880251
description:
Nov 26 16:12:00 host2 sshd[3894458]: Disconnected from invalid user ionadmin 45.78.230.114 port 43438 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 16:17:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<support@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<JpqYH31EgucXXz9j>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.249.127.147
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.249.127.147 - maximsholdings "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.249.125.249
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.249.125.249 - maximsho "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsho (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.193.31
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.239.193.31 - awanish@maximsholdings.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.205.178
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.239.205.178 - maximsholdingsco "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maximsholdingsco (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 16:20:11 host2 sshd[3900791]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.59.158
country_id: 953987
description:
Nov 26 16:20:36 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<info@weeratrading.com>, method=PLAIN, rip=102.129.59.158, lip=66.85.158.91, TLS, session=<FalZKX1EsIhmgTue>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.151
country_id: 2510769
description:
Nov 26 16:20:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info>, method=PLAIN, rip=139.28.190.151, lip=66.85.158.91, TLS, session=<UXu6Kn1EfL2LHL6X>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.218
country_id: 3017382
description:
Nov 26 16:24:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.218, lip=66.85.158.92, session=<J04QOn1EYaBbxJja>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 16:25:05 host2 sshd[3903721]: Disconnected from invalid user admin 2.57.121.112 port 22741 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.190
country_id: 3017382
description:
Nov 26 16:24:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.196.152.190, lip=66.85.158.92, session=<0S9oOX1EA9BbxJi+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.190
country_id: 3017382
description:
Nov 26 16:25:09 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.190, lip=66.85.158.92, session=<d8PeOn1EKdpbxJi+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.218
country_id: 3017382
description:
Nov 26 16:25:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.218, lip=66.85.158.92, session=<SVERO31Ec+ZbxJja>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 16:26:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<jneDQH1E7osXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 26 16:36:31 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, session=<ng6EY31EguFHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 26 16:36:32 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, session=<wNuRY31EvuNHBpKC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
country_id: 1269750
description:
2025-11-26 16:38:14 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:54456: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
country_id: 290557
description:
2025-11-26 16:38:23 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:51309: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.135.53
country_id: 1168579
description:
Nov 26 16:41:38 host2 sshd[3915659]: Disconnected from invalid user root2 116.71.135.53 port 52298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.71.135.53
country_id: 1168579
description:
Nov 26 16:48:17 host2 sshd[3919829]: Disconnected from invalid user vbox 116.71.135.53 port 52160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.71.135.53
country_id: 1168579
description:
Nov 26 16:54:54 host2 sshd[3925708]: Disconnected from invalid user import 116.71.135.53 port 50142 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 192.140.123.251
country_id: 3469034
description:
Nov 26 16:59:52 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@weeratrading.com>, method=PLAIN, rip=192.140.123.251, lip=66.85.158.91, TLS, session=<MRPhtX1Ew7bAjHv7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.11.89
country_id: 2300660
description:
Nov 26 17:00:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=41.139.11.89, lip=66.85.158.91, TLS, session=<Wnkht31E4b8piwtZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.17.208
country_id: 2921044
description:
Nov 26 17:05:07 host2 sshd[3932573]: Disconnected from invalid user suporte 104.248.17.208 port 57532 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 26 17:07:42 host2 sshd[3934130]: Disconnected from invalid user system 79.61.112.234 port 50714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 26 17:08:11 host2 sshd[3934363]: Disconnected from invalid user test 162.241.87.197 port 32986 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.248.17.208
country_id: 2921044
description:
Nov 26 17:09:06 host2 sshd[3935218]: Disconnected from invalid user bot 104.248.17.208 port 36106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.248.17.208
country_id: 2921044
description:
Nov 26 17:10:05 host2 sshd[3936094]: Disconnected from invalid user ajay 104.248.17.208 port 43134 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 26 17:10:46 host2 sshd[3936468]: Disconnected from invalid user train1 79.61.112.234 port 55886 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 26 17:14:06 host2 sshd[3938839]: Disconnected from invalid user tv 79.61.112.234 port 54508 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.235.18.24
country_id: 1269750
description:
Nov 26 17:14:21 host2 sshd[3938998]: Disconnected from invalid user github 172.235.18.24 port 35716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.61.112.234
country_id: 3175395
description:
Nov 26 17:15:17 host2 sshd[3939681]: Disconnected from invalid user aj 79.61.112.234 port 54052 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-26 17:16:49 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58801: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Nov 26 17:16:51 host2 sshd[3940559]: Disconnected from invalid user huawei 45.169.200.254 port 54154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 26 17:16:56 host2 sshd[3940597]: Disconnected from invalid user db2inst1 162.241.87.197 port 41244 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 17:17:08 host2 sshd[3940691]: Disconnected from invalid user admin1 2.57.121.112 port 61410 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.124
country_id: 1880251
description:
Nov 26 17:17:18 host2 sshd[3940814]: Disconnected from invalid user opc 45.78.203.124 port 57540 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.105.176.66
country_id: 1269750
description:
Nov 26 17:17:34 host2 sshd[3940903]: Disconnected from invalid user github 103.105.176.66 port 54306 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.235.18.24
country_id: 1269750
description:
Nov 26 17:19:04 host2 sshd[3941624]: Disconnected from invalid user gitea 172.235.18.24 port 34948 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 26 17:18:10 host2 sshd[3941199]: Disconnected from invalid user ubuntu 162.241.87.197 port 59538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.105.176.66
country_id: 1269750
description:
Nov 26 17:18:51 host2 sshd[3941504]: Disconnected from invalid user tecnopos 103.105.176.66 port 53840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-11-26 17:19:19 dovecot_plain authenticator failed for (haline) [65.20.133.4]:55555: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 26 17:19:23 host2 sshd[3941807]: Disconnected from invalid user admin 2.57.121.112 port 22462 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2025-11-26 17:19:24 dovecot_plain authenticator failed for (aggial) [24.104.225.201]:57783: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 26 17:19:29 host2 sshd[3941850]: Disconnected from invalid user ubuntu 162.241.87.197 port 41496 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Nov 26 17:19:44 host2 sshd[3942019]: Disconnected from invalid user nrk 45.169.200.254 port 51648 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 26 17:20:50 host2 sshd[3943051]: Disconnected from invalid user user 162.241.87.197 port 38196 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 17:21:25 host2 sshd[3943521]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.169.200.254
country_id: 3469034
description:
Nov 26 17:22:23 host2 sshd[3943978]: Disconnected from invalid user manager 45.169.200.254 port 49128 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.198.43.206
country_id: 6252001
description:
Nov 26 17:25:04 host2 sshd[3945487]: Disconnected from invalid user precio01 104.198.43.206 port 39234 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.116
country_id: 6252001
description:
Nov 26 17:25:42 host2 pure-ftpd[3946121]: (?@66.132.153.116) [INFO] New connection from 66.132.153.116


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.198.43.206
country_id: 6252001
description:
Nov 26 17:26:39 host2 sshd[3946910]: Disconnected from invalid user bitnami 104.198.43.206 port 49708 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.203.124
country_id: 1880251
description:
Nov 26 17:27:36 host2 sshd[3947821]: Disconnected from invalid user q 45.78.203.124 port 43180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.3.96.178
country_id: 3175395
description:
Nov 26 17:33:12 host2 sshd[3951862]: Disconnected from invalid user admin 79.3.96.178 port 49680 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.203.124
country_id: 1880251
description:
Nov 26 17:38:04 host2 sshd[3955751]: Disconnected from invalid user min 45.78.203.124 port 51610 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.150
country_id: 2510769
description:
Nov 26 17:45:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<info@saara.lk>, method=PLAIN, rip=139.28.190.150, lip=66.85.158.91, TLS, session=<W6yBWn5En7KLHL6W>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.50
country_id: 3469034
description:
Nov 26 17:46:19 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info>, method=PLAIN, rip=191.53.130.50, lip=66.85.158.91, TLS, session=<nln1W35EC96/NYIy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 17:48:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<order@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<JFtSZX5EwoQXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.113
country_id: 3469034
description:
Nov 26 17:49:04 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=187.120.72.113, lip=66.85.158.91, TLS, session=<V0LiZX5ETZW7eEhx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.49.95.30
country_id: 3469034
description:
Nov 26 17:49:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=179.49.95.30, lip=66.85.158.91, TLS, session=<oSspZ35EU5OzMV8e>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 17:50:21 host2 sshd[3967014]: Disconnected from invalid user layne 62.60.131.157 port 24438 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:52:56 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<OS/RdH5E/KMDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 26 17:54:03 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Xl2seH5EMtQXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:54:08 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<7MgceX5EkrUDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-11-26 17:56:04 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (oventivil) [73.183.74.177]:51852: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:55:35 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<egpHfn5EOqoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:56:45 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<11Z3gn5Eko8DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:57:20 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<58WJhH5EcswDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 17:58:33 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<o/jpiH5EruoDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 18:00:25 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<nT+Lj35EFLoDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 18:00:30 host2 dovecot[3107204]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<ofPaj35EqoYDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 18:01:43 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<trg6lH5EsKsDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 18:02:10 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<sjrMlX5E8LwDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 26 18:03:22 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<GhcXmn5E2tQDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-26 18:08:57 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (dinelizes) [71.62.34.216]:36180: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 26 18:12:22 host2 sshd[3983957]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.100.80.112
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 212.100.80.112 - simpleengineerin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: User simpleengineerin has their account suspended. Login blocked.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.25
country_id: 3175395
description:
Nov 26 18:22:15 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=217.26.178.25, lip=66.85.158.91, TLS, session=<EWqY3H5EKZjZGrIZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.239.246
country_id: 798544
description:
Nov 26 18:22:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=109.125.239.246, lip=66.85.158.91, TLS, session=<hqXB3X5EUa5tfe/2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.213
country_id: 3469034
description:
Nov 26 18:28:13 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info@saara.lk>, method=PLAIN, rip=191.53.107.213, lip=66.85.158.91, TLS, session=<3rfv8X5EN5S/NWvV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.5.33
country_id: 690791
description:
Nov 26 18:28:43 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=176.103.5.33, lip=66.85.158.91, TLS, session=<PWu5835EVNawZwUh>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 18:42:29 host2 sshd[4002980]: Disconnected from invalid user iyana 62.60.131.157 port 24628 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.95.33
country_id: 3865483
description:
Nov 26 18:57:14 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<info@weeratrading.com>, method=PLAIN, rip=186.64.95.33, lip=66.85.158.91, TLS, session=<Wj6OWX9EuZO6QF8h>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.143.216
country_id: 99237
description:
Nov 26 18:57:33 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<info>, method=PLAIN, rip=65.20.143.216, lip=66.85.158.91, TLS, session=<MB3XWn9E54FBFI/Y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.5.21.201
country_id: 3865483
description:
Nov 26 18:57:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<info@saara.lk>, method=PLAIN, rip=190.5.21.201, lip=66.85.158.91, TLS, session=<QEajW39ENNO+BRXJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.116
country_id: 3469034
description:
Nov 26 18:58:07 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<info>, method=PLAIN, rip=168.0.224.116, lip=66.85.158.91, TLS, session=<AongXH9EF7uoAOB0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 26 19:05:54 host2 sshd[4018460]: Disconnected from invalid user iyana 62.60.131.157 port 47787 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.238
country_id: 2635167
description:
Nov 26 19:06:18 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.238, lip=66.85.158.91, TLS, session=<yycpe39EVadX7LDu>


