# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-01 07:21:23 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:43334: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.93.60.253
country_id: 3865483
description:
2025-11-01 07:21:27 dovecot_login authenticator failed for (host253.181-93-60.telecom.net.ar) [181.93.60.253]:56052: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-01 07:22:53 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:52816: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov  1 07:22:32 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<olhIvH5ClrEDjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-01 07:22:39 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:39048: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.111.3
country_id: 1643084
description:
Nov  1 07:23:50 host2 sshd[1136280]: Disconnected from invalid user julie 103.154.111.3 port 57114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-11-01 07:25:09 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:55417: 535 Incorrect authentication data (set_id=sales@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.10
country_id: 2186224
description:
2025-11-01 07:25:33 dovecot_login authenticator failed for ([121.73.168.10]) [121.73.168.10]:42116: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-01 07:25:45 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:34885: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.111.3
country_id: 1643084
description:
Nov  1 07:27:21 host2 sshd[1140083]: Disconnected from invalid user noc 103.154.111.3 port 49220 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 07:28:19 host2 sshd[1141082]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.111.3
country_id: 1643084
description:
Nov  1 07:28:54 host2 sshd[1141485]: Disconnected from invalid user mj 103.154.111.3 port 48938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov  1 07:31:37 host2 sshd[1144489]: Disconnected from invalid user sansforensics 122.166.49.42 port 40112 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.166.49.42
country_id: 1269750
description:
Nov  1 07:33:05 host2 sshd[1145870]: Disconnected from invalid user oracle 122.166.49.42 port 45992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.135.153.124
country_id: 6252001
description:
Nov  1 07:32:17 host2 sshd[1145142]: Invalid user askinternationalconsortium from 43.135.153.124 port 16714


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.111.3
country_id: 1643084
description:
Nov  1 07:33:27 host2 sshd[1146274]: Disconnected from invalid user server 103.154.111.3 port 59162 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 07:35:14 host2 sshd[1148139]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.159.91.86
country_id: 3017382
description:
Nov  1 07:39:46 host2 sshd[1152728]: Invalid user askinternationalconsortium from 51.159.91.86 port 3665


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.133
country_id: 6252001
description:
Nov  1 07:41:41 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.133, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<mlDFAH9Ctc+TuYWF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.8
country_id: 3042058
description:
2025-11-01 07:41:43 dovecot_login authenticator failed for (ADMIN) [91.90.122.8]:56896: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.133
country_id: 6252001
description:
Nov  1 07:42:17 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 15 secs): user=<>, rip=147.185.133.133, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<L1bmAn9CfPmTuYWF>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.139
country_id: 1643084
description:
Nov  1 07:42:50 host2 sshd[1156073]: Disconnected from invalid user dj 103.172.205.139 port 34666 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
country_id: 1819730
description:
2025-11-01 07:44:08 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:56362: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-11-01 07:44:30 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:63590: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-01 07:45:03 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br (152-237-221-1.user.vtal.net.br) [187.40.215.162]:49610: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.205.139
country_id: 1643084
description:
Nov  1 07:45:04 host2 sshd[1159159]: Disconnected from invalid user ghostuser 103.172.205.139 port 57312 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 07:45:55 host2 sshd[1160037]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.127.254.199
country_id: 1252634
description:
2025-11-01 07:45:20 dovecot_login authenticator failed for ([103.127.254.199]) [103.127.254.199]:36082: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-01 07:47:42 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:39196: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.133
country_id: 6252001
description:
Nov  1 07:49:41 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.133, lip=66.85.158.92, TLS, session=<QxRkHX9CWOaTuYWF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-11-01 07:49:53 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:59940: 535 Incorrect authentication data (set_id=sales@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.86.212.108
country_id: 6252001
description:
2025-11-01 07:54:27 dovecot_login authenticator failed for ([96.86.212.108]) [96.86.212.108]:47474: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-11-01 07:54:27 dovecot_login authenticator failed for ([117.247.239.202]) [117.247.239.202]:45198: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-01 07:54:42 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:42942: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.190.150.4
country_id: 1269750
description:
2025-11-01 07:55:00 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:50572: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-01 07:56:02 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:51542: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.205.139
country_id: 1643084
description:
Nov  1 07:55:16 host2 sshd[1170912]: Disconnected from invalid user sansforensics 103.172.205.139 port 33060 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 07:57:05 host2 sshd[1173293]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.98
country_id: 6252001
description:
Nov  1 07:56:44 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.98, lip=66.85.158.91, session=<41OTNn9CWPnN0h9i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-01 07:56:17 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:39868: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.189
country_id: 1733045
description:
2025-11-01 07:57:54 dovecot_login authenticator failed for ([49.124.155.189]) [49.124.155.189]:54012: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-11-01 07:58:08 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:53956: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-01 07:58:22 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:51118: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.18.67
country_id: 3469034
description:
2025-11-01 07:58:43 dovecot_login authenticator failed for (cyrela.static.gvt.net.br) [179.185.18.67]:38011: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Nov  1 07:58:53 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=167.94.146.56, lip=66.85.158.91, TLS: Connection closed, session=<Dj5PPn9CFMinXpI4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.224
country_id: 1733045
description:
2025-11-01 07:58:58 dovecot_login authenticator failed for ([49.124.152.224]) [49.124.152.224]:58738: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 164.90.188.38
country_id: 2921044
description:
Nov  1 07:58:21 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=164.90.188.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<XctgPH9CkLCkWrwm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.117.76
country_id: 2510769
description:
2025-11-01 07:58:30 dovecot_login authenticator failed for (76.pool90-160-117.dynamic.orange.es) [90.160.117.76]:34674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-01 07:59:00 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:56804: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-11-01 07:59:03 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:60158: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.56
country_id: 1733045
description:
2025-11-01 07:58:17 dovecot_login authenticator failed for ([49.124.151.56]) [49.124.151.56]:56928: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.102.231.190
country_id: 6290252
description:
2025-11-01 07:59:20 dovecot_login authenticator failed for ([91.102.231.190]) [91.102.231.190]:60752: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-01 08:00:43 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:49396: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.208.59
country_id: 1269750
description:
Nov  1 08:02:07 host2 sshd[1180118]: Invalid user askinternationalconsortium from 165.22.208.59 port 37310


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 08:04:54 host2 sshd[1184112]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.153
country_id: 2635167
description:
Nov  1 08:04:46 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 10 secs): user=<>, rip=35.203.210.153, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<86NOU39CycEjy9KZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.153
country_id: 2635167
description:
Nov  1 08:06:03 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=35.203.210.153, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<mIjuV39ClvQjy9KZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 57.128.191.199
country_id: 3017382
description:
Nov  1 08:11:34 host2 sshd[1193822]: Invalid user askinternationalconsortium from 57.128.191.199 port 57172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.2
country_id: 3175395
description:
2025-11-01 08:12:58 dovecot_login authenticator failed for (ADMIN) [156.146.41.2]:34536: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.153
country_id: 2635167
description:
Nov  1 08:13:01 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.153, lip=66.85.158.91, TLS, session=<mpjVcH9CUvAjy9KZ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 08:13:35 host2 sshd[1196712]: Disconnected from invalid user admin 2.57.121.112 port 33481 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.239.165.114
country_id: 1643084
description:
Nov  1 08:15:08 host2 sshd[1199106]: Invalid user cloudtourssrilanka from 103.239.165.114 port 50784


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov  1 08:17:05 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<G65ef39CSr+LonQW>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 08:17:11 host2 sshd[1201990]: Disconnected from invalid user admin 2.57.121.112 port 59001 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.77.141.29
country_id: 3017382
description:
Nov  1 08:22:09 host2 sshd[1209193]: Invalid user askinternationalconsortium from 51.77.141.29 port 46232


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.94
country_id: 6252001
description:
Nov  1 08:23:16 host2 dovecot[1088764]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=147.185.132.94, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JRiClX9CUMaTuYRe>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.60
country_id: 1168579
description:
2025-11-01 08:24:31 dovecot_login authenticator failed for (60.92.zcomnetworks.com.pk) [103.148.92.60]:40917: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2025-11-01 08:25:12 dovecot_login authenticator failed for ([210.177.143.61]) [210.177.143.61]:41234: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.77
country_id: 1733045
description:
2025-11-01 08:27:18 dovecot_login authenticator failed for ([49.125.201.77]) [49.125.201.77]:48854: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-01 08:31:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53695: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-01 08:33:26 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:32830: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.204.151.223
country_id: 1210997
description:
2025-11-01 08:33:15 dovecot_login authenticator failed for ([116.204.148.28]) [116.204.151.223]:52450: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.29.23.109
country_id: 6252001
description:
2025-11-01 08:35:28 dovecot_login authenticator failed for h109.23.29.71.dynamic.ip.windstream.net [71.29.23.109]:37594: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-11-01 08:35:46 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:24947: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-11-01 08:38:08 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:48596: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-11-01 08:37:50 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:56478: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.159
country_id: 1819730
description:
Nov  1 08:38:25 host2 sshd[1233168]: Invalid user askinternationalconsortium from 118.193.38.159 port 40314


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.178.137.243
country_id: 3017382
description:
Nov  1 08:39:13 host2 sshd[1233935]: Invalid user askinternationalconsortium from 51.178.137.243 port 51864


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.101
country_id: 2661886
description:
2025-11-01 08:41:30 dovecot_login authenticator failed for (ADMIN) [212.112.19.101]:12918: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.196.180
country_id: 6252001
description:
Nov  1 08:41:36 host2 sshd[1236396]: Invalid user askinternationalconsortium from 104.236.196.180 port 6268


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.165.1.55
country_id: 2921044
description:
Nov  1 08:47:08 host2 sshd[1244131]: Invalid user askinternationalconsortium from 43.165.1.55 port 40138


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:50:30 host2 dovecot[1088764]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<VCbg9n9C2IIDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:51:13 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<WYhx+X9CUJkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:52:26 host2 dovecot[1088764]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<jIrR/X9CYtkDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:54:27 host2 dovecot[1088764]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<THMABYBCgMEDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:55:50 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<VH72CYBCjrYDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:56:31 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<S5FnDIBCFo4DiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:56:28 host2 dovecot[1088764]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<byMzDIBCsOwDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.62
country_id: 6252001
description:
Nov  1 08:57:14 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=167.94.146.62, lip=66.85.158.92, TLS: Connection closed, session=<hvH3DoBCxJKnXpI+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-11-01 08:58:58 dovecot_login authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr [80.14.31.158]:54997: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.34.17.250
country_id: 99237
description:
2025-11-01 08:59:07 dovecot_login authenticator failed for ([185.34.17.250]) [185.34.17.250]:37065: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-01 08:59:11 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:38129: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov  1 08:58:32 host2 dovecot[1088764]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<2RefE4BClogDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.125.83.110
country_id: 630336
description:
2025-11-01 08:58:57 dovecot_login authenticator failed for leased-line-93-125-83-110.telecom.by [93.125.83.110]:57319: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-01 09:01:40 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:57698: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-01 09:02:02 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:58643: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.142
country_id: 798549
description:
2025-11-01 09:01:20 dovecot_login authenticator failed for (ADMIN) [91.90.120.142]:50812: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2025-11-01 09:03:58 dovecot_login authenticator failed for (red.170.233.29.157.ssservicios.com.ar) [170.233.29.157]:57038: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-11-01 09:04:11 dovecot_login authenticator failed for (abts-kk-static-182.209.166.122.airtelbroadband.in) [125.17.124.75]:58446: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 09:04:26 host2 sshd[1262995]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.236.196.180
country_id: 6252001
description:
Nov  1 09:07:31 host2 sshd[1265883]: Invalid user cloudtourssrilanka from 104.236.196.180 port 42010


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-11-01 09:09:59 dovecot_login authenticator failed for ([103.56.85.65]) [128.185.227.166]:58520: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-11-01 09:10:16 dovecot_login authenticator failed for ([209.173.10.75]) [209.173.10.75]:33246: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-11-01 09:12:11 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:38940: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.234.121.57
country_id: 2661886
description:
2025-11-01 09:14:58 dovecot_login authenticator failed for 81-234-121-57-no600.tbcn.telia.com [81.234.121.57]:42080: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-11-01 09:14:49 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:51600: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.8.95
country_id: 6252001
description:
Nov  1 09:15:10 host2 sshd[1274151]: Invalid user askinternationalconsortium from 167.99.8.95 port 60258


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.37
country_id: 6252001
description:
Nov  1 09:15:38 host2 dovecot[1088764]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.37, lip=66.85.158.92, TLS, session=<CJHFUIBCgOfG6xgl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.31.158
country_id: 1605651
description:
Nov  1 09:21:50 host2 sshd[1281378]: Invalid user askinternationalconsortium from 150.95.31.158 port 51542


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.2.194.88
country_id: 2963597
description:
2025-11-01 09:26:59 dovecot_login authenticator failed for (ADMIN) [155.2.194.88]:12961: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 09:30:11 host2 sshd[1289902]: Disconnected from invalid user admin 2.57.121.112 port 25821 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 09:33:16 host2 sshd[1292870]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.91.113.248
country_id: 6252001
description:
2025-11-01 09:33:58 dovecot_login authenticator failed for (syn-172-091-113-248.res.spectrum.com) [172.91.113.248]:51164: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-01 09:34:39 dovecot_login authenticator failed for ([122.186.172.97]) [152.52.236.158]:36788: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-01 09:34:11 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:33488: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.23
country_id: 298795
description:
2025-11-01 09:38:41 dovecot_login authenticator failed for ([188.59.178.23]) [188.59.178.23]:54053: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-11-01 09:38:59 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:33220: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.82
country_id: 1733045
description:
2025-11-01 09:41:05 dovecot_login authenticator failed for ([49.124.151.82]) [49.124.151.82]:56578: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.142.148.162
country_id: 1168579
description:
2025-11-01 09:41:26 dovecot_login authenticator failed for ([202.142.148.162]) [202.142.148.162]:41626: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.32.123.9
country_id: 3469034
description:
2025-11-01 09:44:27 dovecot_login authenticator failed for (187-032-123-009.static.ctbctelecom.com.br) [187.32.123.9]:4791: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-11-01 09:44:49 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:35742: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-01 09:44:17 dovecot_login authenticator failed for ([196.189.59.226]) [196.189.59.226]:35535: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Nov  1 09:45:54 host2 sshd[1307120]: Disconnected from invalid user pang 42.200.66.164 port 52118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-11-01 09:45:17 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:39904: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-01 09:47:03 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:36974: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.62
country_id: 1269750
description:
2025-11-01 09:49:05 dovecot_login authenticator failed for ([182.95.2.153]) [125.20.224.62]:49594: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.109
country_id: 3865483
description:
2025-11-01 09:49:23 dovecot_login authenticator failed for (ADMIN) [146.70.38.109]:49314: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-01 09:50:01 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3108: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Nov  1 09:51:21 host2 sshd[1312680]: Disconnected from invalid user ftpuser 42.200.66.164 port 59802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-01 09:52:24 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:59072: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.66.164
country_id: 1819730
description:
Nov  1 09:52:40 host2 sshd[1313879]: Disconnected from invalid user hydra 42.200.66.164 port 33484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.186.147.126
country_id: 1880251
description:
Nov  1 09:53:40 host2 sshd[1314834]: Invalid user askinternationalconsortium from 35.186.147.126 port 36274


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Nov  1 09:53:55 host2 sshd[1315059]: Disconnected from invalid user debian 42.200.66.164 port 35398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.66.164
country_id: 1819730
description:
Nov  1 09:55:11 host2 sshd[1316921]: Disconnected from invalid user ricoh 42.200.66.164 port 37310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.83.190
country_id: 1861060
description:
Nov  1 09:55:42 host2 sshd[1317530]: Invalid user askinternationalconsortium from 150.95.83.190 port 58244


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.225.52.249
country_id: 290557
description:
Nov  1 10:00:54 host2 sshd[1322962]: Invalid user askinternationalconsortium from 43.225.52.249 port 44280


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.53
country_id: 1733045
description:
2025-11-01 10:04:14 dovecot_login authenticator failed for ([49.124.151.53]) [49.124.151.53]:50056: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-11-01 10:04:40 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:50292: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.161.199
country_id: 2186224
description:
2025-11-01 10:05:15 dovecot_login authenticator failed for ([121.73.161.199]) [121.73.161.199]:59938: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.218
country_id: 1733045
description:
2025-11-01 10:05:16 dovecot_login authenticator failed for ([49.124.152.218]) [49.124.152.218]:53342: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Nov  1 10:07:06 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, TLS: Connection closed, session=<+wLQCIFCbtlChJmE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  1 10:06:44 host2 dovecot[1299590]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<tjGHB4FCMoQD7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.232.19.79
country_id: 2750405
description:
Nov  1 10:11:38 host2 sshd[1334650]: Invalid user askinternationalconsortium from 52.232.19.79 port 38478


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.120.205.11
country_id: 6251999
description:
2025-11-01 10:12:33 dovecot_login authenticator failed for (ADMIN) [37.120.205.11]:60962: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov  1 10:12:49 host2 sshd[1335955]: Disconnected from invalid user yang 34.69.0.72 port 33122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-01 10:15:51 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:46283: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.93.75
country_id: 1643084
description:
Nov  1 10:15:51 host2 sshd[1339319]: Invalid user askinternationalconsortium from 103.82.93.75 port 55856


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.29.57
country_id: 290557
description:
2025-11-01 10:15:36 dovecot_login authenticator failed for ([94.207.29.57]) [94.207.29.57]:37934: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.199.201.205
country_id: 6252001
description:
Nov  1 10:15:42 host2 sshd[1339182]: Invalid user askinternationalconsortium from 134.199.201.205 port 43504


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-11-01 10:18:01 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:33606: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.142.148.162
country_id: 1168579
description:
2025-11-01 10:18:22 dovecot_login authenticator failed for ([202.142.148.162]) [202.142.148.162]:58212: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.199.201.205
country_id: 6252001
description:
Nov  1 10:18:33 host2 sshd[1341922]: Invalid user cloudtourssrilanka from 134.199.201.205 port 51592


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.69.0.72
country_id: 6252001
description:
Nov  1 10:19:27 host2 sshd[1343108]: Disconnected from invalid user switching 34.69.0.72 port 50688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 114.7.163.154
country_id: 1643084
description:
Nov  1 10:20:35 host2 sshd[1344549]: Invalid user askinternationalconsortium from 114.7.163.154 port 56936


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.69.0.72
country_id: 6252001
description:
Nov  1 10:20:49 host2 sshd[1344787]: Disconnected from invalid user info 34.69.0.72 port 36160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.100.209.172
country_id: 1819730
description:
Nov  1 10:22:05 host2 sshd[1346279]: Invalid user cloudtourssrilanka from 103.100.209.172 port 21508


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.198.109.95
country_id: 2635167
description:
2025-11-01 10:24:40 dovecot_login authenticator failed for ([213.198.109.95]) [213.198.109.95]:47000: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.215
country_id: 1269750
description:
2025-11-01 10:24:27 dovecot_login authenticator failed for (nsg-corporate-215.230.187.122.airtel.in) [122.187.230.215]:51417: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.117
country_id: 6252001
description:
Nov  1 10:26:03 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=199.45.154.117, lip=66.85.158.91, TLS: Connection closed, session=<I3yaTIFCwtLHLZp1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.199.163.128
country_id: 2635167
description:
2025-11-01 10:26:26 dovecot_login authenticator failed for 128.163.199.146.dyn.plus.net [146.199.163.128]:35746: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.164.188
country_id: 1819730
description:
2025-11-01 10:26:56 dovecot_login authenticator failed for (223-197-164-188.static.imsbiz.com) [223.197.164.188]:52706: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-01 10:27:00 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:38053: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-11-01 10:26:15 dovecot_login authenticator failed for ([128.185.247.14]) [122.184.124.46]:51660: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-01 10:26:18 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:42038: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.247.20.83
country_id: 1643084
description:
Nov  1 10:28:01 host2 sshd[1352466]: Invalid user askinternationalconsortium from 103.247.20.83 port 55400


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.119.132.230
country_id: 2510769
description:
2025-11-01 10:29:27 dovecot_login authenticator failed for ([176.119.132.230]) [176.119.132.230]:37424: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-11-01 10:29:48 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:50720: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.19
country_id: 6290252
description:
2025-11-01 10:37:02 dovecot_login authenticator failed for (ADMIN) [37.46.115.19]:42954: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 10:37:45 host2 sshd[1363023]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.69.10.175
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.69.10.175 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 38.69.10.175
country_id: 6252001
description:
Nov  1 10:44:42 host2 sshd[1370834]: Invalid user cloudtourssrilan_travel from 38.69.10.175 port 60310


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 10:46:38 host2 sshd[1373358]: Disconnected from invalid user admin 2.57.121.112 port 8579 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-01 10:48:13 dovecot_login authenticator failed for ([1.7.229.162]) [49.37.32.248]:57324: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.211.21.213
country_id: 1269750
description:
2025-11-01 10:48:54 dovecot_login authenticator failed for (213-21.211.103.static.gtplkcbpl.in) [103.211.21.213]:48751: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-11-01 10:49:01 dovecot_login authenticator failed for (nsg-corporate-73.18.186.122.airtel.in) [128.185.211.102]:48224: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.89
country_id: 2264397
description:
Nov  1 10:50:51 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.156.128.89, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<erdDpYFCX8gtnIBZ>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.209.30
country_id: 2264397
description:
Nov  1 10:51:01 host2 pure-ftpd[1378059]: (?@109.105.209.30) [INFO] New connection from 109.105.209.30


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.209.29
country_id: 2264397
description:
Nov  1 10:50:59 host2 pure-ftpd[1378044]: (?@109.105.209.29) [INFO] New connection from 109.105.209.29


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 10:50:12 host2 sshd[1377324]: Disconnected from invalid user admin 2.57.121.112 port 26339 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.87
country_id: 2264397
description:
Nov  1 10:50:49 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.128.87, lip=66.85.158.92, TLS, session=<5GgnpYFC1dstnIBX>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.209.28
country_id: 2264397
description:
Nov  1 10:51:02 host2 pure-ftpd[1378173]: (?@109.105.209.28) [INFO] New connection from 109.105.209.28


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.209.27
country_id: 2264397
description:
Nov  1 10:51:03 host2 pure-ftpd[1378175]: (?@109.105.209.27) [INFO] New connection from 109.105.209.27


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.128.87
country_id: 2264397
description:
Nov  1 10:50:44 host2 dovecot[1299590]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.128.87, lip=66.85.158.92, TLS, session=<xSrdpIFCM5YtnIBX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.86
country_id: 2264397
description:
Nov  1 10:50:47 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.128.86, lip=66.85.158.92, TLS, session=<pj8SpYFCDKItnIBW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.128.88
country_id: 2264397
description:
Nov  1 10:50:58 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol (no auth attempts in 0 secs): user=<>, rip=45.156.128.88, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090FC:SSL routines:tls_early_post_process_client_hello:unknown protocol, session=<v3uupYFCR7otnIBY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.56.26
country_id: 1269750
description:
2025-11-01 10:57:32 dovecot_login authenticator failed for ([59.145.127.41]) [122.187.56.26]:44866: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.220.228
country_id: 99237
description:
2025-11-01 10:57:47 dovecot_login authenticator failed for ([93.191.115.52]) [194.31.220.228]:37221: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-11-01 10:57:50 dovecot_login authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:41836: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.47.214
country_id: 1269750
description:
2025-11-01 10:58:13 dovecot_login authenticator failed for ([150.129.47.214]) [150.129.47.214]:35492: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.9.202.254
country_id: 2510769
description:
2025-11-01 10:58:30 dovecot_login authenticator failed for 254.red-88-9-202.dynamicip.rima-tde.net [88.9.202.254]:60226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.136.122
country_id: 1269750
description:
Nov  1 11:00:03 host2 sshd[1388512]: Invalid user askinternationalconsortium from 64.227.136.122 port 41788


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-11-01 11:01:23 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:32912: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-11-01 11:01:35 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:48152: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.190
country_id: 1269750
description:
2025-11-01 11:01:38 dovecot_login authenticator failed for ([27.123.98.190]) [27.123.98.190]:47952: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.48.70
country_id: 3469034
description:
2025-11-01 11:02:08 dovecot_login authenticator failed for ([187.12.48.70]) [187.12.48.70]:42733: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-01 11:02:18 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:38030: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.9
country_id: 1733045
description:
2025-11-01 11:02:27 dovecot_login authenticator failed for ([49.124.153.9]) [49.124.153.9]:58982: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-11-01 11:01:45 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:44732: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-11-01 11:01:47 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:52750: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.211.97
country_id: 6252001
description:
Nov  1 11:03:50 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=45.79.211.97, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<rla504FCWcstT9Nh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov  1 11:04:14 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.91, session=<Umsq1YFCbNKUcd3D>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.177.197
country_id: 3469034
description:
2025-11-01 11:05:18 dovecot_login authenticator failed for (ADMIN) [188.241.177.197]:48315: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:06:39 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<gT3G3YFC7NEDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.208.59
country_id: 1269750
description:
Nov  1 11:05:54 host2 sshd[1394748]: Invalid user askinternationalconsortium from 165.22.208.59 port 44360


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-01 11:06:04 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:55240: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-01 11:06:56 dovecot_login authenticator failed for (187-50-194-182.customer.tdatabrasil.net.br) [187.50.194.182]:48316: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:07:39 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<1PFW4YFCxNwDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:08:36 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<tZ/B5IFCgKQDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.146.21.153
country_id: 1605651
description:
Nov  1 11:08:09 host2 sshd[1397002]: Invalid user askinternationalconsortium from 203.146.21.153 port 45666


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:08:40 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<+9j+5IFCyI8DgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.125.83.110
country_id: 630336
description:
2025-11-01 11:08:49 dovecot_login authenticator failed for leased-line-93-125-83-110.telecom.by ([91.149.142.21]) [93.125.83.110]:34719: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-11-01 11:09:02 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:34280: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:10:33 host2 dovecot[1299590]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=</xq764FCVpADgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:10:53 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Gjbq7IFC2IkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:11:55 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZuSc8IFCwLkDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.83.145.39
country_id: 6252001
description:
Nov  1 11:12:17 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.83.145.39, lip=66.85.158.91, TLS, session=<ZZnx8YFCQr4DU5En>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.105
country_id: 6252001
description:
Nov  1 11:12:18 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.195.105, lip=66.85.158.92, session=<tNr/8YFCDNQUQcNp>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:12:53 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<UAET9IFCxuUDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 212.102.40.218
country_id: 6252001
description:
Nov  1 11:13:00 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=212.102.40.218, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<6gd89IFCmGTUZija>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:13:51 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, TLS, session=<BF6F94FCvN0DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.192.67
country_id: 6252001
description:
Nov  1 11:14:48 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.65.192.67, lip=66.85.158.91, session=<Wn30+oFCOrsUQcBD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:14:52 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<CPUu+4FCDpsDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 11:15:47 host2 dovecot[1299590]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, TLS, session=<54Z1/oFCpLYDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.29
country_id: 6290252
description:
2025-11-01 11:29:41 dovecot_login authenticator failed for (ADMIN) [37.46.115.29]:57464: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-11-01 11:33:47 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:59258: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.135
country_id: 1733045
description:
2025-11-01 11:34:07 dovecot_login authenticator failed for ([49.124.142.135]) [49.124.142.135]:40560: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-11-01 11:35:42 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:47968: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
country_id: 1819730
description:
2025-11-01 11:36:25 dovecot_login authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:50155: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.254
country_id: 6251999
description:
Nov  1 11:38:34 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.254, lip=66.85.158.92, session=<YYHpT4JCmImUcdL+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.153.210
country_id: 6252001
description:
Nov  1 11:39:14 host2 sshd[1432472]: Invalid user agronatureholdings from 137.184.153.210 port 36984


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.213.247
country_id: 6251999
description:
Nov  1 11:40:21 host2 sshd[1433811]: Invalid user agronatureholdings from 143.110.213.247 port 39470


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.75.89.78
country_id: 617790
description:
2025-11-01 11:42:39 dovecot_login authenticator failed for (host-static-37-75-89-78.moldtelecom.md) [37.75.89.78]:57553: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-11-01 11:41:59 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:46072: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.143.133.126
country_id: 3595528
description:
2025-11-01 11:44:00 dovecot_login authenticator failed for ([190.143.133.126]) [190.143.133.126]:51933: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-11-01 11:44:23 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:54086: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-01 11:47:15 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:45683: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.144
country_id: 1733045
description:
2025-11-01 11:46:56 dovecot_login authenticator failed for ([49.124.152.144]) [49.124.152.144]:40896: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.33
country_id: 732800
description:
2025-11-01 11:52:50 dovecot_login authenticator failed for (ADMIN) [94.156.14.33]:51286: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-01 11:57:37 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:38725: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-01 11:58:00 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:36840: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-01 11:58:35 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:38674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-11-01 11:57:50 dovecot_login authenticator failed for ([118.26.153.102]) [118.26.153.102]:32454: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-01 12:02:29 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63567: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 12:02:43 host2 sshd[1458169]: Disconnected from invalid user admin 2.57.121.112 port 47250 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.192.245
country_id: 6252001
description:
Nov  1 12:07:55 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.249.192.245, lip=66.85.158.92, session=<EKbsuIJCbOlK+cD1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.102.117.55
country_id: 6252001
description:
Nov  1 12:09:23 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.102.117.55, lip=66.85.158.91, session=<nw8qvoJCtKsUZnU3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2025-11-01 12:10:29 dovecot_login authenticator failed for (nsg-static-106.102.72.182.airtel.in) [182.72.102.106]:52224: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.102.101.248
country_id: 1269750
description:
2025-11-01 12:11:31 dovecot_login authenticator failed for ([14.102.101.248]) [14.102.101.248]:41013: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.97.134
country_id: 294640
description:
2025-11-01 12:13:06 dovecot_login authenticator failed for (2-54-97-134.orange.net.il) [2.54.97.134]:53052: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-01 12:13:28 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:38509: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.120.154
country_id: 798549
description:
2025-11-01 12:13:31 dovecot_login authenticator failed for (ADMIN) [91.90.120.154]:40652: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2025-11-01 12:19:19 dovecot_login authenticator failed for ([188.59.19.112]) [188.59.19.112]:56439: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.181.177.244
country_id: 2029969
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 66.181.177.244 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.33.70.173
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 75.33.70.173 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 125.27.53.229
country_id: 1605651
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 125.27.53.229 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.225.246.49
country_id: 1282988
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.225.246.49 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.48.191.236
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.48.191.236 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.183.203.230
country_id: 2510769
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 107.183.203.230 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.206.152.163
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 31.206.152.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.36.222.160
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 51.36.222.160 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.153.203.18
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 85.153.203.18 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.115.66.158
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 190.115.66.158 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.107.90.124
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.107.90.124 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.84.34.69
country_id: 3895114
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 138.84.34.69 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.167.123.54
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.167.123.54 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 212.174.68.50
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 212.174.68.50 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.218.49.225
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.218.49.225 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.252.198.217
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 51.252.198.217 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.53.34.162
country_id: 1733045
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 60.53.34.162 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.190.107.201
country_id: 3508796
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.190.107.201 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.155.39
country_id: 1733045
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 161.142.155.39 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.49.231.101
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.49.231.101 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.251.17.209
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 172.251.17.209 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.65.113.153
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 37.65.113.153 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.161.3.45
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.161.3.45 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.49.3.84
country_id: 458258
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 92.49.3.84 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.103.185.26
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 74.103.185.26 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.167.182.159
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.167.182.159 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.141.11.223
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.141.11.223 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.217.151.198
country_id: 587116
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 62.217.151.198 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.206.63.196
country_id: 2542007
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 196.206.63.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.236.188.134
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 70.236.188.134 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.32.195.203
country_id: 3686110
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 179.32.195.203 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.128.252.63
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.128.252.63 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.124.156.22
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.124.156.22 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.189.105.84
country_id: 3895114
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 186.189.105.84 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 183.88.234.155
country_id: 1605651
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 183.88.234.155 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.62.83.121
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 187.62.83.121 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.196.38.123
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 146.196.38.123 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.217.108.69
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.217.108.69 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.110.72.84
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 46.110.72.84 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.106.157.38
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 174.106.157.38 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.43.224.104
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 49.43.224.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.150.250.238
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.150.250.238 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.241.22.228
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 23.241.22.228 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.150.246.167
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 35.150.246.167 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.243.106.73
country_id: 2017370
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 91.243.106.73 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.58.97.140
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 152.58.97.140 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.56.133.228
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 152.56.133.228 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.195.146.219
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 107.195.146.219 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.195.97.27
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 107.195.97.27 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.79.22.44
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 71.79.22.44 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.183.72
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.151.183.72 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.57.252.181
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.57.252.181 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.44.183.216
country_id: 3895114
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 190.44.183.216 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.31.86.207
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.31.86.207 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.59.90.13
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.59.90.13 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.121.235.171
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 78.121.235.171 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.59.118.166
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 152.59.118.166 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.57.175.15
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 152.57.175.15 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.32.29.185
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.32.29.185 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.162.148.43
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 122.162.148.43 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 80.233.51.61
country_id: 2963597
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 80.233.51.61 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.64.127.5
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 71.64.127.5 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.122.152.214
country_id: 294640
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 37.122.152.214 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.234.8.23
country_id: 1562822
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 171.234.8.23 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.165.11.116
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 179.165.11.116 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.212.113.102
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 117.212.113.102 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.195.88.127
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.195.88.127 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.34.103.6
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 201.34.103.6 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 143.255.133.41
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 143.255.133.41 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.211.52.7
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.211.52.7 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.61.142.27
country_id: 3865483
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 186.61.142.27 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.102.174.244
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 97.102.174.244 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.146.113.148
country_id: 587116
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 185.146.113.148 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.196.207.237
country_id: 3996063
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 189.196.207.237 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.89.72.69
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.89.72.69 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.22.225.107
country_id: 3865483
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 186.22.225.107 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.254.64.207
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 151.254.64.207 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 100.0.96.201
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 100.0.96.201 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.19.156.214
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 187.19.156.214 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.174.71.124
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 75.174.71.124 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.37.183.79
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.37.183.79 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.107.212.163
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 150.107.212.163 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.207.76
country_id: 99237
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 185.187.207.76 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.127.45.9
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.127.45.9 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.36.184.34
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.36.184.34 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 94.248.234.18
country_id: 6290252
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 94.248.234.18 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 112.201.132.152
country_id: 1694008
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 112.201.132.152 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.49.54.113
country_id: 3439705
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 186.49.54.113 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.47.8.166
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 49.47.8.166 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.151.56.163
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 35.151.56.163 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.36.102.32
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.36.102.32 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.214.7.118
country_id: 630336
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 37.214.7.118 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.237.22.93
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 186.237.22.93 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.62.31.211
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 173.62.31.211 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.197.138.106
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.197.138.106 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.46.30.188
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.46.30.188 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.107.204.137
country_id: 783754
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 95.107.204.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.21.140.46
country_id: 286963
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 5.21.140.46 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.222.237.131
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 179.222.237.131 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.106.254.121
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.106.254.121 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.18.120.7
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.18.120.7 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.177.154.168
country_id: 294640
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 79.177.154.168 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.74.110.128
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.74.110.128 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.185.39.156
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 223.185.39.156 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.160.194.182
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.160.194.182 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.120.49.119
country_id: 630336
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 178.120.49.119 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.140.27.148
country_id: 1527747
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.140.27.148 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.222.238.94
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 106.222.238.94 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.224.250.146
country_id: 2186224
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 49.224.250.146 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.181.82.102
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.181.82.102 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.207.167.1
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.207.167.1 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.109.162.205
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 98.109.162.205 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.88.3.1
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.88.3.1 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.233.177.28
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.233.177.28 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.46.189.115
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 75.46.189.115 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.177.222.215
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 75.177.222.215 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.178.177.130
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 72.178.177.130 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.41.93.1
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 5.41.93.1 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.0.33.140
country_id: 6251999
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 174.0.33.140 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 46.1.230.182
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 46.1.230.182 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.222.31.253
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 104.222.31.253 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.203.85.32
country_id: 2464461
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 196.203.85.32 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.100.201.70
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 200.100.201.70 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.211.240.18
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.211.240.18 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.217.236.145
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.217.236.145 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.201.58.31
country_id: 290291
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 88.201.58.31 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.176.165.100
country_id: 2542007
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 160.176.165.100 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.38.62.194
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 187.38.62.194 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.68.246.26
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 182.68.246.26 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.181.64.231
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.181.64.231 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.133.218.12
country_id: 3996063
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 189.133.218.12 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.34.68.239
country_id: 1282988
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 27.34.68.239 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.36.215.156
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 138.36.215.156 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 116.90.176.112
country_id: 1643084
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 116.90.176.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.137.24.126
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 38.137.24.126 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.162.122.215
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 177.162.122.215 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.59.84.164
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 27.59.84.164 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.240.72.6
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 176.240.72.6 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.243.25.48
country_id: 6290252
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 77.243.25.48 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 206.170.208.89
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 206.170.208.89 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.105.197.114
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 190.105.197.114 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.190.117.140
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.190.117.140 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.223.162.122
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 50.223.162.122 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.246.248.111
country_id: 1668284
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 111.246.248.111 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.134.53.39
country_id: 2802361
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 109.134.53.39 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.114.243.11
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 23.114.243.11 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.73.38.0
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.73.38.0 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.178.192.70
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 72.178.192.70 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.44.10.96
country_id: 3865483
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 181.44.10.96 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.86.102
country_id: 3608932
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 45.181.86.102 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.92.157.103
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 68.92.157.103 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 135.134.13.128
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 135.134.13.128 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.144.241.185
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.144.241.185 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.83.252.233
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 108.83.252.233 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.169.47.136
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 67.169.47.136 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.117.188.62
country_id: 3437598
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 181.117.188.62 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.141.86.186
country_id: 3469034
description:
[2025-11-01 12:21:38 +0530] info [whostmgrd] 192.141.86.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.87.25.115
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.87.25.115 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.244.196.105
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 178.244.196.105 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.106.30.182
country_id: 99237
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 185.106.30.182 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.214.55.188
country_id: 3895114
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 201.214.55.188 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.247.139.254
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 43.247.139.254 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.36
country_id: 1733045
description:
2025-11-01 12:21:24 dovecot_login authenticator failed for ([49.124.153.36]) [49.124.153.36]:45470: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 12.74.205.1
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 12.74.205.1 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.245.10.201
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 117.245.10.201 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.235.193.25
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 162.235.193.25 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.47.10.76
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 49.47.10.76 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.190.196.47
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.190.196.47 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.118.190.134
country_id: 1562822
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 42.118.190.134 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.239.152.43
country_id: 3932488
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 190.239.152.43 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.163.92.254
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 75.163.92.254 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.142.177.172
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 170.142.177.172 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.163.57.196
country_id: 102358
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 5.163.57.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.20.34.57
country_id: 3895114
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 190.20.34.57 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.118.159.93
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.118.159.93 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.123.234.55
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 103.123.234.55 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.212.54.241
country_id: 630336
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 37.212.54.241 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.31.160.10
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 108.31.160.10 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.192.139.127
country_id: 3996063
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 189.192.139.127 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.70.146.200
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 95.70.146.200 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 70.190.72.45
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 70.190.72.45 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.130.234.203
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 97.130.234.203 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.133.152.77
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 24.133.152.77 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.209.58.29
country_id: 3865483
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 181.209.58.29 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.36.136.52
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 49.36.136.52 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.12.8.167
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 177.12.8.167 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.206.100.158
country_id: 6251999
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 173.206.100.158 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.180.48.133
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 78.180.48.133 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.0.115.246
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.0.115.246 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.18.65.112
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.18.65.112 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.171.137.231
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.171.137.231 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 106.215.179.52
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 106.215.179.52 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.5.216.142
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 104.5.216.142 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.214.56.40
country_id: 630336
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 37.214.56.40 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.238.135.197
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 160.238.135.197 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.79.251.158
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 170.79.251.158 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.250.190.101
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 191.250.190.101 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.237.3.151
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.237.3.151 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.173.7.84
country_id: 3865483
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 190.173.7.84 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.7.247.92
country_id: 1605651
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 171.7.247.92 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.154.102.188
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 47.154.102.188 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.135.38.210
country_id: 1168579
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 139.135.38.210 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.129.113.76
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 150.129.113.76 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.239.30.192
country_id: 3865483
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 170.239.30.192 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.146.199.208
country_id: 2542007
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 197.146.199.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.244.132.177
country_id: 1562822
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 14.244.132.177 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.140.145.87
country_id: 1168579
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 192.140.145.87 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.59.86.107
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 152.59.86.107 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 62.113.87.107
country_id: 2017370
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 62.113.87.107 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 92.253.31.61
country_id: 248816
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 92.253.31.61 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.213.96.163
country_id: 6251999
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.213.96.163 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 1.187.238.39
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 1.187.238.39 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.116.201.105
country_id: 3865483
description:
[2025-11-01 12:21:45 +0530] info [cpaneld] 181.116.201.105 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.91.47.91
country_id: 3469034
description:
[2025-11-01 12:21:45 +0530] info [cpaneld] 177.91.47.91 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-11-01 12:22:06 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:52849: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.178.190.79
country_id: 3017382
description:
[2025-11-01 12:21:46 +0530] info [cpaneld] 88.178.190.79 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.13.244.218
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 73.13.244.218 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.125.247.209
country_id: 2245662
description:
[2025-11-01 12:21:41 +0530] info [cpaneld] 154.125.247.209 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.74.229.182
country_id: 3469034
description:
[2025-11-01 12:21:47 +0530] info [cpaneld] 177.74.229.182 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.201
country_id: 6252001
description:
Nov  1 12:24:40 host2 dovecot[1299590]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.201, lip=66.85.158.92, session=<ID/Q9IJCCOvG6xjJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.175
country_id: 1733045
description:
2025-11-01 12:24:48 dovecot_login authenticator failed for ([49.124.154.175]) [49.124.154.175]:32888: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2025-11-01 12:31:36 dovecot_login authenticator failed for ([182.176.4.105]) [182.176.4.105]:57026: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.176.171.169
country_id: 6251999
description:
2025-11-01 12:30:52 dovecot_login authenticator failed for (169.171.176.69.dhcp.ftth.hstn.citywest.ca) [69.176.171.169]:44049: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2025-11-01 12:30:56 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:40734: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.87.192.126
country_id: 6252001
description:
2025-11-01 12:31:41 dovecot_login authenticator failed for ([96.87.192.126]) [96.87.192.126]:56454: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.150.78
country_id: 6252001
description:
2025-11-01 12:32:47 dovecot_login authenticator failed for (ADMIN) [191.96.150.78]:26256: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 290557
description:
2025-11-01 12:40:36 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:46218: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.18.240.170
country_id: 3686110
description:
2025-11-01 12:41:18 dovecot_login authenticator failed for ([161.18.240.170]) [161.18.240.170]:52744: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.219.2
country_id: 1269750
description:
2025-11-01 12:40:50 dovecot_login authenticator failed for ([59.145.114.82]) [128.185.219.2]:49208: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.127.86
country_id: 1269750
description:
2025-11-01 12:40:57 dovecot_login authenticator failed for (dsl-ncr-dynamic-097.178.23.125.airtelbroadband.in) [182.79.127.86]:37654: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-01 12:48:05 dovecot_login authenticator failed for ([182.95.84.254]) [128.185.199.14]:57170: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 12:48:27 host2 sshd[1507220]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
country_id: 6252001
description:
2025-11-01 12:47:50 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:59251: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 12:47:54 host2 sshd[1506696]: Disconnected from invalid user telecomadmin 2.57.121.112 port 62925 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-01 12:50:33 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:64294: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.170
country_id: 3041565
description:
2025-11-01 12:51:16 dovecot_login authenticator failed for (ADMIN) [173.239.217.170]:56986: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-01 12:50:50 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:52028: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 12:54:26 host2 sshd[1513239]: Disconnected from invalid user telecomadmin 2.57.121.112 port 62651 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 199.45.154.145
country_id: 6252001
description:
Nov  1 12:56:05 host2 dovecot[1497670]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=199.45.154.145, lip=66.85.158.92, TLS: Connection closed, session=<Zd8nZYNCJJ3HLZqR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-11-01 12:56:30 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:35130: 535 Incorrect authentication data (set_id=stuff@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  1 12:56:35 host2 sshd[1516110]: Disconnected from invalid user user 2.57.121.25 port 7501 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.160.134.192
country_id: 1861060
description:
Nov  1 12:57:02 host2 sshd[1516650]: Disconnected from invalid user atul 108.160.134.192 port 58758 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-01 12:56:45 dovecot_login authenticator failed for ([182.95.22.221]) [125.19.251.90]:33832: 535 Incorrect authentication data (set_id=stuff)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-01 12:59:09 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:59942: 535 Incorrect authentication data (set_id=stuff)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-11-01 12:58:49 dovecot_login authenticator failed for ([125.19.110.89]) [182.78.107.6]:49822: 535 Incorrect authentication data (set_id=stuff@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-11-01 13:00:04 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:37776: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-01 13:00:04 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:54631: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov  1 13:00:36 host2 dovecot[1497670]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<C2hRdYNCPoMD7a3c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 108.160.134.192
country_id: 1861060
description:
Nov  1 12:59:57 host2 sshd[1520174]: Disconnected from invalid user admin 108.160.134.192 port 34746 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.5.98.214
country_id: 3469034
description:
2025-11-01 13:01:24 dovecot_login authenticator failed for (191-5-98-214.static.redeglobaltelecom.net.br) [191.5.98.214]:44887: 535 Incorrect authentication data (set_id=stuff@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-11-01 13:00:41 dovecot_login authenticator failed for (31-154-125-200.orange.net.il) [2.55.125.200]:42650: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-11-01 13:00:50 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:56922: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-01 13:01:58 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:49343: 535 Incorrect authentication data (set_id=stuff)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.179
country_id: 2661886
description:
Nov  1 13:02:22 host2 sshd[1523023]: Disconnected from invalid user prova 155.4.244.179 port 34241 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 108.160.134.192
country_id: 1861060
description:
Nov  1 13:02:55 host2 sshd[1523666]: Disconnected from invalid user test1 108.160.134.192 port 38980 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.4.244.179
country_id: 2661886
description:
Nov  1 13:03:54 host2 sshd[1525482]: Disconnected from invalid user testman 155.4.244.179 port 51420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov  1 13:04:42 host2 dovecot[1497670]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.165, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<S5j+g4NCif/CpRCl>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.4.244.179
country_id: 2661886
description:
Nov  1 13:08:18 host2 sshd[1530158]: Disconnected from invalid user user 155.4.244.179 port 14699 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
country_id: 732800
description:
2025-11-01 13:10:14 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:55693: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov  1 13:10:59 host2 dovecot[1497670]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, session=<C5p3moNCmf8t4/6Y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.0.148.211
country_id: 6252001
description:
2025-11-01 13:12:23 dovecot_login authenticator failed for (198-0-148-211-static.hfc.comcastbusiness.net) [198.0.148.211]:44797: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-01 13:12:30 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:47057: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.221.27
country_id: 6252001
description:
2025-11-01 13:18:08 dovecot_login authenticator failed for (ADMIN) [37.19.221.27]:26072: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.84
country_id: 3017382
description:
Nov  1 13:21:06 host2 dovecot[1497670]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.231.89.84, lip=66.85.158.91, session=<W/OkvoNC5Zhb51lU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.82
country_id: 3017382
description:
Nov  1 13:20:38 host2 dovecot[1497670]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.231.89.82, lip=66.85.158.91, session=<a1TxvINCz5pb51lS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.212
country_id: 3017382
description:
Nov  1 13:20:48 host2 dovecot[1497670]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=91.231.89.212, lip=66.85.158.91, session=<M7SPvYNC77Rb51nU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.210
country_id: 3017382
description:
Nov  1 13:21:10 host2 dovecot[1497670]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.210, lip=66.85.158.91, session=<OU7XvoNCs4Bb51nS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-01 13:21:42 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:44078: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2025-11-01 13:21:20 dovecot_login authenticator failed for ([103.67.152.201]) [103.67.152.201]:55078: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-11-01 13:21:28 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:53920: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2025-11-01 13:21:53 dovecot_login authenticator failed for ([125.19.196.207]) [27.123.104.142]:54974: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 13:22:08 host2 sshd[1545251]: Disconnected from invalid user admin 2.57.121.112 port 28475 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
country_id: 6252001
description:
2025-11-01 13:24:52 dovecot_login authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:38706: 535 Incorrect authentication data (set_id=stuff@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-01 13:25:14 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:44778: 535 Incorrect authentication data (set_id=stuff)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-01 13:28:03 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:32779: 535 Incorrect authentication data (set_id=stuff)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-01 13:27:26 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br (187-126-105-145.user.vtal.net.br) [187.126.105.42]:42011: 535 Incorrect authentication data (set_id=stuff@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-11-01 13:30:04 dovecot_login authenticator failed for (47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net) [47.206.63.169]:33490: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-11-01 13:30:39 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:44319: 535 Incorrect authentication data (set_id=admin)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 1477 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
country_id: 3144096
description:
2025-11-01 13:32:14 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:52674: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-11-01 13:32:27 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:44354: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-11-01 13:32:31 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:45267: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-01 13:32:39 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:53696: 535 Incorrect authentication data (set_id=admin)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 314 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.54.40
country_id: 453733
description:
2025-11-01 13:34:08 dovecot_login authenticator failed for 40-54-166-83.dyn.estpak.ee [83.166.54.40]:49116: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 873 connections per 30 seconds to 80 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 1252 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-01 13:35:48 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:33090: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.222.23.245
country_id: 6252001
description:
2025-11-01 13:36:17 dovecot_login authenticator failed for ([158.222.23.245]) [158.222.23.245]:43545: 535 Incorrect authentication data (set_id=awanish)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 784 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-01 13:36:41 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:55049: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
country_id: 1269750
description:
2025-11-01 13:38:58 dovecot_login authenticator failed for ([157.20.228.20]) [157.20.228.20]:51141: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2025-11-01 13:39:12 dovecot_login authenticator failed for ([101.127.101.225]) [101.127.101.225]:51648: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.52
country_id: 6252001
description:
2025-11-01 13:40:56 dovecot_login authenticator failed for (ADMIN) [181.215.182.52]:36752: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-01 13:42:20 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:64079: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.213.98
country_id: 1269750
description:
2025-11-01 13:42:50 dovecot_login authenticator failed for ([128.185.241.123]) [152.52.213.98]:55430: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.235.44
country_id: 1269750
description:
2025-11-01 13:42:56 dovecot_login authenticator failed for (beta.corporatecitizen.in) [103.29.235.44]:46718: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-11-01 13:43:11 dovecot_login authenticator failed for ([103.133.175.82]) [103.142.184.55]:53885: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 13:46:50 host2 sshd[1570623]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 101.2.191.213
country_id: 1227603
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 101.2.191.213 - cloudtourssrilan "GET /cpsess4548032132/frontend/jupiter/filemanager/index.html HTTP/1.1" DEFERRED LOGIN cpaneld: cookie ip check: IP address has changed: IP Address [101.2.187.171] != Current IP Address [101.2.191.213]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-11-01 13:51:31 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:55489: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.226.186
country_id: 1269750
description:
2025-11-01 13:51:42 dovecot_login authenticator failed for ([125.17.165.105]) [125.19.226.186]:33874: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.11.88.29
country_id: 3923057
description:
2025-11-01 13:52:15 dovecot_login authenticator failed for host-190-11-88-29.supernet.com.bo (static-200-58-83-79.supernet.com.bo) [190.11.88.29]:7130: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-11-01 13:52:28 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:34779: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2025-11-01 13:55:24 dovecot_login authenticator failed for (066249.telemar.net.br) [200.216.172.182]:34322: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-11-01 13:55:30 dovecot_login authenticator failed for ([203.193.147.41]) [203.193.147.37]:63300: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-01 13:54:53 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:8549: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-01 13:54:52 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:35410: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-11-01 13:55:13 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:43733: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-11-01 13:56:04 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:45334: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-01 13:55:35 dovecot_login authenticator failed for (173-25-186-130.client.mchsi.com) [173.25.186.130]:61288: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-11-01 13:59:05 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:51954: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.172.89.176
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.172.89.176: 250 connections per 30 seconds to 443 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 34.172.89.176
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 34.172.89.176: 339 connections per 30 seconds to 443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2025-11-01 14:03:16 dovecot_login authenticator failed for (177-174-0-3.user.vivozap.com.br) [177.174.0.3]:58025: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.38
country_id: 1733045
description:
2025-11-01 14:03:41 dovecot_login authenticator failed for ([49.124.153.38]) [49.124.153.38]:60068: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.5.98.214
country_id: 3469034
description:
2025-11-01 14:06:10 dovecot_login authenticator failed for (191-5-98-214.static.redeglobaltelecom.net.br) [191.5.98.214]:37349: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-01 14:06:39 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:41878: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.78.112
country_id: 3017382
description:
2025-11-01 14:12:36 dovecot_login authenticator failed for 217-128-78-112.ftth.fr.orangecustomers.net [217.128.78.112]:44779: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.16
country_id: 1733045
description:
2025-11-01 14:14:43 dovecot_login authenticator failed for ([49.124.153.16]) [49.124.153.16]:34938: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.178
country_id: 1269750
description:
2025-11-01 14:15:06 dovecot_login authenticator failed for (nsg-corporate-57.181.187.122.airtel.in) [182.95.174.178]:60000: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov  1 14:15:07 host2 dovecot[1497670]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<JaXNf4RC/KUD7r/l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.62
country_id: 1269750
description:
2025-11-01 14:17:47 dovecot_login authenticator failed for (nsg-corporate-62.116.187.122.airtel.in) [122.187.116.62]:58090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2025-11-01 14:18:08 dovecot_login authenticator failed for (223-197-145-33.static.imsbiz.com) [223.197.145.33]:55233: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 14:24:49 host2 sshd[1610655]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Nov  1 14:28:11 host2 sshd[1614327]: Disconnected from invalid user andrej 40.83.182.122 port 35702 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.44
country_id: 390903
description:
2025-11-01 14:28:20 dovecot_login authenticator failed for (ADMIN) [79.127.181.44]:35944: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.229.21.151
country_id: 6252001
description:
Nov  1 14:28:21 host2 sshd[1614428]: Disconnected from invalid user jobs 156.229.21.151 port 55572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  1 14:29:20 host2 sshd[1615494]: Disconnected from invalid user catalina 62.60.131.157 port 11474 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov  1 14:32:16 host2 sshd[1618529]: Disconnected from invalid user user 200.118.99.170 port 53294 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.229.21.151
country_id: 6252001
description:
Nov  1 14:34:21 host2 sshd[1620672]: Disconnected from invalid user zzy 156.229.21.151 port 37038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov  1 14:33:54 host2 sshd[1620167]: Disconnected from invalid user sdc 200.118.99.170 port 57680 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 40.83.182.122
country_id: 6252001
description:
Nov  1 14:34:15 host2 sshd[1620605]: Disconnected from invalid user ubuntu 40.83.182.122 port 34958 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.206.49
country_id: 6251999
description:
Nov  1 14:36:23 host2 dovecot[1497670]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=148.113.206.49, lip=66.85.158.92, TLS, session=<F6Dey4RCCNqUcc4x>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.229.21.151
country_id: 6252001
description:
Nov  1 14:36:48 host2 sshd[1623269]: Disconnected from invalid user openhab 156.229.21.151 port 58746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  1 14:37:34 host2 sshd[1623886]: Disconnected from invalid user user 2.57.121.25 port 9091 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.83.182.122
country_id: 6252001
description:
Nov  1 14:38:47 host2 sshd[1625082]: Disconnected from invalid user git 40.83.182.122 port 45152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.145.213.106
country_id: 6252001
description:
Nov  1 14:39:32 host2 sshd[1625960]: Disconnected from invalid user Linux 132.145.213.106 port 46982 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  1 14:41:42 host2 sshd[1628381]: Disconnected from invalid user user 2.57.121.25 port 46012 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.114.171
country_id: 294640
description:
2025-11-01 14:43:40 dovecot_login authenticator failed for (2-55-114-171.orange.net.il) [2.55.114.171]:51920: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 132.145.213.106
country_id: 6252001
description:
Nov  1 14:45:51 host2 sshd[1633261]: Disconnected from invalid user zhuyou 132.145.213.106 port 50154 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2025-11-01 14:46:32 dovecot_login authenticator failed for (aes-static-075.124.17.125.airtel.in) [125.17.124.75]:57702: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.29
country_id: 6252001
description:
2025-11-01 14:46:45 dovecot_login authenticator failed for (ADMIN) [181.41.206.29]:63921: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.51.198
country_id: 3277605
description:
2025-11-01 14:47:04 dovecot_login authenticator failed for wispi-ia.19522251-198.bih.net.ba [195.222.51.198]:34100: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.210.254
country_id: 6251999
description:
Nov  1 14:47:08 host2 dovecot[1497670]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.210.254, lip=66.85.158.92, session=<ItJS8oRCfKGUcdL+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.118.99.170
country_id: 3686110
description:
Nov  1 14:49:20 host2 sshd[1637015]: Disconnected from invalid user openhab 200.118.99.170 port 52374 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2025-11-01 14:49:55 dovecot_login authenticator failed for ([210.56.12.205]) [210.56.12.205]:60692: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-11-01 14:50:20 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:38298: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-01 14:50:47 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:64189: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-11-01 14:50:57 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:60479: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2025-11-01 14:56:33 dovecot_login authenticator failed for (193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:63319: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.202.197
country_id: 3175395
description:
2025-11-01 14:59:27 dovecot_login authenticator failed for host-95-229-202-197.business.telecomitalia.it [95.229.202.197]:51692: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2025-11-01 15:00:12 dovecot_login authenticator failed for 15-50-166-83.dyn.estpak.ee [83.166.50.15]:38404: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.107.104.228
country_id: 1819730
description:
2025-11-01 15:07:33 dovecot_login authenticator failed for (ADMIN) [86.107.104.228]:35096: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-01 15:08:17 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:54913: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-11-01 15:09:13 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:48966: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Nov  1 15:09:36 host2 dovecot[1497670]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<41KlQoVC6uk2rEyT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-01 15:09:39 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:43474: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov  1 15:15:53 host2 dovecot[1497670]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<OMgfWYVCwMgsyhQX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 15:17:32 host2 sshd[1666529]: Disconnected from invalid user  2.57.121.112 port 61687 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Nov  1 15:21:47 host2 sshd[1670722]: Disconnected from invalid user factorio 172.200.228.35 port 46106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2025-11-01 15:22:31 dovecot_login authenticator failed for ([182.79.151.121]) [27.123.84.54]:52702: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-11-01 15:22:37 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:33267: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 15:23:14 host2 sshd[1672334]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-11-01 15:22:53 dovecot_login authenticator failed for ([182.78.70.126]) [182.78.70.126]:48396: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Nov  1 15:23:10 host2 sshd[1672263]: Disconnected from invalid user wow 172.200.228.35 port 60166 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-11-01 15:23:22 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:54736: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.200.228.35
country_id: 6252001
description:
Nov  1 15:25:56 host2 sshd[1675205]: Disconnected from invalid user ubuntu 172.200.228.35 port 52078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.28.151.87
country_id: 1694008
description:
2025-11-01 15:26:32 dovecot_login authenticator failed for ([120.28.151.87]) [120.28.151.87]:51643: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-01 15:27:03 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:39663: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-11-01 15:26:46 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:59958: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-01 15:29:11 dovecot_login authenticator failed for ([197.156.121.38]) [213.55.85.202]:3109: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2025-11-01 15:29:31 dovecot_login authenticator failed for static-200-105-141-172.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.172]:53072: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Nov  1 15:30:12 host2 sshd[1680137]: Disconnected from invalid user odoo 172.200.228.35 port 54194 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.54.182
country_id: 6252001
description:
2025-11-01 15:31:30 dovecot_login authenticator failed for (ADMIN) [212.56.54.182]:10335: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.200.228.35
country_id: 6252001
description:
Nov  1 15:31:34 host2 sshd[1681439]: Disconnected from invalid user henning 172.200.228.35 port 45494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-11-01 15:32:25 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:46432: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-01 15:32:50 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:33712: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2025-11-01 15:32:53 dovecot_login authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:46222: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov  1 15:34:07 host2 dovecot[1497670]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, TLS, session=<1/xVmoVCdq8D7r/l>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.228.181.34
country_id: 3573345
description:
2025-11-01 15:36:04 dovecot_login authenticator failed for ([207.228.181.34]) [207.228.181.34]:41657: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.175.21
country_id: 6252001
description:
2025-11-01 15:35:43 dovecot_login authenticator failed for (syn-072-134-175-021.res.spectrum.com) [72.134.175.21]:42918: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov  1 15:37:08 host2 dovecot[1497670]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=</S0fpYVCFNA2xDDo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.18.126
country_id: 1269750
description:
2025-11-01 15:37:29 dovecot_login authenticator failed for (telemedia-ap-dynamic-126.18.175.122.airtelbroadband.in) [122.175.18.126]:35131: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  1 15:37:31 host2 sshd[1687742]: Disconnected from invalid user lia 62.60.131.157 port 31072 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-01 15:36:53 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57170: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-01 15:38:12 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:35386: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
country_id: 2233387
description:
2025-11-01 15:40:39 dovecot_login authenticator failed for ([195.24.215.70]) [195.24.215.70]:44362: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.141.52.88
country_id: 6252001
description:
Nov  1 15:42:37 host2 sshd[1694086]: Disconnected from invalid user yakov 209.141.52.88 port 40042 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.158.4.216
country_id: 1512440
description:
Nov  1 15:42:47 host2 sshd[1694381]: Disconnected from invalid user baguero 195.158.4.216 port 43635 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.229.78
country_id: 1269750
description:
Nov  1 15:44:19 host2 dovecot[1690571]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<isuru@euroentertainmentlk.com>, method=PLAIN, rip=122.187.229.78, lip=66.85.158.91, TLS, session=<NQOkvYVCyo56u+VO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 68.193.149.88
country_id: 6252001
description:
Nov  1 15:44:36 host2 dovecot[1690571]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<isuru>, method=PLAIN, rip=68.193.149.88, lip=66.85.158.91, TLS, session=<osnZvoVCn5lEwZVY>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.158.4.216
country_id: 1512440
description:
Nov  1 15:45:21 host2 sshd[1697792]: Disconnected from invalid user are 195.158.4.216 port 57374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.141.52.88
country_id: 6252001
description:
Nov  1 15:45:40 host2 sshd[1698058]: Disconnected from invalid user sale 209.141.52.88 port 41394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 15:49:52 host2 sshd[1702417]: Disconnected from invalid user admin 2.57.121.112 port 50925 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.138.123.229
country_id: 294640
description:
2025-11-01 15:52:35 dovecot_plain authenticator failed for ([89.116.164.85]) [77.138.123.229]:52731: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.70.113.156
country_id: 6252001
description:
2025-11-01 15:52:22 dovecot_plain authenticator failed for ip174-70-113-156.no.no.cox.net ([89.116.164.85]) [174.70.113.156]:49461: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.50.165.17
country_id: 6252001
description:
2025-11-01 15:52:27 dovecot_plain authenticator failed for ([89.116.164.85]) [174.50.165.17]:36955: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.42.0.80
country_id: 3469034
description:
2025-11-01 15:52:33 dovecot_plain authenticator failed for ([89.116.164.85]) [177.42.0.80]:38719: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.221.226.222
country_id: 6252001
description:
2025-11-01 15:52:15 dovecot_plain authenticator failed for 69-221-226-222.lightspeed.sndgca.sbcglobal.net ([89.116.164.85]) [69.221.226.222]:58853: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.121.6.128
country_id: 630336
description:
2025-11-01 15:52:26 dovecot_plain authenticator failed for mm-128-6-121-178.gomel.dynamic.pppoe.byfly.by ([89.116.164.85]) [178.121.6.128]:1204: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.226.89.205
country_id: 1269750
description:
2025-11-01 15:52:27 dovecot_plain authenticator failed for ([89.116.164.85]) [103.226.89.205]:40895: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.179.48.94
country_id: 6252001
description:
2025-11-01 15:52:37 dovecot_plain authenticator failed for wsip-184-179-48-94.ga.at.cox.net ([89.116.164.85]) [184.179.48.94]:48799: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.58.7.86
country_id: 3175395
description:
2025-11-01 15:52:16 dovecot_plain authenticator failed for host-82-58-7-86.retail.telecomitalia.it ([89.116.164.85]) [82.58.7.86]:37055: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.183.145.22
country_id: 3469034
description:
2025-11-01 15:52:30 dovecot_plain authenticator failed for ([89.116.164.85]) [179.183.145.22]:43571: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.106.140.73
country_id: 298795
description:
2025-11-01 15:52:08 dovecot_plain authenticator failed for ([89.116.164.85]) [85.106.140.73]:3567: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.40.139
country_id: 1269750
description:
2025-11-01 15:52:26 dovecot_plain authenticator failed for ([89.116.164.85]) [152.59.40.139]:49999: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.186.188.52
country_id: 6252001
description:
2025-11-01 15:52:31 dovecot_plain authenticator failed for ip98-186-188-52.ks.ks.cox.net ([89.116.164.85]) [98.186.188.52]:51702: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.203.152.181
country_id: 630336
description:
2025-11-01 15:52:32 dovecot_plain authenticator failed for ([89.116.164.85]) [185.203.152.181]:40403: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.202.203.177
country_id: 6252001
description:
2025-11-01 15:52:07 dovecot_plain authenticator failed for ([89.116.164.85]) [47.202.203.177]:45117: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.74.71.67
country_id: 1733045
description:
2025-11-01 15:52:14 dovecot_plain authenticator failed for ([89.116.164.85]) [180.74.71.67]:64476: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.110.176.61
country_id: 290557
description:
2025-11-01 15:52:27 dovecot_plain authenticator failed for bba-83-110-176-61.alshamil.net.ae ([89.116.164.85]) [83.110.176.61]:53853: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-01 15:52:29 dovecot_login authenticator failed for ([182.78.159.104]) [182.78.159.82]:58964: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.120.75.158
country_id: 3469034
description:
2025-11-01 15:52:35 dovecot_plain authenticator failed for ([89.116.164.85]) [189.120.75.158]:16371: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.5.188.217
country_id: 298795
description:
2025-11-01 15:52:11 dovecot_plain authenticator failed for ([89.116.164.85]) [95.5.188.217]:45669: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.89.106
country_id: 1269750
description:
2025-11-01 15:52:22 dovecot_plain authenticator failed for ([89.116.164.85]) [49.43.89.106]:37167: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.117.190.122
country_id: 2542007
description:
2025-11-01 15:52:29 dovecot_plain authenticator failed for ([89.116.164.85]) [196.117.190.122]:47509: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.37.192.251
country_id: 6252001
description:
2025-11-01 15:52:26 dovecot_plain authenticator failed for ([89.116.164.85]) [152.37.192.251]:34145: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.225.202.139
country_id: 6252001
description:
2025-11-01 15:52:37 dovecot_plain authenticator failed for 162-225-202-139.lightspeed.frokca.sbcglobal.net ([89.116.164.85]) [162.225.202.139]:43629: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-11-01 15:52:12 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:53916: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.238.69.3
country_id: 6252001
description:
2025-11-01 15:52:22 dovecot_plain authenticator failed for ([89.116.164.85]) [72.238.69.3]:59900: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.161.130
country_id: 3686110
description:
2025-11-01 15:52:14 dovecot_plain authenticator failed for ([89.116.164.85]) [181.129.161.130]:38575: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.204.59.66
country_id: 3469034
description:
2025-11-01 15:52:19 dovecot_plain authenticator failed for ([89.116.164.85]) [186.204.59.66]:16961: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.6.51.166
country_id: 3469034
description:
2025-11-01 15:52:32 dovecot_plain authenticator failed for ([89.116.164.85]) [191.6.51.166]:59649: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.89.242.26
country_id: 1643084
description:
2025-11-01 15:52:33 dovecot_plain authenticator failed for ([89.116.164.85]) [103.89.242.26]:54611: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.178.77.97
country_id: 1269750
description:
2025-11-01 15:52:21 dovecot_plain authenticator failed for ([89.116.164.85]) [122.178.77.97]:57313: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.128.15.18
country_id: 3686110
description:
2025-11-01 15:52:26 dovecot_plain authenticator failed for ([89.116.164.85]) [181.128.15.18]:32965: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.38.159
country_id: 1269750
description:
2025-11-01 15:52:32 dovecot_plain authenticator failed for ([89.116.164.85]) [152.59.38.159]:34415: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.89.56.197
country_id: 6252001
description:
2025-11-01 15:52:11 dovecot_plain authenticator failed for ([89.116.164.85]) [76.89.56.197]:58537: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.9.214.180
country_id: 6252001
description:
2025-11-01 15:52:20 dovecot_plain authenticator failed for ([89.116.164.85]) [107.9.214.180]:39007: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.42.184.179
country_id: 2510769
description:
2025-11-01 15:52:20 dovecot_plain authenticator failed for 62.42.184.179.dyn.user.ono.com ([89.116.164.85]) [62.42.184.179]:57405: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.118.138.56
country_id: 102358
description:
2025-11-01 15:52:26 dovecot_plain authenticator failed for ([89.116.164.85]) [66.118.138.56]:38538: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.181.142.100
country_id: 6252001
description:
2025-11-01 15:52:27 dovecot_plain authenticator failed for c-73-181-142-100.hsd1.wa.comcast.net ([89.116.164.85]) [73.181.142.100]:41339: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.15.145.89
country_id: 6252001
description:
2025-11-01 15:52:26 dovecot_plain authenticator failed for 184-15-145-89.dr02.chtn.wv.frontiernet.net ([89.116.164.85]) [184.15.145.89]:42071: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.195.45.198
country_id: 1269750
description:
2025-11-01 15:52:27 dovecot_plain authenticator failed for ([89.116.164.85]) [106.195.45.198]:35595: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.154.183.21
country_id: 286963
description:
2025-11-01 15:52:31 dovecot_plain authenticator failed for ([89.116.164.85]) [85.154.183.21]:45663: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.80.35.114
country_id: 3469034
description:
2025-11-01 15:52:17 dovecot_plain authenticator failed for ([89.116.164.85]) [170.80.35.114]:45201: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.139.74.97
country_id: 3469034
description:
2025-11-01 15:52:26 dovecot_plain authenticator failed for ([89.116.164.85]) [177.139.74.97]:33306: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.122.153.235
country_id: 294640
description:
2025-11-01 15:52:32 dovecot_plain authenticator failed for ([89.116.164.85]) [37.122.153.235]:30734: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.5.30.212
country_id: 1605651
description:
2025-11-01 15:52:34 dovecot_plain authenticator failed for ([89.116.164.85]) [171.5.30.212]:36717: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.173.117
country_id: 3996063
description:
2025-11-01 15:52:37 dovecot_plain authenticator failed for ([89.116.164.85]) [201.166.173.117]:46519: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.150.252.190
country_id: 3469034
description:
2025-11-01 15:52:14 dovecot_plain authenticator failed for ([89.116.164.85]) [200.150.252.190]:43521: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.10.97.50
country_id: 1643084
description:
2025-11-01 15:52:22 dovecot_plain authenticator failed for ([89.116.164.85]) [182.10.97.50]:55642: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.175.2.138
country_id: 1269750
description:
2025-11-01 15:52:27 dovecot_plain authenticator failed for ([89.116.164.85]) [103.175.2.138]:19485: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.207.69.179
country_id: 6252001
description:
2025-11-01 15:52:29 dovecot_plain authenticator failed for 179.sub-75-207-69.myvzw.com ([89.116.164.85]) [75.207.69.179]:46409: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.12.6.126
country_id: 6252001
description:
2025-11-01 15:52:33 dovecot_plain authenticator failed for ([89.116.164.85]) [108.12.6.126]:40706: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.51.121.247
country_id: 1269750
description:
2025-11-01 15:52:36 dovecot_plain authenticator failed for ([89.116.164.85]) [157.51.121.247]:53741: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.4.196.245
country_id: 6252001
description:
2025-11-01 15:52:38 dovecot_plain authenticator failed for ([89.116.164.85]) [47.4.196.245]:49014: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.138.123.229
country_id: 294640
description:
2025-11-01 15:52:42 dovecot_login authenticator failed for ([89.116.164.85]) [77.138.123.229]:52731: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.120.75.158
country_id: 3469034
description:
2025-11-01 15:52:42 dovecot_login authenticator failed for ([89.116.164.85]) [189.120.75.158]:16371: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.219.27.220
country_id: 953987
description:
2025-11-01 15:52:52 dovecot_plain authenticator failed for ([89.116.164.85]) [102.219.27.220]:28681: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.208.118.170
country_id: 6252001
description:
2025-11-01 15:52:38 dovecot_plain authenticator failed for ([89.116.164.85]) [47.208.118.170]:54815: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.5.30.212
country_id: 1605651
description:
2025-11-01 15:52:41 dovecot_login authenticator failed for ([89.116.164.85]) [171.5.30.212]:36717: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.209.254
country_id: 3469034
description:
2025-11-01 15:52:49 dovecot_plain authenticator failed for ([89.116.164.85]) [45.191.209.254]:23881: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.154.13.222
country_id: 2186224
description:
2025-11-01 15:52:49 dovecot_plain authenticator failed for 222-154-13-222-fibre.sparkbb.co.nz ([89.116.164.85]) [222.154.13.222]:40903: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.215.231
country_id: 3351879
description:
2025-11-01 15:52:52 dovecot_plain authenticator failed for cust-154-118-215-231.zapfibra.co.ao ([89.116.164.85]) [154.118.215.231]:47229: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.203.152.181
country_id: 630336
description:
2025-11-01 15:52:39 dovecot_login authenticator failed for ([89.116.164.85]) [185.203.152.181]:40403: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.133.246.8
country_id: 1269750
description:
2025-11-01 15:52:42 dovecot_plain authenticator failed for ([89.116.164.85]) [112.133.246.8]:42269: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.161.50.16
country_id: 1269750
description:
2025-11-01 15:52:43 dovecot_plain authenticator failed for ([89.116.164.85]) [122.161.50.16]:8835: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.222.237.155
country_id: 298795
description:
2025-11-01 15:52:43 dovecot_plain authenticator failed for ([89.116.164.85]) [82.222.237.155]:54064: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.254.87.152
country_id: 102358
description:
2025-11-01 15:52:45 dovecot_plain authenticator failed for ([89.116.164.85]) [151.254.87.152]:3080: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.90.115.48
country_id: 3469034
description:
2025-11-01 15:52:47 dovecot_plain authenticator failed for ([89.116.164.85]) [187.90.115.48]:55199: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.242.199.213
country_id: 6252001
description:
2025-11-01 15:52:54 dovecot_plain authenticator failed for ([89.116.164.85]) [23.242.199.213]:49252: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.97.0.79
country_id: 6252001
description:
2025-11-01 15:52:58 dovecot_plain authenticator failed for ([89.116.164.85]) [98.97.0.79]:3596: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.42.0.80
country_id: 3469034
description:
2025-11-01 15:52:42 dovecot_login authenticator failed for ([89.116.164.85]) [177.42.0.80]:38719: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.143.128.186
country_id: 6252001
description:
2025-11-01 15:52:43 dovecot_plain authenticator failed for 107-143-128-186.lightspeed.gnbonc.sbcglobal.net ([89.116.164.85]) [107.143.128.186]:45057: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.180.152.59
country_id: 298795
description:
2025-11-01 15:52:55 dovecot_plain authenticator failed for ([89.116.164.85]) [78.180.152.59]:56340: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.100.36.57
country_id: 6252001
description:
2025-11-01 15:52:43 dovecot_plain authenticator failed for c-76-100-36-57.hsd1.md.comcast.net ([89.116.164.85]) [76.100.36.57]:54451: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.51.121.247
country_id: 1269750
description:
2025-11-01 15:52:43 dovecot_login authenticator failed for ([89.116.164.85]) [157.51.121.247]:53741: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.166.173.117
country_id: 3996063
description:
2025-11-01 15:52:43 dovecot_login authenticator failed for ([89.116.164.85]) [201.166.173.117]:46519: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.154.183.21
country_id: 286963
description:
2025-11-01 15:52:38 dovecot_login authenticator failed for ([89.116.164.85]) [85.154.183.21]:45663: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.45.211.47
country_id: 6252001
description:
2025-11-01 15:52:50 dovecot_plain authenticator failed for ool-182dd32f.dyn.optonline.net ([89.116.164.85]) [24.45.211.47]:59755: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.96.94
country_id: 1269750
description:
2025-11-01 15:52:56 dovecot_plain authenticator failed for ([89.116.164.85]) [103.190.96.94]:55755: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.227.90.20
country_id: 3469034
description:
2025-11-01 15:52:58 dovecot_plain authenticator failed for ([89.116.164.85]) [148.227.90.20]:27728: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.122.153.235
country_id: 294640
description:
2025-11-01 15:52:39 dovecot_login authenticator failed for ([89.116.164.85]) [37.122.153.235]:30734: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.225.202.139
country_id: 6252001
description:
2025-11-01 15:52:43 dovecot_login authenticator failed for 162-225-202-139.lightspeed.frokca.sbcglobal.net ([89.116.164.85]) [162.225.202.139]:43629: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.255.162.214
country_id: 1522867
description:
2025-11-01 15:52:41 dovecot_plain authenticator failed for ([89.116.164.85]) [145.255.162.214]:51643: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.108.130.190
country_id: 6252001
description:
2025-11-01 15:52:39 dovecot_plain authenticator failed for ([89.116.164.85]) [66.108.130.190]:39087: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.186.75.245
country_id: 3469034
description:
2025-11-01 15:52:42 dovecot_plain authenticator failed for ([89.116.164.85]) [45.186.75.245]:4771: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.6.51.166
country_id: 3469034
description:
2025-11-01 15:52:38 dovecot_login authenticator failed for ([89.116.164.85]) [191.6.51.166]:59649: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.233.120.82
country_id: 298795
description:
2025-11-01 15:52:42 dovecot_plain authenticator failed for ([89.116.164.85]) [178.233.120.82]:21727: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.174.13
country_id: 6252001
description:
2025-11-01 15:52:43 dovecot_plain authenticator failed for c-24-127-174-13.hsd1.mi.comcast.net ([89.116.164.85]) [24.127.174.13]:42722: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.161.190.253
country_id: 290291
description:
2025-11-01 15:52:44 dovecot_plain authenticator failed for 109-161-190-253.rev.bb.zain.com ([89.116.164.85]) [109.161.190.253]:47900: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.8.164.219
country_id: 1643084
description:
2025-11-01 15:52:44 dovecot_plain authenticator failed for ([89.116.164.85]) [182.8.164.219]:15484: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.63.89.201
country_id: 3469034
description:
2025-11-01 15:52:38 dovecot_plain authenticator failed for ([89.116.164.85]) [177.63.89.201]:39042: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.100.167
country_id: 953987
description:
2025-11-01 15:52:43 dovecot_plain authenticator failed for ([89.116.164.85]) [102.215.100.167]:55550: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.243.198.36
country_id: 298795
description:
2025-11-01 15:52:39 dovecot_plain authenticator failed for ([89.116.164.85]) [88.243.198.36]:28881: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.38.159
country_id: 1269750
description:
2025-11-01 15:52:40 dovecot_login authenticator failed for ([89.116.164.85]) [152.59.38.159]:34415: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.179.48.94
country_id: 6252001
description:
2025-11-01 15:52:43 dovecot_login authenticator failed for wsip-184-179-48-94.ga.at.cox.net ([89.116.164.85]) [184.179.48.94]:48799: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.47.130.245
country_id: 1269750
description:
2025-11-01 15:52:51 dovecot_plain authenticator failed for ([89.116.164.85]) [49.47.130.245]:51331: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.12.6.126
country_id: 6252001
description:
2025-11-01 15:52:39 dovecot_login authenticator failed for ([89.116.164.85]) [108.12.6.126]:40706: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.212.85.177
country_id: 630336
description:
2025-11-01 15:52:55 dovecot_plain authenticator failed for ([89.116.164.85]) [37.212.85.177]:1240: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.113.64.132
country_id: 1269750
description:
2025-11-01 15:52:58 dovecot_plain authenticator failed for ([89.116.164.85]) [45.113.64.132]:47505: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 145.255.113.210
country_id: 286963
description:
2025-11-01 15:52:46 dovecot_plain authenticator failed for ([89.116.164.85]) [145.255.113.210]:64166: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.89.242.26
country_id: 1643084
description:
2025-11-01 15:52:40 dovecot_login authenticator failed for ([89.116.164.85]) [103.89.242.26]:54611: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.59.187.199
country_id: 6252001
description:
2025-11-01 15:52:48 dovecot_plain authenticator failed for ([89.116.164.85]) [172.59.187.199]:38351: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.61.123.30
country_id: 587116
description:
2025-11-01 15:52:52 dovecot_plain authenticator failed for ([89.116.164.85]) [37.61.123.30]:5813: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.238.21.52
country_id: 3996063
description:
2025-11-01 15:52:41 dovecot_plain authenticator failed for ([89.116.164.85]) [189.238.21.52]:49724: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 1533 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.90
country_id: 2782113
description:
2025-11-01 15:59:06 dovecot_login authenticator failed for (ADMIN) [156.146.60.90]:47961: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 1633 connections per 30 seconds to 80 port.


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 16:01:23 host2 sshd[1717190]: error: kex_exchange_identification: read: Connection reset by peer


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 501 connections per 30 seconds to 80 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 837 connections per 30 seconds to 80 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 405 connections per 30 seconds to 80 port.


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 539 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.177.210.193
country_id: 3469034
description:
2025-11-01 16:05:44 dovecot_login authenticator failed for (193.210.177.45.fronteirainternet.com.br) [45.177.210.193]:49813: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 113.196.56.151
country_id: 1668284
description:
Denial of Service (DoS) attack was discovered from 113.196.56.151: 439 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2025-11-01 16:06:13 dovecot_login authenticator failed for ([103.109.13.50]) [103.109.13.50]:42940: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.99.23.122
country_id: 1880251
description:
[2025-11-01 16:07:13 +0530] info [cpaneld] 139.99.23.122 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.131.24.170
country_id: 6252001
description:
2025-11-01 16:08:33 dovecot_login authenticator failed for ([137.131.24.170]) [137.131.24.170]:48582: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.25
country_id: 1733045
description:
2025-11-01 16:09:00 dovecot_login authenticator failed for ([49.124.153.25]) [49.124.153.25]:36354: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2025-11-01 16:12:37 dovecot_login authenticator failed for ([203.193.168.136]) [203.193.168.136]:49676: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-11-01 16:13:02 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:15583: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-11-01 16:13:32 dovecot_login authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:57292: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.55
country_id: 1819730
description:
2025-11-01 16:12:40 dovecot_login authenticator failed for (182.239.78.55.hk.chinamobile.com) [182.239.78.55]:7308: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.178
country_id: 1269750
description:
2025-11-01 16:15:05 dovecot_login authenticator failed for ([182.95.46.178]) [182.95.46.178]:38154: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-11-01 16:15:35 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:41368: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.230
country_id: 6252001
description:
Nov  1 16:16:16 host2 dovecot[1690571]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.230, lip=66.85.158.92, TLS, session=<oikLMYZC5OPN0h/m>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.138.108.57
country_id: 6252001
description:
2025-11-01 16:17:24 dovecot_login authenticator failed for (syn-075-138-108-057.res.spectrum.com) [75.138.108.57]:58636: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-01 16:17:10 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:46330: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-01 16:20:11 dovecot_login authenticator failed for ([125.23.229.142]) [125.19.248.170]:33056: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-11-01 16:20:24 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:55632: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-01 16:21:14 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:39868: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.224
country_id: 6252001
description:
Nov  1 16:21:35 host2 dovecot[1690571]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.224, lip=66.85.158.91, TLS, session=<Q7wVRIZCBPXG6xjg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.91
country_id: 6252001
description:
2025-11-01 16:22:54 dovecot_login authenticator failed for (ADMIN) [140.228.24.91]:10663: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Nov  1 16:26:35 host2 sshd[1744488]: Disconnected from invalid user admin2 188.166.104.136 port 39416 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Nov  1 16:27:13 host2 dovecot[1690571]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, TLS handshaking: Connection closed, session=<IldBWIZCpOBBMQG2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Nov  1 16:27:41 host2 dovecot[1690571]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, TLS: Connection closed, session=<W6jqWYZC6o9BMQG2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.64.205.45
country_id: 3017382
description:
2025-11-01 16:33:31 dovecot_login authenticator failed for 82-64-205-45.subs.proxad.net [82.64.205.45]:27550: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.219.150
country_id: 1269750
description:
2025-11-01 16:34:24 dovecot_login authenticator failed for ([152.52.234.231]) [122.186.219.150]:44818: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Nov  1 16:34:04 host2 sshd[1752783]: Disconnected from invalid user shashank 188.166.104.136 port 44902 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.91
country_id: 2186224
description:
2025-11-01 16:34:23 dovecot_login authenticator failed for ([121.73.169.91]) [121.73.169.91]:39424: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.104.136
country_id: 2750405
description:
Nov  1 16:35:53 host2 sshd[1754634]: Disconnected from invalid user xymon 188.166.104.136 port 50542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-11-01 16:42:48 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:50734: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-11-01 16:43:04 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:54281: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-01 16:43:24 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:44927: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-11-01 16:42:40 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:39007: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.207
country_id: 1733045
description:
2025-11-01 16:45:29 dovecot_login authenticator failed for ([49.124.148.207]) [49.124.148.207]:50840: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.87.166.237
country_id: 6252001
description:
2025-11-01 16:46:08 dovecot_login authenticator failed for syn-172-087-166-237.biz.spectrum.com [172.87.166.237]:1391: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2025-11-01 16:46:23 dovecot_login authenticator failed for ([110.172.147.190]) [110.172.147.190]:43332: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
country_id: 690791
description:
2025-11-01 16:46:26 dovecot_login authenticator failed for (82.193.121.147.ipnet.ua) [82.193.121.147]:50133: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.75.89.78
country_id: 617790
description:
2025-11-01 16:47:19 dovecot_login authenticator failed for (host-static-37-75-89-78.moldtelecom.md) [37.75.89.78]:43973: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.22.27.146
country_id: 2300660
description:
2025-11-01 16:46:50 dovecot_login authenticator failed for ([102.22.27.146]) [102.22.27.146]:34412: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-01 16:46:52 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:50787: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-11-01 16:47:11 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:51010: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.4.64.15
country_id: 1605651
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 171.4.64.15 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.230.104.159
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 43.230.104.159 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.185.26.133
country_id: 1269750
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 223.185.26.133 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.68.131.172
country_id: 2017370
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 188.68.131.172 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.137.68.102
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 99.137.68.102 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.170.146.135
country_id: 3017382
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 91.170.146.135 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-11-01 16:48:20 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:53395: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.255.184.199
country_id: 290291
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 84.255.184.199 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-01 16:48:47 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:50088: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.238
country_id: 2635167
description:
Nov  1 16:51:19 host2 dovecot[1690571]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.238, lip=66.85.158.92, TLS, session=<Uj5proZCHYlX7LDu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.213
country_id: 2635167
description:
Nov  1 16:51:20 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.213, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<M/xzroZCW8ZX7LDV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.33.161.49
country_id: 3175395
description:
Nov  1 16:51:46 host2 sshd[1771636]: Disconnected from invalid user alok 84.33.161.49 port 18289 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.194
country_id: 2635167
description:
Nov  1 16:51:53 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.194, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<fapvsIZCaeRX7LDC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.196
country_id: 2635167
description:
Nov  1 16:52:27 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=87.236.176.196, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uOtzsoZCN5JX7LDE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.194
country_id: 2635167
description:
Nov  1 16:53:00 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.194, lip=66.85.158.92, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<o9BqtIZC9e1X7LDC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.33.161.49
country_id: 3175395
description:
Nov  1 16:53:07 host2 sshd[1772976]: Disconnected from invalid user guest1 84.33.161.49 port 22011 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.212
country_id: 2635167
description:
Nov  1 16:53:33 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<CxNmtoZCg5ZX7LDU>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.215
country_id: 2635167
description:
Nov  1 16:54:06 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=87.236.176.215, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<FYtfuIZCNYZX7LDX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 84.33.161.49
country_id: 3175395
description:
Nov  1 16:53:47 host2 sshd[1773743]: Disconnected from invalid user inbox 84.33.161.49 port 20429 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.208
country_id: 2635167
description:
Nov  1 16:54:39 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.208, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<vrRcuoZCOb6594nQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-01 16:55:03 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:42974: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.195
country_id: 2635167
description:
Nov  1 16:55:13 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.195, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<NxNYvIZCQ7O594nD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.91
country_id: 2186224
description:
2025-11-01 16:54:39 dovecot_login authenticator failed for ([121.73.169.91]) [121.73.169.91]:35950: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.206
country_id: 2635167
description:
Nov  1 16:55:46 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.206, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<KoFRvoZCqZ1X7LDO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.190
country_id: 2635167
description:
Nov  1 16:56:19 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=185.247.137.190, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<2t9MwIZCM66594m+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.33.161.49
country_id: 3175395
description:
Nov  1 16:57:10 host2 sshd[1777772]: Disconnected from invalid user ftpuser 84.33.161.49 port 19530 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-11-01 16:57:32 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:59608: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-01 16:57:04 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:37924: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.242
country_id: 798544
description:
2025-11-01 16:58:02 dovecot_login authenticator failed for (ADMIN) [138.199.59.242]:54728: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 84.33.161.49
country_id: 3175395
description:
Nov  1 16:59:11 host2 sshd[1779892]: Disconnected from invalid user ezybeli 84.33.161.49 port 21357 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 16:59:23 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<wh5Hy4ZCjOYDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-01 16:59:37 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:47244: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 16:59:41 host2 sshd[1780357]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-01 16:59:58 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:37996: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 17:00:47 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=</7xK0IZCAM4DgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 17:02:01 host2 dovecot[1690571]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<JiKx1IZC2IQDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 17:03:27 host2 dovecot[1690571]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<IIPM2YZCUIEDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 17:04:02 host2 dovecot[1690571]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<iWTe24ZC9OYDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 17:05:17 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<MVlk4IZCDtIDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 17:04:55 host2 sshd[1786493]: Disconnected from invalid user admin 2.57.121.112 port 38644 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 17:06:49 host2 dovecot[1690571]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<MmHX5YZCZLcDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 17:08:12 host2 dovecot[1690571]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<c5PR6oZCUtQDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 17:08:13 host2 dovecot[1690571]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<5I3U6oZCpMwDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-01 17:09:10 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:46458: 535 Incorrect authentication data (set_id=admin@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
country_id: 290557
description:
2025-11-01 17:09:34 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:36984: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov  1 17:09:33 host2 dovecot[1690571]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<uP6h74ZCHtwDgmBb>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.228.13
country_id: 2589581
description:
2025-11-01 17:19:49 dovecot_login authenticator failed for (ADMIN) [176.125.228.13]:63704: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.198.80.92
country_id: 1168579
description:
2025-11-01 17:25:06 dovecot_plain authenticator failed for ([192.168.43.195]) [154.198.80.92]:14379: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-11-01 17:24:40 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:53798: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.198.80.92
country_id: 1168579
description:
2025-11-01 17:25:13 dovecot_login authenticator failed for ([192.168.43.195]) [154.198.80.92]:14379: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.161.110
country_id: 1269750
description:
2025-11-01 17:25:12 dovecot_login authenticator failed for (nsg-corporate-56.184.185.122.airtel.in) [125.19.161.110]:46570: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.192.203
country_id: 1522867
description:
2025-11-01 17:27:34 dovecot_login authenticator failed for (2-74-192-203.kcell.kz) [2.74.192.203]:47451: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.161.199
country_id: 2186224
description:
2025-11-01 17:27:58 dovecot_login authenticator failed for ([121.73.161.199]) [121.73.161.199]:60136: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-01 17:33:50 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:52735: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 17:34:19 host2 sshd[1816805]: Disconnected from invalid user 1234 2.57.121.112 port 62695 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-11-01 17:34:36 dovecot_login authenticator failed for ([186.238.157.140]) [187.9.247.58]:36889: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-11-01 17:36:02 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:47119: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.170.1.244
country_id: 3017382
description:
2025-11-01 17:36:51 dovecot_login authenticator failed for 176-170-1-244.abo.bbox.fr [176.170.1.244]:49363: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 17:37:50 host2 sshd[1820432]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.135.217
country_id: 2510769
description:
2025-11-01 17:40:34 dovecot_login authenticator failed for (217.pool90-160-135.dynamic.orange.es) [90.160.135.217]:45340: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-01 17:40:49 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:35324: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-11-01 17:40:52 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:53116: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.24
country_id: 732800
description:
2025-11-01 17:42:54 dovecot_login authenticator failed for (ADMIN) [94.156.14.24]:31934: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  1 17:52:59 host2 sshd[1837669]: Disconnected from invalid user celina 62.60.131.157 port 34868 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-01 18:04:54 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:34078: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-11-01 18:07:03 dovecot_login authenticator failed for (nsg-corporate-246.50.185.122.airtel.in) [182.78.67.22]:44788: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.66
country_id: 2077456
description:
2025-11-01 18:09:27 dovecot_login authenticator failed for (ADMIN) [179.61.228.66]:65010: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-11-01 18:13:34 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:55932: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.247
country_id: 1733045
description:
2025-11-01 18:13:59 dovecot_login authenticator failed for ([49.124.152.247]) [49.124.152.247]:49578: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-11-01 18:19:02 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:40034: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.140.111
country_id: 1819730
description:
2025-11-01 18:19:19 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:32339: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Nov  1 18:22:40 host2 sshd[1872241]: Disconnected from invalid user todd 101.36.122.23 port 42938 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 103.86.176.18
country_id: 1269750
description:
Denial of Service (DoS) attack was discovered from 103.86.176.18: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Nov  1 18:24:29 host2 sshd[1874131]: Disconnected from invalid user guest 143.58.211.64 port 40890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.58.211.64
country_id: 2635167
description:
Nov  1 18:25:45 host2 sshd[1875609]: Disconnected from invalid user peter 143.58.211.64 port 49512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.58.211.64
country_id: 2635167
description:
Nov  1 18:26:59 host2 sshd[1876780]: Disconnected from invalid user keun 143.58.211.64 port 36410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-01 18:29:33 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:56754: 535 Incorrect authentication data (set_id=admin@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.122.23
country_id: 1819730
description:
Nov  1 18:29:31 host2 sshd[1879563]: Disconnected from invalid user peter 101.36.122.23 port 35906 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-11-01 18:30:15 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:43723: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-01 18:30:48 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:44714: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-01 18:31:07 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:52588: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.182
country_id: 6252001
description:
2025-11-01 18:36:39 dovecot_login authenticator failed for (ADMIN) [140.228.24.182]:20715: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 18:36:26 host2 sshd[1886967]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Nov  1 18:42:30 host2 sshd[1893466]: Disconnected from invalid user mina 45.61.187.30 port 42162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Nov  1 18:44:30 host2 sshd[1895812]: Disconnected from invalid user ec2-user 45.61.187.30 port 44098 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-01 18:45:35 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:57969: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-11-01 18:45:54 dovecot_login authenticator failed for ([92.47.46.174]) [92.47.46.174]:58050: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.172.153.88
country_id: 6252001
description:
Nov  1 18:45:33 host2 sshd[1897352]: Disconnected from invalid user dev 167.172.153.88 port 39690 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-11-01 18:48:32 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:59634: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.33.102
country_id: 1522867
description:
2025-11-01 18:49:06 dovecot_login authenticator failed for (102.33.127.188.static.ktc.kz) [188.127.33.102]:35450: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.61.187.30
country_id: 6252001
description:
Nov  1 18:48:15 host2 sshd[1899957]: Disconnected from invalid user jrojas 45.61.187.30 port 47970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.172.153.88
country_id: 6252001
description:
Nov  1 18:49:11 host2 sshd[1901021]: Disconnected from invalid user lcj 167.172.153.88 port 41452 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.61.187.30
country_id: 6252001
description:
Nov  1 18:51:44 host2 sshd[1903563]: Disconnected from invalid user tester 45.61.187.30 port 51838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.181
country_id: 1733045
description:
2025-11-01 18:55:46 dovecot_login authenticator failed for ([49.124.159.181]) [49.124.159.181]:46744: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-01 18:56:02 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:57643: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.185.206
country_id: 6252001
description:
Nov  1 18:57:41 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.124.185.206, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<+xddcohCXsgofLnO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.102
country_id: 1269750
description:
2025-11-01 18:58:11 dovecot_login authenticator failed for ([27.123.104.102]) [27.123.104.102]:51984: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-11-01 18:58:49 dovecot_login authenticator failed for ([191.36.154.175]) [191.36.154.175]:45364: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.249.128.108
country_id: 6252001
description:
Nov  1 18:59:53 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=74.249.128.108, lip=66.85.158.91, TLS, session=<oh0ueohCftdK+YBs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.127.120.34
country_id: 1269750
description:
2025-11-01 19:01:30 dovecot_login authenticator failed for ([45.127.120.34]) [45.127.120.34]:53206: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-01 19:01:58 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:48574: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-01 19:02:14 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:34872: 535 Incorrect authentication data (set_id=prasanka)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.188.201.67
country_id: 6252001
description:
2025-11-01 19:02:20 dovecot_plain authenticator failed for ([89.116.164.85]) [64.188.201.67]:58342: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.59.232.5
country_id: 6252001
description:
2025-11-01 19:02:31 dovecot_plain authenticator failed for ([89.116.164.85]) [143.59.232.5]:34674: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.22.254
country_id: 1643084
description:
2025-11-01 19:02:08 dovecot_plain authenticator failed for ([89.116.164.85]) [103.55.22.254]:32834: 535 Incorrect authentication data (set_id=info@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-11-01 19:02:07 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com [208.105.196.214]:34784: 535 Incorrect authentication data (set_id=prasanka@agronatureholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.30
country_id: 3042225
description:
2025-11-01 19:03:20 dovecot_login authenticator failed for (ADMIN) [91.90.124.30]:36264: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-01 19:05:00 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:48327: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
country_id: 798544
description:
2025-11-01 19:04:44 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:55212: 535 Incorrect authentication data (set_id=accounts@agronatureholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.25.236.192
country_id: 2510769
description:
Nov  1 19:05:24 host2 sshd[1919086]: Disconnected from invalid user daro 46.25.236.192 port 36758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.25.236.192
country_id: 2510769
description:
Nov  1 19:07:35 host2 sshd[1921163]: Disconnected from invalid user godwin 46.25.236.192 port 35310 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.18
country_id: 6252001
description:
Nov  1 19:10:06 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.18, lip=66.85.158.91, session=<uVnDnohCG6jDuEwS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.118
country_id: 6252001
description:
Nov  1 19:10:17 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.118, lip=66.85.158.91, session=<j7hln4hCT7bDuEx2>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 19:14:45 host2 sshd[1928531]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.113
country_id: 6252001
description:
Nov  1 19:14:06 host2 dovecot[1890606]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=195.184.76.113, lip=66.85.158.91, session=<mRwJrYhCcbvDuExx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.114
country_id: 6252001
description:
Nov  1 19:14:09 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.114, lip=66.85.158.91, session=<buI4rYhCvd3DuExy>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.25.236.192
country_id: 2510769
description:
Nov  1 19:18:48 host2 sshd[1932430]: Disconnected from invalid user guest 46.25.236.192 port 56110 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-01 19:21:56 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64159: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.117
country_id: 357994
description:
2025-11-01 19:26:35 dovecot_login authenticator failed for (ADMIN) [188.214.122.117]:51693: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2025-11-01 19:28:50 dovecot_login authenticator failed for ([182.95.223.46]) [182.95.223.46]:47180: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.91
country_id: 2186224
description:
2025-11-01 19:29:08 dovecot_login authenticator failed for ([121.73.169.91]) [121.73.169.91]:56662: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.44
country_id: 1733045
description:
2025-11-01 19:31:56 dovecot_login authenticator failed for ([49.124.153.44]) [49.124.153.44]:51972: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-11-01 19:32:17 dovecot_login authenticator failed for ([103.133.175.82]) [103.142.184.55]:54709: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.220.26
country_id: 1269750
description:
2025-11-01 19:38:16 dovecot_login authenticator failed for ([125.19.220.26]) [125.19.220.26]:39706: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
country_id: 1210997
description:
2025-11-01 19:38:47 dovecot_login authenticator failed for ([103.245.109.37]) [103.245.109.37]:52288: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-01 19:39:57 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:57279: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.244
country_id: 1269750
description:
2025-11-01 19:40:22 dovecot_login authenticator failed for ([118.91.176.244]) [118.91.176.244]:48413: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.210.228
country_id: 6251999
description:
Nov  1 19:43:16 host2 pure-ftpd[1956887]: (?@148.113.210.228) [INFO] New connection from 148.113.210.228


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.210.228
country_id: 6251999
description:
Nov  1 19:43:22 host2 pure-ftpd[1957077]: (?@148.113.210.228) [INFO] New connection from 148.113.210.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-01 19:43:23 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:33303: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.156.46
country_id: 1269750
description:
2025-11-01 19:43:35 dovecot_login authenticator failed for ([125.19.156.46]) [125.19.156.46]:39140: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.34
country_id: 3625428
description:
2025-11-01 19:47:48 dovecot_login authenticator failed for (ADMIN) [95.181.237.34]:31572: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov  1 19:49:10 host2 pure-ftpd[1963419]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.193.59
country_id: 6251999
description:
Nov  1 19:49:16 host2 pure-ftpd[1963542]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-01 19:57:01 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:36160: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2025-11-01 19:56:54 dovecot_login authenticator failed for (red.170.233.29.157.ssservicios.com.ar) [170.233.29.157]:49862: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.254
country_id: 1733045
description:
2025-11-01 19:57:09 dovecot_login authenticator failed for ([49.124.152.254]) [49.124.152.254]:38756: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2025-11-01 19:57:15 dovecot_login authenticator failed for ([128.185.254.54]) [128.185.254.54]:59904: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.217.70
country_id: 1269750
description:
2025-11-01 20:06:23 dovecot_login authenticator failed for ([203.129.217.70]) [203.129.217.70]:53618: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-01 20:06:27 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:55321: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-11-01 20:06:39 dovecot_login authenticator failed for ([102.90.34.90]) [102.90.34.90]:32780: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.6.176
country_id: 298795
description:
2025-11-01 20:06:47 dovecot_login authenticator failed for ([188.59.6.176]) [188.59.6.176]:59433: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 20:06:49 host2 sshd[1982450]: Disconnected from invalid user admin 2.57.121.112 port 28428 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  1 20:07:23 host2 sshd[1982977]: Disconnected from invalid user admin 2.57.121.112 port 28260 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.92.235.70
country_id: 1210997
description:
2025-11-01 20:08:27 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:43934: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2025-11-01 20:08:29 dovecot_login authenticator failed for (pXaafK) [45.92.33.82]:63670: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  1 20:08:29 host2 sshd[1984068]: Disconnected from invalid user luca 62.60.131.157 port 23017 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2025-11-01 20:09:17 dovecot_login authenticator failed for (NK7dRE) [45.92.33.82]:50331: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.223
country_id: 99237
description:
2025-11-01 20:11:04 dovecot_plain authenticator failed for (hexte) [65.20.155.223]:38356: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.92.33.82
country_id: 390903
description:
2025-11-01 20:10:08 dovecot_login authenticator failed for (gJ74Hi) [45.92.33.82]:52815: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.168.122.69
country_id: 1269750
description:
2025-11-01 20:11:20 dovecot_login authenticator failed for (abts-mp-dynamic-069.122.168.122.airtelbroadband.in) [122.168.122.69]:46592: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-01 20:11:36 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:33956: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.107.104.231
country_id: 1819730
description:
2025-11-01 20:12:38 dovecot_login authenticator failed for (ADMIN) [86.107.104.231]:42778: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 20:13:34 host2 sshd[1989274]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-11-01 20:14:27 dovecot_plain authenticator failed for (jecors) [94.201.22.158]:36883: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.46.228.199
country_id: 6252001
description:
Nov  1 20:14:08 host2 pure-ftpd[1990012]: (?@20.46.228.199) [INFO] New connection from 20.46.228.199


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.114.171
country_id: 294640
description:
2025-11-01 20:18:46 dovecot_login authenticator failed for (2-55-114-171.orange.net.il) [2.55.114.171]:54694: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.70.126
country_id: 1269750
description:
2025-11-01 20:18:11 dovecot_login authenticator failed for ([125.20.232.243]) [182.78.70.126]:53706: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.75.122.7
country_id: 927384
description:
2025-11-01 20:20:32 dovecot_login authenticator failed for ([41.75.122.7]) [41.75.122.7]:59121: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-11-01 20:21:16 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:57220: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.168.234
country_id: 1562822
description:
Nov  1 20:22:36 host2 sshd[1998220]: Disconnected from invalid user ptest 165.154.168.234 port 36978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.228.190.124
country_id: 3865483
description:
2025-11-01 20:23:38 dovecot_login authenticator failed for 45-228-190-124.obercom.net.ar [45.228.190.124]:42202: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.92.35.211
country_id: 1643084
description:
2025-11-01 20:23:53 dovecot_login authenticator failed for ([36.92.35.211]) [36.92.35.211]:55250: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  1 20:23:29 host2 sshd[1999041]: Disconnected from invalid user user 27.254.235.2 port 48674 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.162.24
country_id: 3469034
description:
2025-11-01 20:25:00 dovecot_login authenticator failed for ([131.108.162.24]) [131.108.162.24]:36042: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-11-01 20:25:01 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:34814: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-11-01 20:25:22 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:53564: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2025-11-01 20:25:35 dovecot_plain authenticator failed for c-73-176-157-57.hsd1.il.comcast.net (ferks) [73.176.157.57]:46974: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.186
country_id: 1269750
description:
2025-11-01 20:25:52 dovecot_login authenticator failed for ([182.95.222.186]) [182.95.222.186]:33538: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.164.107.6
country_id: 6252001
description:
Nov  1 20:26:27 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=194.164.107.6, lip=66.85.158.92, session=<v8nHr4lCiIbCpGsG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  1 20:26:48 host2 sshd[2002672]: Disconnected from invalid user bt 27.254.235.2 port 52960 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  1 20:28:21 host2 sshd[2004231]: Disconnected from invalid user chen 27.254.235.2 port 54324 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.168.234
country_id: 1562822
description:
Nov  1 20:30:57 host2 sshd[2006725]: Disconnected from invalid user testuser 165.154.168.234 port 52154 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.208.49.189
country_id: 6252001
description:
Nov  1 20:31:39 host2 pure-ftpd[2007671]: (?@172.208.49.189) [INFO] New connection from 172.208.49.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.207.250.28
country_id: 130758
description:
2025-11-01 20:33:03 dovecot_plain authenticator failed for (batold) [213.207.250.28]:41212: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.254.235.2
country_id: 1605651
description:
Nov  1 20:33:13 host2 sshd[2009108]: Disconnected from invalid user ptest 27.254.235.2 port 58454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Nov  1 20:34:20 host2 sshd[2010429]: Disconnected from invalid user vm 157.10.252.119 port 38716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.152.106
country_id: 130758
description:
Nov  1 20:35:08 host2 sshd[2011279]: Disconnected from invalid user hadoop 94.182.152.106 port 39284 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 20:36:51 host2 sshd[2012808]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.60.77.128
country_id: 6252001
description:
2025-11-01 20:37:28 dovecot_plain authenticator failed for c-68-60-77-128.hsd1.mi.comcast.net (imphiffety) [68.60.77.128]:40004: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.94.170.106
country_id: 6252001
description:
Nov  1 20:37:42 host2 sshd[2014069]: Disconnected from invalid user tuser 155.94.170.106 port 55040 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.154.168.234
country_id: 1562822
description:
Nov  1 20:38:51 host2 sshd[2014977]: Disconnected from invalid user douglas 165.154.168.234 port 45442 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.152.106
country_id: 130758
description:
Nov  1 20:39:51 host2 sshd[2015996]: Disconnected from invalid user hadoop 94.182.152.106 port 39644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 155.94.170.106
country_id: 6252001
description:
Nov  1 20:40:08 host2 sshd[2016398]: Disconnected from invalid user altibase 155.94.170.106 port 56912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-01 20:40:27 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (detionness) [71.62.34.216]:58040: 535 Incorrect authentication data (set_id=admin@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-11-01 20:41:09 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (culbardes) [98.227.25.115]:54616: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Nov  1 20:42:14 host2 sshd[2018294]: Disconnected from invalid user bot 157.10.252.119 port 57678 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.94.170.106
country_id: 6252001
description:
Nov  1 20:43:32 host2 sshd[2019770]: Disconnected from invalid user arthur 155.94.170.106 port 59716 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Nov  1 20:43:17 host2 dovecot[1890606]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.91, session=<6lv764lCaH5BMRRD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.206.98
country_id: 1269750
description:
2025-11-01 20:45:49 dovecot_login authenticator failed for ([103.148.206.98]) [103.148.206.98]:57655: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
country_id: 3469034
description:
2025-11-01 20:45:53 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.28]:40550: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-11-01 20:45:05 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (fiencrome) [73.213.236.66]:60666: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-11-01 20:45:08 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (crothon) [73.137.7.97]:49998: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.10.252.119
country_id: 1643084
description:
Nov  1 20:46:58 host2 sshd[2023763]: Disconnected from invalid user elastic 157.10.252.119 port 53770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2025-11-01 20:46:14 dovecot_login authenticator failed for cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net [81.111.223.51]:60229: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-01 20:46:28 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:43086: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Nov  1 20:46:53 host2 sshd[2023723]: Disconnected from invalid user zabbix 103.250.11.116 port 54460 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.10.252.119
country_id: 1643084
description:
Nov  1 20:48:31 host2 sshd[2025155]: Disconnected from invalid user catarina 157.10.252.119 port 49636 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-11-01 20:49:04 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:56720: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-11-01 20:49:49 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (prodyl) [73.230.86.50]:47834: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.212.1.235
country_id: 2017370
description:
2025-11-01 20:51:41 dovecot_login authenticator failed for ([155.212.1.235]) [155.212.1.235]:57238: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 20:51:59 host2 sshd[2028915]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-01 20:52:06 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:62799: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.250.11.116
country_id: 1643084
description:
Nov  1 20:53:56 host2 sshd[2030621]: Disconnected from invalid user hadoop 103.250.11.116 port 58484 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.54.29
country_id: 6252001
description:
2025-11-01 20:55:39 dovecot_plain authenticator failed for c-67-172-54-29.hsd1.pa.comcast.net (merita) [67.172.54.29]:35048: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-11-01 20:57:23 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (rently) [73.196.144.25]:35078: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.186
country_id: 2077456
description:
2025-11-01 20:58:23 dovecot_login authenticator failed for (ADMIN) [179.61.228.186]:27289: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-01 20:58:30 dovecot_login authenticator failed for ([125.17.198.105]) [125.19.251.90]:40090: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-01 20:58:51 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:54677: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-01 20:59:07 dovecot_plain authenticator failed for (argar) [102.53.15.17]:45675: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-11-01 21:00:44 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:48778: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-11-01 21:01:17 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:39224: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.103.72
country_id: 6252001
description:
2025-11-01 21:02:03 dovecot_plain authenticator failed for c-73-0-103-72.hsd1.fl.comcast.net ([89.116.164.85]) [73.0.103.72]:55368: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.53.55.244
country_id: 718075
description:
2025-11-01 21:02:12 dovecot_plain authenticator failed for ([89.116.164.85]) [92.53.55.244]:6519: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.7.68
country_id: 1269750
description:
2025-11-01 21:02:14 dovecot_plain authenticator failed for ([89.116.164.85]) [103.157.7.68]:64889: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.84.198.38
country_id: 1269750
description:
2025-11-01 21:02:21 dovecot_plain authenticator failed for ([89.116.164.85]) [103.84.198.38]:26831: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.208.93.73
country_id: 6252001
description:
2025-11-01 21:02:24 dovecot_plain authenticator failed for 73.sub-97-208-93.myvzw.com ([89.116.164.85]) [97.208.93.73]:59373: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.188.155.105
country_id: 2077456
description:
2025-11-01 21:02:29 dovecot_plain authenticator failed for ([89.116.164.85]) [101.188.155.105]:52429: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.213.204
country_id: 1269750
description:
2025-11-01 21:02:34 dovecot_plain authenticator failed for ([89.116.164.85]) [106.222.213.204]:27767: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.198.237.147
country_id: 6252001
description:
2025-11-01 21:02:08 dovecot_plain authenticator failed for c-98-198-237-147.hsd1.tx.comcast.net ([89.116.164.85]) [98.198.237.147]:57907: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.121.0.9
country_id: 630336
description:
2025-11-01 21:02:10 dovecot_plain authenticator failed for mm-9-0-121-178.gomel.dynamic.pppoe.byfly.by ([89.116.164.85]) [178.121.0.9]:3828: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.94.228.83
country_id: 3437598
description:
2025-11-01 21:02:37 dovecot_plain authenticator failed for ([89.116.164.85]) [181.94.228.83]:57424: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.200.212.211
country_id: 1269750
description:
2025-11-01 21:02:49 dovecot_plain authenticator failed for ([89.116.164.85]) [106.200.212.211]:38663: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.140.149.23
country_id: 1168579
description:
2025-11-01 21:02:26 dovecot_plain authenticator failed for ([89.116.164.85]) [192.140.149.23]:45005: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.212.119.190
country_id: 2029969
description:
2025-11-01 21:02:26 dovecot_plain authenticator failed for ([89.116.164.85]) [103.212.119.190]:21528: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.144.237.128
country_id: 3570311
description:
2025-11-01 21:02:40 dovecot_plain authenticator failed for lfbn-lam-1-155-128.w92-144.abo.wanadoo.fr ([89.116.164.85]) [92.144.237.128]:43317: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.36.219.86
country_id: 102358
description:
2025-11-01 21:02:17 dovecot_plain authenticator failed for ([89.116.164.85]) [51.36.219.86]:1910: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.167.214.120
country_id: 298795
description:
2025-11-01 21:02:22 dovecot_plain authenticator failed for ([89.116.164.85]) [78.167.214.120]:39531: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.0.231.195
country_id: 3608932
description:
2025-11-01 21:02:22 dovecot_plain authenticator failed for ([89.116.164.85]) [138.0.231.195]:46082: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.122.109.192
country_id: 3865483
description:
2025-11-01 21:02:24 dovecot_plain authenticator failed for ([89.116.164.85]) [186.122.109.192]:42326: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.106.28.46
country_id: 99237
description:
2025-11-01 21:02:34 dovecot_plain authenticator failed for ([89.116.164.85]) [185.106.28.46]:17758: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.174.222.16
country_id: 6252001
description:
2025-11-01 21:02:09 dovecot_plain authenticator failed for pool-71-174-222-16.bstnma.fios.verizon.net ([89.116.164.85]) [71.174.222.16]:57199: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.154.11.153
country_id: 6252001
description:
2025-11-01 21:02:16 dovecot_plain authenticator failed for ([89.116.164.85]) [162.154.11.153]:42553: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.53.243
country_id: 1269750
description:
2025-11-01 21:02:43 dovecot_plain authenticator failed for ([89.116.164.85]) [103.251.53.243]:20887: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.197.209.145
country_id: 6252001
description:
2025-11-01 21:02:53 dovecot_plain authenticator failed for ip72-197-209-145.sd.sd.cox.net ([89.116.164.85]) [72.197.209.145]:34903: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.10.177.107
country_id: 298795
description:
2025-11-01 21:02:27 dovecot_plain authenticator failed for ([89.116.164.85]) [95.10.177.107]:36755: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.5.67.44
country_id: 298795
description:
2025-11-01 21:02:28 dovecot_plain authenticator failed for ([89.116.164.85]) [95.5.67.44]:47953: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.252.144.33
country_id: 102358
description:
2025-11-01 21:02:26 dovecot_plain authenticator failed for ([89.116.164.85]) [51.252.144.33]:32716: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.75.118.177
country_id: 3469034
description:
2025-11-01 21:02:27 dovecot_plain authenticator failed for ([89.116.164.85]) [187.75.118.177]:44587: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.202.64.47
country_id: 3469034
description:
2025-11-01 21:02:28 dovecot_plain authenticator failed for ([89.116.164.85]) [191.202.64.47]:40393: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.185.24.41
country_id: 6252001
description:
2025-11-01 21:02:37 dovecot_plain authenticator failed for c-73-185-24-41.hsd1.ca.comcast.net ([89.116.164.85]) [73.185.24.41]:57268: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.69.169.181
country_id: 6252001
description:
2025-11-01 21:02:38 dovecot_plain authenticator failed for pool-72-69-169-181.nycmny.fios.verizon.net ([89.116.164.85]) [72.69.169.181]:40291: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.48.253.52
country_id: 1269750
description:
2025-11-01 21:02:51 dovecot_plain authenticator failed for ([89.116.164.85]) [157.48.253.52]:56865: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.144.198.91
country_id: 6252001
description:
2025-11-01 21:02:14 dovecot_plain authenticator failed for 204-144-198-91.cgn.imoncommunications.net ([89.116.164.85]) [204.144.198.91]:26556: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.103.86.50
country_id: 3608932
description:
2025-11-01 21:02:20 dovecot_plain authenticator failed for ([89.116.164.85]) [191.103.86.50]:57364: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.255.184.109
country_id: 290291
description:
2025-11-01 21:02:12 dovecot_plain authenticator failed for ([89.116.164.85]) [84.255.184.109]:10839: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.188.123.194
country_id: 290291
description:
2025-11-01 21:02:12 dovecot_plain authenticator failed for ([89.116.164.85]) [193.188.123.194]:18127: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.40.139
country_id: 1269750
description:
2025-11-01 21:02:13 dovecot_plain authenticator failed for ([89.116.164.85]) [152.59.40.139]:59159: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.148.27.67
country_id: 290291
description:
2025-11-01 21:02:15 dovecot_plain authenticator failed for ([89.116.164.85]) [89.148.27.67]:37767: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.246.178
country_id: 3865483
description:
2025-11-01 21:02:26 dovecot_plain authenticator failed for ([89.116.164.85]) [168.196.246.178]:57492: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.34.65.198
country_id: 1282988
description:
2025-11-01 21:02:05 dovecot_plain authenticator failed for ([89.116.164.85]) [27.34.65.198]:38327: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.222.50
country_id: 1168579
description:
2025-11-01 21:02:08 dovecot_plain authenticator failed for ([89.116.164.85]) [58.65.222.50]:48146: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.230.49.246
country_id: 3895114
description:
2025-11-01 21:02:28 dovecot_plain authenticator failed for ([89.116.164.85]) [45.230.49.246]:35806: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.97.3.67
country_id: 3469034
description:
2025-11-01 21:02:31 dovecot_plain authenticator failed for ([89.116.164.85]) [138.97.3.67]:48703: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.80.22.74
country_id: 6252001
description:
2025-11-01 21:02:33 dovecot_plain authenticator failed for denovomediallc42403.d.subnet.rcn.com ([89.116.164.85]) [216.80.22.74]:37840: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.121.220.247
country_id: 3469034
description:
2025-11-01 21:02:37 dovecot_plain authenticator failed for ([89.116.164.85]) [138.121.220.247]:37389: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.249.157
country_id: 1733045
description:
2025-11-01 21:02:42 dovecot_plain authenticator failed for ([89.116.164.85]) [183.171.249.157]:33502: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.39.246.21
country_id: 102358
description:
2025-11-01 21:02:07 dovecot_plain authenticator failed for ([89.116.164.85]) [51.39.246.21]:13934: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.18.78.35
country_id: 6252001
description:
2025-11-01 21:02:18 dovecot_plain authenticator failed for c-73-18-78-35.hsd1.mi.comcast.net ([89.116.164.85]) [73.18.78.35]:48373: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.199.46.165
country_id: 3658394
description:
2025-11-01 21:02:40 dovecot_plain authenticator failed for ([89.116.164.85]) [181.199.46.165]:36457: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.163.118.198
country_id: 102358
description:
2025-11-01 21:02:33 dovecot_plain authenticator failed for ([89.116.164.85]) [5.163.118.198]:58531: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.173.212.239
country_id: 3017382
description:
2025-11-01 21:02:34 dovecot_plain authenticator failed for 88-173-212-239.subs.proxad.net ([89.116.164.85]) [88.173.212.239]:54013: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.77.130
country_id: 6252001
description:
2025-11-01 21:02:31 dovecot_plain authenticator failed for c-73-208-77-130.hsd1.il.comcast.net ([89.116.164.85]) [73.208.77.130]:47401: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.152.217.108
country_id: 3469034
description:
2025-11-01 21:02:32 dovecot_plain authenticator failed for ([89.116.164.85]) [179.152.217.108]:36677: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.229.105.215
country_id: 2635167
description:
2025-11-01 21:02:38 dovecot_plain authenticator failed for ([89.116.164.85]) [185.229.105.215]:51557: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.3.196.114
country_id: 3374084
description:
2025-11-01 21:02:12 dovecot_plain authenticator failed for ([89.116.164.85]) [196.3.196.114]:53572: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.134.185.143
country_id: 6251999
description:
2025-11-01 21:02:19 dovecot_plain authenticator failed for ([89.116.164.85]) [57.134.185.143]:60854: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.110.208.185
country_id: 6252001
description:
2025-11-01 21:02:20 dovecot_plain authenticator failed for ([89.116.164.85]) [46.110.208.185]:16535: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.54.44
country_id: 1269750
description:
2025-11-01 21:02:30 dovecot_plain authenticator failed for ([89.116.164.85]) [116.72.54.44]:56633: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.170.49
country_id: 3469034
description:
2025-11-01 21:02:30 dovecot_plain authenticator failed for ([89.116.164.85]) [177.22.170.49]:27735: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.171.243.145
country_id: 6252001
description:
2025-11-01 21:02:39 dovecot_plain authenticator failed for 145.sub-97-171-243.myvzw.com ([89.116.164.85]) [97.171.243.145]:60497: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.63.56.141
country_id: 290291
description:
2025-11-01 21:02:40 dovecot_plain authenticator failed for ([89.116.164.85]) [109.63.56.141]:55547: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.43.105.134
country_id: 1269750
description:
2025-11-01 21:02:12 dovecot_plain authenticator failed for ([89.116.164.85]) [49.43.105.134]:43685: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.210.1.195
country_id: 6252001
description:
2025-11-01 21:02:16 dovecot_plain authenticator failed for ([89.116.164.85]) [71.210.1.195]:48015: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.61.150.251
country_id: 6252001
description:
2025-11-01 21:02:18 dovecot_plain authenticator failed for 104-61-150-251.lightspeed.mdldtx.sbcglobal.net ([89.116.164.85]) [104.61.150.251]:42601: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.174.211.210
country_id: 298795
description:
2025-11-01 21:02:37 dovecot_plain authenticator failed for ([89.116.164.85]) [78.174.211.210]:15847: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.70.197.154
country_id: 1269750
description:
2025-11-01 21:02:49 dovecot_plain authenticator failed for ([89.116.164.85]) [103.70.197.154]:34841: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.203.14.130
country_id: 6252001
description:
2025-11-01 21:02:06 dovecot_plain authenticator failed for ([89.116.164.85]) [76.203.14.130]:34167: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.51.220.145
country_id: 6252001
description:
2025-11-01 21:02:09 dovecot_plain authenticator failed for c-98-51-220-145.hsd1.ca.comcast.net ([89.116.164.85]) [98.51.220.145]:57289: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.140.239.7
country_id: 6252001
description:
2025-11-01 21:02:17 dovecot_plain authenticator failed for 7.sub-97-140-239.myvzw.com ([89.116.164.85]) [97.140.239.7]:41141: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.108.194.240
country_id: 298795
description:
2025-11-01 21:02:23 dovecot_plain authenticator failed for ([89.116.164.85]) [85.108.194.240]:4157: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.237.201.24
country_id: 298795
description:
2025-11-01 21:02:25 dovecot_plain authenticator failed for ([89.116.164.85]) [176.237.201.24]:45125: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.113.145.12
country_id: 3469034
description:
2025-11-01 21:02:35 dovecot_plain authenticator failed for ([89.116.164.85]) [179.113.145.12]:36122: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.226.134.189
country_id: 953987
description:
2025-11-01 21:02:51 dovecot_plain authenticator failed for ([89.116.164.85]) [160.226.134.189]:57765: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.226.87.216
country_id: 1269750
description:
2025-11-01 21:02:10 dovecot_plain authenticator failed for ([89.116.164.85]) [103.226.87.216]:47617: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.143.181.99
country_id: 2542007
description:
2025-11-01 21:02:12 dovecot_plain authenticator failed for ([89.116.164.85]) [41.143.181.99]:55319: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.30.159.1
country_id: 2635167
description:
2025-11-01 21:02:23 dovecot_plain authenticator failed for 188.30.159.1.threembb.co.uk ([89.116.164.85]) [188.30.159.1]:41513: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.224.232.214
country_id: 1269750
description:
2025-11-01 21:02:49 dovecot_plain authenticator failed for ([89.116.164.85]) [38.224.232.214]:6557: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.44.26.162
country_id: 298795
description:
2025-11-01 21:02:49 dovecot_plain authenticator failed for ([89.116.164.85]) [92.44.26.162]:49775: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.220.140.214
country_id: 3608932
description:
2025-11-01 21:02:17 dovecot_plain authenticator failed for ([89.116.164.85]) [201.220.140.214]:43059: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.53.55.156
country_id: 102358
description:
2025-11-01 21:02:23 dovecot_plain authenticator failed for ([89.116.164.85]) [188.53.55.156]:9524: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.33.147.132
country_id: 6252001
description:
2025-11-01 21:02:35 dovecot_plain authenticator failed for c-68-33-147-132.hsd1.de.comcast.net ([89.116.164.85]) [68.33.147.132]:50860: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.36.219.249
country_id: 102358
description:
2025-11-01 21:02:25 dovecot_plain authenticator failed for ([89.116.164.85]) [51.36.219.249]:13704: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.92.77.228
country_id: 1269750
description:
2025-11-01 21:02:31 dovecot_plain authenticator failed for ([89.116.164.85]) [111.92.77.228]:57731: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.0.239.57
country_id: 3469034
description:
2025-11-01 21:02:41 dovecot_plain authenticator failed for ([89.116.164.85]) [187.0.239.57]:12778: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.77.100.38
country_id: 3469034
description:
2025-11-01 21:02:44 dovecot_plain authenticator failed for ([89.116.164.85]) [201.77.100.38]:7826: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.152.5.235
country_id: 3469034
description:
2025-11-01 21:02:17 dovecot_plain authenticator failed for ([89.116.164.85]) [24.152.5.235]:53520: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.253.177.220
country_id: 102358
description:
2025-11-01 21:02:20 dovecot_plain authenticator failed for ([89.116.164.85]) [51.253.177.220]:24087: 535 Incorrect authentication data (set_id=admin@epid.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.85
country_id: 2635167
description:
Nov  1 21:04:01 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.85, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<h2AfNopCbsYjy9JV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-11-01 21:03:20 dovecot_login authenticator failed for (dsl-ncr-dynamic-153.4.23.125.airtelbroadband.in) [182.78.111.34]:32898: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2025-11-01 21:03:35 dovecot_login authenticator failed for ([128.185.176.81]) [27.123.112.126]:35054: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.85
country_id: 2635167
description:
Nov  1 21:04:39 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=35.203.210.85, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<jMRuOIpCEOojy9JV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.108.124
country_id: 1819730
description:
2025-11-01 21:05:29 dovecot_login authenticator failed for ([45.251.108.124]) [45.251.108.124]:50944: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-11-01 21:05:50 dovecot_login authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:46592: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
country_id: 2233387
description:
2025-11-01 21:05:58 dovecot_login authenticator failed for ([195.24.215.70]) [195.24.215.70]:37938: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.139.140.231
country_id: 1168579
description:
2025-11-01 21:05:22 dovecot_login authenticator failed for ([103.139.140.231]) [103.139.140.231]:60619: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.46.235
country_id: 1880251
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 159.223.46.235 - 2096cpsess01302957403rdpartyroundcube "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.85
country_id: 2635167
description:
Nov  1 21:11:53 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=35.203.210.85, lip=66.85.158.91, TLS, session=<YnE+UopCOu0jy9JV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-01 21:11:55 dovecot_plain authenticator failed for (croly) [64.72.74.162]:39693: 535 Incorrect authentication data (set_id=contact@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.231
country_id: 6252001
description:
Nov  1 21:12:32 host2 pure-ftpd[2051166]: (?@147.185.132.231) [INFO] New connection from 147.185.132.231


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.186.92
country_id: 357994
description:
2025-11-01 21:12:33 dovecot_plain authenticator failed for (bussite) [154.177.186.92]:42246: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 75.101.203.62
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 75.101.203.62: 250 connections per 30 seconds to 80 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.51.162
country_id: 1149361
description:
2025-11-01 21:14:26 dovecot_login authenticator failed for ([149.54.51.162]) [149.54.51.162]:45977: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.137.7.97
country_id: 6252001
description:
2025-11-01 21:14:34 dovecot_plain authenticator failed for c-73-137-7-97.hsd1.ga.comcast.net (lotsum) [73.137.7.97]:42300: 535 Incorrect authentication data (set_id=contact@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.223.25.174
country_id: 6252001
description:
2025-11-01 21:14:50 dovecot_login authenticator failed for 174.sub-75-223-25.myvzw.com [75.223.25.174]:59360: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.236.111
country_id: 1269750
description:
2025-11-01 21:15:09 dovecot_login authenticator failed for (static.bb.ill.59.92.236.111.bsnl.in) [59.92.236.111]:49400: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-01 21:14:15 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:33758: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-11-01 21:15:36 dovecot_plain authenticator failed for (resher) [65.20.149.93]:48413: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-01 21:17:38 dovecot_login authenticator failed for ([200.148.171.233]) [189.56.0.19]:47598: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
country_id: 3932488
description:
2025-11-01 21:17:43 dovecot_login authenticator failed for ([45.170.50.2]) [45.170.50.2]:57444: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-01 21:17:44 dovecot_login authenticator failed for ([182.95.115.38]) [182.95.115.38]:39658: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.127.120.34
country_id: 1269750
description:
2025-11-01 21:17:46 dovecot_login authenticator failed for ([45.127.120.34]) [45.127.120.34]:49176: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.150
country_id: 1149361
description:
2025-11-01 21:18:01 dovecot_login authenticator failed for ([149.54.33.150]) [149.54.33.150]:56620: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.56
country_id: 1733045
description:
2025-11-01 21:18:03 dovecot_login authenticator failed for ([49.124.153.56]) [49.124.153.56]:36678: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Nov  1 21:17:54 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.92, session=<0VjGZ4pCjolKUi8F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2025-11-01 21:18:04 dovecot_login authenticator failed for (104.214.46.200.psinetpa.net) [200.46.214.110]:47064: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.5
country_id: 6252001
description:
Nov  1 21:18:21 host2 dovecot[1890606]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=74.82.47.5, lip=66.85.158.92, session=<1X9saYpCdpNKUi8F>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-01 21:18:29 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:43767: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.25.90
country_id: 6252001
description:
2025-11-01 21:21:02 dovecot_login authenticator failed for (ADMIN) [158.173.25.90]:57048: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.205
country_id: 6252001
description:
Nov  1 21:22:26 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 12 secs): user=<>, rip=147.185.133.205, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<LJsBeIpCR8WTuYXN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.205
country_id: 6252001
description:
Nov  1 21:23:26 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 14 secs): user=<>, rip=147.185.133.205, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<WrmXe4pCbPaTuYXN>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 216.218.206.67
country_id: 6252001
description:
Nov  1 21:25:45 host2 pure-ftpd[2064993]: (?@216.218.206.67) [INFO] New connection from 216.218.206.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-01 21:30:05 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:33662: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-11-01 21:29:51 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:53442: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.205
country_id: 6252001
description:
Nov  1 21:30:39 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.205, lip=66.85.158.92, TLS, session=<3shhlYpCROeTuYXN>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 21:31:44 host2 sshd[2070922]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-01 21:32:38 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:40716: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-01 21:32:53 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:55051: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.173.169
country_id: 2921044
description:
2025-11-01 21:38:24 dovecot_login authenticator failed for (ADMIN) [181.214.173.169]:39964: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.186.92
country_id: 357994
description:
2025-11-01 21:38:27 dovecot_plain authenticator failed for (pisraph) [154.177.186.92]:49216: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-01 21:38:49 dovecot_plain authenticator failed for (suraled) [65.20.153.146]:53060: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-11-01 21:39:30 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (foreeter) [73.196.144.25]:54734: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.86.111.108
country_id: 6252001
description:
Nov  1 21:40:04 host2 sshd[2080281]: Disconnected from invalid user gitlabrunner 172.86.111.108 port 48106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.177.30.53
country_id: 6252001
description:
2025-11-01 21:40:54 dovecot_plain authenticator failed for c-66-177-30-53.hsd1.fl.comcast.net (shasm) [66.177.30.53]:36404: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.86.111.108
country_id: 6252001
description:
Nov  1 21:41:12 host2 sshd[2081340]: Disconnected from invalid user aileen 172.86.111.108 port 54334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.183.46.135
country_id: 2635167
description:
Nov  1 21:41:43 host2 sshd[2081751]: Disconnected from invalid user aileen 68.183.46.135 port 60178 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov  1 21:44:03 host2 sshd[2084259]: Disconnected from invalid user terraria 164.92.106.89 port 34130 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.183.46.135
country_id: 2635167
description:
Nov  1 21:44:45 host2 sshd[2085033]: Disconnected from invalid user lizj 68.183.46.135 port 44050 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.193.226
country_id: 6252001
description:
Nov  1 21:44:20 host2 pure-ftpd[2084604]: (?@20.65.193.226) [INFO] New connection from 20.65.193.226


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.244.34
country_id: 878675
description:
Nov  1 21:46:38 host2 sshd[2087605]: Disconnected from invalid user anton 197.221.244.34 port 62880 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Nov  1 21:48:11 host2 sshd[2089427]: Disconnected from invalid user talib 164.92.106.89 port 41538 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.217.177.44
country_id: 130758
description:
Nov  1 21:48:53 host2 sshd[2095247]: Disconnected from invalid user web1 91.217.177.44 port 54268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.244.34
country_id: 878675
description:
Nov  1 21:48:25 host2 sshd[2090510]: Disconnected from invalid user aleeza 197.221.244.34 port 25924 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2025-11-01 21:50:06 dovecot_plain authenticator failed for c-73-196-144-25.hsd1.nj.comcast.net (mitante) [73.196.144.25]:53132: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-11-01 21:50:10 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (rinsetis) [174.161.27.82]:58491: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.228.68.232
country_id: 3865483
description:
Nov  1 21:49:19 host2 sshd[2100189]: Disconnected from invalid user mysite 181.228.68.232 port 34558 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.213.240
country_id: 6252001
description:
Nov  1 21:49:25 host2 sshd[2100930]: Disconnected from invalid user apache 192.227.213.240 port 41774 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 21:50:48 host2 sshd[2104332]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.228.68.232
country_id: 3865483
description:
Nov  1 21:50:57 host2 sshd[2104393]: Disconnected from invalid user sharief 181.228.68.232 port 35928 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2025-11-01 21:51:09 dovecot_plain authenticator failed for c-73-208-81-125.hsd1.in.comcast.net (midia) [73.208.81.125]:54464: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.217.177.44
country_id: 130758
description:
Nov  1 21:50:11 host2 sshd[2103345]: Disconnected from invalid user sharief 91.217.177.44 port 36068 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.213.240
country_id: 6252001
description:
Nov  1 21:51:54 host2 sshd[2105329]: Disconnected from invalid user test 192.227.213.240 port 34336 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.221.244.34
country_id: 878675
description:
Nov  1 21:51:57 host2 sshd[2105345]: Disconnected from invalid user carter 197.221.244.34 port 9404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.217.177.44
country_id: 130758
description:
Nov  1 21:52:46 host2 sshd[2106169]: Disconnected from invalid user beo 91.217.177.44 port 54950 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.98.185
country_id: 6252001
description:
Nov  1 21:52:55 host2 sshd[2106248]: Disconnected from invalid user ftpuser 64.227.98.185 port 53028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Nov  1 21:52:48 host2 sshd[2106189]: Disconnected from invalid user testout 177.53.215.134 port 42772 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.227.213.240
country_id: 6252001
description:
Nov  1 21:53:06 host2 sshd[2106560]: Disconnected from invalid user spike 192.227.213.240 port 59788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.27
country_id: 3923057
description:
Nov  1 21:53:15 host2 sshd[2106667]: Disconnected from invalid user test3 190.181.27.27 port 39490 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 177.53.215.134
country_id: 3658394
description:
Nov  1 21:55:55 host2 sshd[2109903]: Disconnected from invalid user zhangjb 177.53.215.134 port 47934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.221.244.34
country_id: 878675
description:
Nov  1 21:55:26 host2 sshd[2109455]: Disconnected from invalid user beo 197.221.244.34 port 34047 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov  1 21:55:42 host2 pure-ftpd[2109742]: (?@66.132.153.130) [INFO] New connection from 66.132.153.130


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Nov  1 21:57:19 host2 sshd[2111452]: Disconnected from invalid user teamspeak 103.248.120.6 port 57446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.218.72
country_id: 2802361
description:
2025-11-01 21:57:31 dovecot_login authenticator failed for (ADMIN) [181.214.218.72]:33651: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.27
country_id: 3923057
description:
Nov  1 22:01:44 host2 sshd[2116378]: Disconnected from invalid user jiangwei 190.181.27.27 port 56078 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 177.53.215.134
country_id: 3658394
description:
Nov  1 22:01:51 host2 sshd[2116478]: Disconnected from invalid user bill 177.53.215.134 port 51944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov  1 22:02:18 host2 sshd[2116921]: Disconnected from invalid user caixabaixa 41.111.162.34 port 21936 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-01 22:02:45 dovecot_plain authenticator failed for (popon) [23.30.11.253]:35844: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.42.27.227
country_id: 3469034
description:
Nov  1 22:02:55 host2 sshd[2117382]: Disconnected from invalid user user 201.42.27.227 port 56820 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2025-11-01 22:02:24 dovecot_plain authenticator failed for c-73-183-74-177.hsd1.pa.comcast.net (unsopen) [73.183.74.177]:50742: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.92.81.41
country_id: 1819730
description:
Nov  1 22:02:36 host2 sshd[2117134]: Disconnected from invalid user wallabag 34.92.81.41 port 34698 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.27
country_id: 3923057
description:
Nov  1 22:03:21 host2 sshd[2118251]: Disconnected from invalid user hrodriguez 190.181.27.27 port 47586 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Nov  1 22:03:51 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, session=<sQYmDItC0snY2s5E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.13
country_id: 6252001
description:
Nov  1 22:03:59 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.13, lip=66.85.158.91, TLS handshaking: Connection closed, session=<XOeXDItCDTxAPsUN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.2
country_id: 6252001
description:
Nov  1 22:04:17 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.2, lip=66.85.158.91, TLS handshaking: Connection closed, session=<J4aqDYtCkGNAPsUC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Nov  1 22:04:20 host2 dovecot[1890606]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, session=<LobfDYtCaELY2s5E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-11-01 22:05:33 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (goodoxing) [68.82.141.145]:38726: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.154.238
country_id: 1168579
description:
Nov  1 22:05:41 host2 sshd[2120935]: Disconnected from invalid user tester 121.52.154.238 port 56748 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.44.190.194
country_id: 3625428
description:
Nov  1 22:07:08 host2 sshd[2122381]: Disconnected from invalid user jy 200.44.190.194 port 52746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov  1 22:08:21 host2 sshd[2123582]: Disconnected from invalid user bkp 41.111.162.34 port 36784 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 200.44.190.194
country_id: 3625428
description:
Nov  1 22:08:36 host2 sshd[2123771]: Disconnected from invalid user mm 200.44.190.194 port 50338 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Nov  1 22:08:45 host2 sshd[2124007]: Disconnected from invalid user admin 139.59.231.45 port 45494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.52.154.238
country_id: 1168579
description:
Nov  1 22:08:45 host2 sshd[2124012]: Disconnected from invalid user aws 121.52.154.238 port 36118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-01 22:10:49 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:34782: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-11-01 22:10:59 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:48180: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.206.54
country_id: 1269750
description:
2025-11-01 22:11:02 dovecot_login authenticator failed for ([128.185.241.87]) [125.19.206.54]:53744: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.97.80
country_id: 1269750
description:
2025-11-01 22:11:11 dovecot_login authenticator failed for (183.82.97.80.actcorp.in) [183.82.97.80]:48558: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov  1 22:11:31 host2 sshd[2127110]: Disconnected from invalid user sdtdserver 41.111.162.34 port 37168 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 193.110.157.47
country_id: 2750405
description:
Nov  1 22:13:49 host2 sshd[2129639]: Invalid user lankaherbalsolutions from 193.110.157.47 port 55328


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Nov  1 22:14:02 host2 sshd[2129830]: Disconnected from invalid user mrr 139.59.231.45 port 38912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.27
country_id: 3923057
description:
Nov  1 22:14:08 host2 sshd[2129956]: Disconnected from invalid user kite 190.181.27.27 port 51418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.159
country_id: 1819730
description:
Nov  1 22:16:03 host2 sshd[2132163]: Invalid user lankaherbalsolutions from 118.193.38.159 port 33906


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.42.27.227
country_id: 3469034
description:
Nov  1 22:16:09 host2 sshd[2132365]: Disconnected from invalid user hrodriguez 201.42.27.227 port 35136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.186.147.126
country_id: 1880251
description:
Nov  1 22:18:09 host2 sshd[2134432]: Invalid user lankaherbalsolutions from 35.186.147.126 port 46630


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.152.60
country_id: 6252001
description:
Nov  1 22:18:37 host2 sshd[2134873]: Invalid user lankaherbalsolutions from 137.184.152.60 port 50330


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-11-01 22:18:39 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (ovoch) [71.230.228.16]:48208: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Nov  1 22:20:17 host2 sshd[2136603]: Disconnected from invalid user yoo 103.248.120.6 port 53876 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Nov  1 22:22:09 host2 sshd[2138348]: Disconnected from invalid user guna 139.59.231.45 port 36278 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.254
country_id: 6252001
description:
Nov  1 22:22:59 host2 dovecot[1890606]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=162.216.149.254, lip=66.85.158.91, session=<8w2GUItCUuqi2JX+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.10
country_id: 6252001
description:
Nov  1 22:22:45 host2 pure-ftpd[2138908]: (?@147.185.132.10) [INFO] New connection from 147.185.132.10


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.195.206
country_id: 6252001
description:
Nov  1 22:23:22 host2 sshd[2139713]: Invalid user askinternationalconsortium from 50.6.195.206 port 53010


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.231.45
country_id: 1880251
description:
Nov  1 22:23:48 host2 sshd[2140108]: Disconnected from invalid user a 139.59.231.45 port 56058 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-01 22:25:53 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (curifted) [24.127.53.61]:39614: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.243
country_id: 2658434
description:
2025-11-01 22:27:43 dovecot_login authenticator failed for (ADMIN) [158.173.152.243]:40204: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.231.45
country_id: 1880251
description:
Nov  1 22:27:14 host2 sshd[2143449]: Disconnected from invalid user amir 139.59.231.45 port 35956 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.93
country_id: 294640
description:
2025-11-01 22:29:01 dovecot_plain authenticator failed for (pluess) [109.226.14.93]:45161: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 22:29:15 host2 sshd[2145785]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Nov  1 22:34:56 host2 sshd[2151776]: Disconnected from invalid user test123 103.248.120.6 port 50050 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-01 22:37:34 dovecot_plain authenticator failed for (crocorths) [216.194.174.27]:65031: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.248.120.6
country_id: 1269750
description:
Nov  1 22:37:53 host2 sshd[2155129]: Disconnected from invalid user leif 103.248.120.6 port 38106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-11-01 22:39:29 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (ficaly) [76.157.219.158]:53028: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-01 22:41:07 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:52746: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-01 22:40:45 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:36054: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-01 22:40:51 dovecot_login authenticator failed for ([125.20.220.9]) [128.185.199.14]:37770: 535 Incorrect authentication data (set_id=info@ajsstarlog.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.228.24
country_id: 3017382
description:
Nov  1 22:44:23 host2 sshd[2162519]: Invalid user lankaherbalsolutions from 146.59.228.24 port 45762


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.198.38
country_id: 1269750
description:
Nov  1 22:46:16 host2 sshd[2165095]: Invalid user lankaherbalsolutions from 66.116.198.38 port 37694


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.48.100.83
country_id: 3932488
description:
Nov  1 22:47:02 host2 sshd[2165842]: Invalid user lankaherbalsolutions from 200.48.100.83 port 43698


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.153
country_id: 2328926
description:
2025-11-01 22:47:52 dovecot_login authenticator failed for (ADMIN) [146.70.65.153]:12061: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-11-01 22:48:25 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (folaing) [67.173.58.47]:44478: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.179
country_id: 1733045
description:
2025-11-01 22:50:03 dovecot_login authenticator failed for ([49.124.159.179]) [49.124.159.179]:42048: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-11-01 22:50:01 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:38656: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.243.150.185
country_id: 2077456
description:
2025-11-01 22:50:32 dovecot_login authenticator failed for 123-243-150-185.static.tpgi.com.au [123.243.150.185]:55890: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2025-11-01 22:50:45 dovecot_login authenticator failed for (nsg-corporate-183.230.187.122.airtel.in) [122.187.230.183]:56913: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Nov  1 22:52:03 host2 sshd[2171195]: Disconnected from invalid user francesca 103.23.199.128 port 39730 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 116.193.191.159
country_id: 1643084
description:
Nov  1 22:52:09 host2 sshd[2171296]: Disconnected from invalid user kevin 116.193.191.159 port 42806 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.210.122
country_id: 2802361
description:
Nov  1 22:52:57 host2 pure-ftpd[2172020]: (?@34.76.210.122) [INFO] New connection from 34.76.210.122


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov  1 22:53:52 host2 sshd[2172847]: Disconnected from invalid user darwin 116.193.191.159 port 50100 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  1 22:56:08 host2 sshd[2175787]: Disconnected from invalid user user 2.57.121.25 port 18209 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.95.26.153
country_id: 1861060
description:
Nov  1 22:57:49 host2 sshd[2177413]: Invalid user lankaherbalsolutions from 150.95.26.153 port 59414


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-11-01 22:59:39 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:53714: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.82.212.15
country_id: 2510769
description:
2025-11-01 22:59:11 dovecot_login authenticator failed for ([88.82.212.15]) [88.82.212.15]:57434: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-01 23:02:22 dovecot_plain authenticator failed for (ripity) [65.20.233.110]:43519: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.23.199.128
country_id: 1643084
description:
Nov  1 23:04:53 host2 sshd[2185183]: Disconnected from invalid user eduard 103.23.199.128 port 43446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.217.141
country_id: 3041565
description:
2025-11-01 23:06:28 dovecot_login authenticator failed for (ADMIN) [173.239.217.141]:40980: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.23.199.128
country_id: 1643084
description:
Nov  1 23:07:02 host2 sshd[2187407]: Disconnected from invalid user admin 103.23.199.128 port 59762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-11-01 23:08:02 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:35796: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.15.147.239
country_id: 1880251
description:
2025-11-01 23:08:09 dovecot_login authenticator failed for bb116-15-147-239.singnet.com.sg [116.15.147.239]:20434: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-01 23:07:24 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:55350: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-11-01 23:07:33 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:10278: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-11-01 23:12:28 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (gampal) [73.129.57.71]:35560: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-11-01 23:12:53 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (surated) [98.193.112.85]:59322: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Nov  1 23:15:23 host2 sshd[2196646]: Disconnected from invalid user mq 42.200.78.78 port 50006 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-11-01 23:15:56 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (juguanthed) [71.224.169.28]:56252: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 42.200.78.78
country_id: 1819730
description:
Nov  1 23:21:26 host2 sshd[2202822]: Disconnected from invalid user kafka 42.200.78.78 port 60998 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.154.22
country_id: 298795
description:
2025-11-01 23:22:24 dovecot_plain authenticator failed for (coutenid) [5.26.154.22]:43854: 535 Incorrect authentication data (set_id=contact@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-01 23:23:59 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52455: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.140.198
country_id: 1819730
description:
2025-11-01 23:25:49 dovecot_login authenticator failed for ([180.188.140.198]) [180.188.140.198]:39152: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 42.200.78.78
country_id: 1819730
description:
Nov  1 23:25:14 host2 sshd[2206810]: Disconnected from invalid user ubuntu 42.200.78.78 port 36042 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2025-11-01 23:25:15 dovecot_login authenticator failed for u153-26.static.grape.cz [93.91.153.26]:41571: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-01 23:26:50 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:49698: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.102
country_id: 1269750
description:
2025-11-01 23:27:11 dovecot_login authenticator failed for ([182.95.54.102]) [182.95.54.102]:57456: 535 Incorrect authentication data (set_id=info@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.197
country_id: 1733045
description:
2025-11-01 23:28:00 dovecot_login authenticator failed for ([49.124.148.197]) [49.124.148.197]:49812: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.231
country_id: 6252001
description:
2025-11-01 23:28:17 dovecot_login authenticator failed for (ADMIN) [212.32.50.231]:39304: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  1 23:30:41 host2 sshd[2212809]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2025-11-01 23:36:40 dovecot_plain authenticator failed for cm-72-241-202-216.buckeyecom.net (unize) [72.241.202.216]:53191: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.22.24.25
country_id: 2017370
description:
Nov  1 23:38:26 host2 dovecot[1890606]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=178.22.24.25, lip=66.85.158.91, session=<SUliXoxCFp6yFhgZ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.196.103.107
country_id: 6290252
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 213.196.103.107 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-11-01 23:43:30 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (nadoutue) [24.1.200.187]:32780: 535 Incorrect authentication data (set_id=info@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-11-01 23:43:41 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (cured) [73.161.96.107]:40846: 535 Incorrect authentication data (set_id=info@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-01 23:46:02 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:43911: 535 Incorrect authentication data (set_id=info@ceylondigest.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.30
country_id: 2186224
description:
2025-11-01 23:46:15 dovecot_login authenticator failed for ([121.73.168.30]) [121.73.168.30]:41604: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Nov  1 23:47:52 host2 sshd[2231284]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 54493


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Nov  1 23:48:02 host2 dovecot[1890606]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, session=<qt+0gIxCSsRBMRRD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.3
country_id: 3625428
description:
2025-11-01 23:48:59 dovecot_login authenticator failed for (ADMIN) [95.181.237.3]:43724: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Nov  1 23:48:16 host2 dovecot[1890606]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, TLS: Connection closed, session=<4BCIgYxC6nFBMRRD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.202
country_id: 6252001
description:
Nov  1 23:48:41 host2 dovecot[1890606]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.202, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Yp4Hg4xC7q5APpzK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.224
country_id: 6252001
description:
Nov  1 23:51:44 host2 dovecot[1890606]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.224, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<mOnxjYxCItvN0h/g>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.221.178
country_id: 1269750
description:
2025-11-01 23:52:02 dovecot_plain authenticator failed for (symers) [125.19.221.178]:38490: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.22.24.25
country_id: 2017370
description:
Nov  1 23:53:29 host2 dovecot[1890606]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=178.22.24.25, lip=66.85.158.92, session=<xQA5lIxCuJ+yFhgZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-11-01 23:55:03 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:36873: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.127.254.199
country_id: 1252634
description:
2025-11-01 23:54:42 dovecot_login authenticator failed for ([103.127.254.199]) [103.127.254.199]:39336: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-01 23:54:55 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:50256: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.170.32
country_id: 2186224
description:
2025-11-01 23:55:16 dovecot_login authenticator failed for ([121.73.170.32]) [121.73.170.32]:57440: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-11-01 23:55:46 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:49920: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.88.31
country_id: 2750405
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 196.251.88.31 - yashiholdings "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashiholdings (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-01 23:58:11 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:36324: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.88.31
country_id: 2750405
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 196.251.88.31 - yashihol "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashihol (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.230.102
country_id: 1269750
description:
2025-11-01 23:57:57 dovecot_login authenticator failed for ([182.78.120.1]) [125.20.230.102]:40104: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.102
country_id: 1819730
description:
2025-11-01 23:57:57 dovecot_login authenticator failed for ([118.26.153.102]) [118.26.153.102]:46240: 535 Incorrect authentication data (set_id=info@colourmarklabels.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-11-01 23:58:09 dovecot_login authenticator failed for 47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net [47.206.63.169]:53724: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-11-01 23:58:33 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:34842: 535 Incorrect authentication data (set_id=info@colperlab.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.148.79
country_id: 1733045
description:
2025-11-01 23:58:57 dovecot_login authenticator failed for ([183.171.148.79]) [183.171.148.79]:38964: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-11-01 23:59:16 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:52830: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Nov  2 00:02:02 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.77, lip=66.85.158.92, TLS handshaking: Connection closed, session=<xM7KsoxCSlZAPsVN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.21.151.21
country_id: 2802361
description:
2025-11-02 00:01:27 dovecot_plain authenticator failed for 78-21-151-21.access.telenet.be (metergic) [78.21.151.21]:55490: 535 Incorrect authentication data (set_id=info@lakwelholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.81
country_id: 6252001
description:
Nov  2 00:01:44 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.81, lip=66.85.158.92, TLS handshaking: Connection closed, session=<go+0sYxCo/lAPsVR>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.148.33.57
country_id: 3595528
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 190.148.33.57 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Nov  2 00:02:16 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.77, lip=66.85.158.92, TLS: Connection closed, session=<wXKWs4xCyDNAPsVN>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 160.19.19.152
country_id: 1643084
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 160.19.19.152 - sysnytechcom "GET /login/?login_only=1&user=sysnytechcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytechcom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.99.180.247
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 179.99.180.247 - sysnyt "GET /login/?login_only=1&user=sysnyt&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyt (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.106.46.33
country_id: 99237
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 91.106.46.33 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.190.248.209
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [whostmgrd] 78.190.248.209 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.215.192.116
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 75.215.192.116 - sy "GET /login/?login_only=1&user=sy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sy (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.209.128.16
country_id: 1522867
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 67.209.128.16 - sysnytech "GET /login/?login_only=1&user=sysnytech&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.182.70.189
country_id: 3469034
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 45.182.70.189 - sysnyte "GET /login/?login_only=1&user=sysnyte&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnyte (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.192.91.139
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 68.192.91.139 - sysny "GET /login/?login_only=1&user=sysny&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysny (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.145.94.88
country_id: 6252001
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 76.145.94.88 - sysn "GET /login/?login_only=1&user=sysn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.230.60.179
country_id: 298795
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 88.230.60.179 - sys "GET /login/?login_only=1&user=sys&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sys (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.9.33.235
country_id: 1643084
description:
[2025-10-23 10:01:31 +0530] info [cpaneld] 182.9.33.235 - sysnytec "GET /login/?login_only=1&user=sysnytec&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sysnytec (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Nov  2 00:08:48 host2 sshd[2254384]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 58445


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.36
country_id: 289688
description:
2025-11-02 00:11:16 dovecot_login authenticator failed for (ADMIN) [95.181.234.36]:1207: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-02 00:14:26 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:43012: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-11-02 00:14:44 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:49583: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.230.86.50
country_id: 6252001
description:
2025-11-02 00:21:46 dovecot_plain authenticator failed for c-73-230-86-50.hsd1.pa.comcast.net (inilinatis) [73.230.86.50]:46496: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Nov  2 00:22:54 host2 sshd[2269872]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 64934


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.176
country_id: 3017382
description:
Nov  2 00:23:42 host2 pure-ftpd[2270708]: (?@91.196.152.176) [INFO] New connection from 91.196.152.176


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.178
country_id: 3017382
description:
Nov  2 00:23:42 host2 pure-ftpd[2270702]: (?@91.196.152.178) [INFO] New connection from 91.196.152.178


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.127.176.139
country_id: 6252001
description:
2025-11-02 00:24:35 dovecot_plain authenticator failed for (preeliver) [199.127.176.139]:56271: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.76.210.122
country_id: 2802361
description:
Nov  2 00:25:27 host2 pure-ftpd[2272718]: (?@34.76.210.122) [INFO] New connection from 34.76.210.122


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov  2 00:25:51 host2 sshd[2273195]: Disconnected from invalid user jaquelin 62.60.131.157 port 44301 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2025-11-02 00:27:35 dovecot_plain authenticator failed for c-73-199-161-144.hsd1.nj.comcast.net (supcomon) [73.199.161.144]:59390: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 00:29:00 host2 sshd[2276405]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.172
country_id: 2635167
description:
Nov  2 00:29:53 host2 dovecot[1890606]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.172, lip=66.85.158.92, TLS, session=<Q4JZFo1CP8NX7LCs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-11-02 00:31:20 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (turid) [73.161.96.107]:56196: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Nov  2 00:31:37 host2 sshd[2279293]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 55387


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov  2 00:32:19 host2 sshd[2280073]: Disconnected from invalid user admin 2.57.121.112 port 35290 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-02 00:33:26 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (subman) [87.103.126.54]:5084: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.23.125.83
country_id: 6252001
description:
2025-11-02 00:33:48 dovecot_plain authenticator failed for c-24-23-125-83.hsd1.pa.comcast.net (ramoody) [24.23.125.83]:55574: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov  2 00:33:53 host2 sshd[2281552]: Disconnected from invalid user user 2.57.121.25 port 16025 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.32.122.34
country_id: 597427
description:
2025-11-02 00:36:06 dovecot_login authenticator failed for (ADMIN) [194.32.122.34]:40369: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.235
country_id: 6252001
description:
Nov  2 00:38:29 host2 dovecot[1890606]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.235, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<yhckNY1C0NjG6xjr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.231
country_id: 6252001
description:
Nov  2 00:42:37 host2 dovecot[2287296]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.231, lip=66.85.158.92, session=</vXpQ41Cvv2TuYTn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.76
country_id: 2328926
description:
2025-11-02 00:48:31 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.76]:63322: 535 Incorrect authentication data (set_id=info@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.235.131
country_id: 690791
description:
2025-11-02 00:48:44 dovecot_login authenticator failed for ([178.158.235.131]) [178.158.235.131]:49416: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2025-11-02 00:50:22 dovecot_plain authenticator failed for c-73-0-191-33.hsd1.fl.comcast.net (melliounad) [73.0.191.33]:35620: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Nov  2 00:51:00 host2 sshd[2300958]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 59044


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.64
country_id: 6252001
description:
Nov  2 00:55:01 host2 pure-ftpd[2306062]: (?@198.235.24.64) [INFO] New connection from 198.235.24.64


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.219.235.108
country_id: 6252001
description:
Nov  2 00:57:32 host2 sshd[2308897]: Invalid user cloudtourssrilan_travel from 104.219.235.108 port 61020


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.111
country_id: 6252001
description:
Nov  2 00:59:24 host2 dovecot[2287296]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.111, lip=66.85.158.91, TLS, session=<3Nzzf41CQOqTuYRv>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.29.23.130
country_id: 6252001
description:
Nov  2 01:01:25 host2 dovecot[2287296]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=20.29.23.130, lip=66.85.158.91, TLS, session=<G58eh41CIsgUHReC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.165.171
country_id: 6252001
description:
2025-11-02 01:03:12 dovecot_login authenticator failed for (ADMIN) [181.214.165.171]:31229: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 72.14.178.148
country_id: 6252001
description:
Nov  2 01:06:02 host2 dovecot[2287296]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=72.14.178.148, lip=66.85.158.92, session=<OZutl41CSJ9IDrKU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 01:06:59 host2 sshd[2321027]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-02 01:09:18 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (siverrice) [87.103.126.54]:26569: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-11-02 01:13:45 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (dronne) [68.46.148.180]:44700: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-11-02 01:17:40 dovecot_plain authenticator failed for (deism) [65.20.129.67]:49149: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov  2 01:24:35 host2 sshd[2339022]: Disconnected from invalid user pass 103.172.20.218 port 49130 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-02 01:26:57 dovecot_plain authenticator failed for (elescy) [64.72.74.162]:45721: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.136.253.239
country_id: 1605651
description:
Nov  2 01:27:34 host2 sshd[2342054]: Disconnected from invalid user back 58.136.253.239 port 59222 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.189.234.27
country_id: 6252001
description:
Nov  2 01:28:55 host2 sshd[2343349]: Disconnected from invalid user admin 12.189.234.27 port 41841 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov  2 01:28:36 host2 sshd[2343107]: Disconnected from invalid user medical 103.172.20.218 port 40328 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.20.218
country_id: 1643084
description:
Nov  2 01:30:04 host2 sshd[2344643]: Disconnected from invalid user admin 103.172.20.218 port 48368 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.104.11.34
country_id: 6252001
description:
Nov  2 01:30:32 host2 dovecot[2287296]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.104.11.34, lip=66.85.158.91, session=<khVH741CfK2saAsi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Nov  2 01:31:16 host2 sshd[2345790]: Disconnected from invalid user joko 165.154.1.18 port 55016 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.20.218
country_id: 1643084
description:
Nov  2 01:31:33 host2 sshd[2346055]: Disconnected from invalid user n 103.172.20.218 port 42678 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.136.253.239
country_id: 1605651
description:
Nov  2 01:32:42 host2 sshd[2347079]: Disconnected from invalid user zwj 58.136.253.239 port 52970 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.54.219
country_id: 2510769
description:
Nov  2 01:33:28 host2 sshd[2347757]: Disconnected from invalid user admin 79.112.54.219 port 47980 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.119.112.96
country_id: 6252001
description:
Nov  2 01:33:48 host2 dovecot[2287296]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.119.112.96, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<X9v0+o1CzK+Hd3Bg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-02 01:33:52 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net (slatuce) [71.62.34.216]:55232: 535 Incorrect authentication data (set_id=admin@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.182.123.205
country_id: 3175395
description:
Nov  2 01:34:39 host2 sshd[2348913]: Disconnected from invalid user ando 37.182.123.205 port 52582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.188
country_id: 1819730
description:
Nov  2 01:35:13 host2 sshd[2349613]: Disconnected from invalid user sentry 156.236.75.188 port 34716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 58.136.253.239
country_id: 1605651
description:
Nov  2 01:36:09 host2 sshd[2350472]: Disconnected from invalid user inna 58.136.253.239 port 43652 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.182.123.205
country_id: 3175395
description:
Nov  2 01:37:41 host2 sshd[2351897]: Disconnected from invalid user openshift 37.182.123.205 port 46348 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 58.136.253.239
country_id: 1605651
description:
Nov  2 01:37:35 host2 sshd[2351804]: Disconnected from invalid user oracle 58.136.253.239 port 60598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.154.1.18
country_id: 1819730
description:
Nov  2 01:38:11 host2 sshd[2352373]: Disconnected from invalid user nader 165.154.1.18 port 39600 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-11-02 01:38:32 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net (proph) [73.45.216.101]:39311: 535 Incorrect authentication data (set_id=info@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-02 01:39:10 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:56412: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-02 01:39:20 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:52344: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.236.75.188
country_id: 1819730
description:
Nov  2 01:39:30 host2 sshd[2353819]: Disconnected from invalid user oo 156.236.75.188 port 48750 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-11-02 01:40:20 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (nucoutd) [73.168.136.150]:56828: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.112.54.219
country_id: 2510769
description:
Nov  2 01:40:36 host2 sshd[2355008]: Disconnected from invalid user oracle 79.112.54.219 port 59526 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 79.112.54.219
country_id: 2510769
description:
Nov  2 01:44:09 host2 sshd[2358623]: Disconnected from invalid user postgres 79.112.54.219 port 37064 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.239.194.95
country_id: 2077456
description:
2025-11-02 01:47:39 dovecot_login authenticator failed for (ADMIN) [173.239.194.95]:59979: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-11-02 01:52:56 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (molotte) [73.224.171.101]:46928: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-02 01:54:29 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (zygodor) [87.103.126.54]:61268: 535 Incorrect authentication data (set_id=info@visionsolutionshospital.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-02 01:54:39 dovecot_plain authenticator failed for (brabing) [65.20.143.159]:55096: 535 Incorrect authentication data (set_id=contact@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.140.198
country_id: 1819730
description:
2025-11-02 01:56:03 dovecot_login authenticator failed for ([180.188.140.198]) [180.188.140.198]:48984: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-02 01:56:31 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:58988: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2025-11-02 02:00:51 dovecot_plain authenticator failed for c-73-171-230-200.hsd1.fl.comcast.net (enebruise) [73.171.230.200]:44035: 535 Incorrect authentication data (set_id=info@trails.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 02:04:49 host2 sshd[2380473]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.32.96.252
country_id: 3017382
description:
2025-11-02 02:13:06 dovecot_login authenticator failed for ip252.ip-178-32-96.eu (ADMIN) [178.32.96.252]:37788: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.101.1.180
country_id: 2635167
description:
2025-11-02 02:12:59 dovecot_plain authenticator failed for (lings) [46.101.1.180]:45034: 535 Incorrect authentication data (set_id=info@sysnytech.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov  2 02:14:05 host2 sshd[2390356]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.46.235.164
country_id: 6252001
description:
Nov  2 02:18:22 host2 dovecot[2287296]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.46.235.164, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<MHFfmo5CHNMULuuk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.171.8.86
country_id: 6252001
description:
Nov  2 02:20:33 host2 dovecot[2287296]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.171.8.86, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Ux4ooo5CRr0UqwhW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Nov  2 02:23:57 host2 sshd[2400459]: Disconnected from invalid user oracle1 146.190.93.207 port 33528 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Nov  2 02:24:16 host2 sshd[2400789]: Disconnected from invalid user pranav 103.187.165.26 port 50490 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.168.136.150
country_id: 6252001
description:
2025-11-02 02:24:23 dovecot_plain authenticator failed for c-73-168-136-150.hsd1.il.comcast.net (deable) [73.168.136.150]:40174: 535 Incorrect authentication data (set_id=info@sivagnanamfoundation.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov  2 02:24:26 host2 sshd[2400943]: Disconnected from invalid user els 189.126.4.42 port 47826 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-02 02:25:10 dovecot_plain authenticator failed for (sentostess) [46.8.245.34]:40456: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Nov  2 02:26:59 host2 sshd[2403543]: Disconnected from invalid user magento_user 103.187.165.26 port 48382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.117.128
country_id: 6252001
description:
Nov  2 02:26:22 host2 sshd[2403019]: Disconnected from invalid user postgres 172.190.117.128 port 34760 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Nov  2 02:26:38 host2 sshd[2403213]: Disconnected from invalid user pranav 146.190.93.207 port 60414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.200
country_id: 1819730
description:
Nov  2 02:27:16 host2 sshd[2403864]: Disconnected from invalid user shoutcast 154.83.15.200 port 52912 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.117.128
country_id: 6252001
description:
Nov  2 02:27:40 host2 sshd[2404146]: Disconnected from invalid user oracle 172.190.117.128 port 58032 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 146.190.93.207
country_id: 1880251
description:
Nov  2 02:28:07 host2 sshd[2404619]: Disconnected from invalid user admin 146.190.93.207 port 60736 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.92.244
country_id: 6252001
description:
Nov  2 02:28:32 host2 sshd[2404991]: Disconnected from invalid user integral 198.12.92.244 port 60602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.92.244
country_id: 6252001
description:
Nov  2 02:29:48 host2 sshd[2406316]: Disconnected from invalid user anna 198.12.92.244 port 38218 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.126.4.42
country_id: 3469034
description:
Nov  2 02:29:52 host2 sshd[2406383]: Disconnected from invalid user conan 189.126.4.42 port 44912 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-02 02:30:07 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:5585: 535 Incorrect authentication data (set_id=info@cloudtourssrilanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Nov  2 02:31:03 host2 sshd[2407805]: Disconnected from invalid user prueba 146.190.93.207 port 39840 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Nov  2 02:30:11 host2 sshd[2406904]: Disconnected from invalid user admin 103.187.165.26 port 54272 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-02 02:30:14 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:55757: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.190.117.128
country_id: 6252001
description:
Nov  2 02:30:29 host2 sshd[2407175]: Disconnected from invalid user angie 172.190.117.128 port 39324 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.126.4.42
country_id: 3469034
description:
Nov  2 02:32:53 host2 sshd[2409476]: Disconnected from invalid user subsonic 189.126.4.42 port 56894 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.190.93.207
country_id: 1880251
description:
Nov  2 02:32:28 host2 sshd[2409105]: Disconnected from invalid user conan 146.190.93.207 port 54860 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.161.96.107
country_id: 6252001
description:
2025-11-02 02:34:27 dovecot_plain authenticator failed for c-73-161-96-107.hsd1.mi.comcast.net (potersm) [73.161.96.107]:44566: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.165.26
country_id: 1643084
description:
Nov  2 02:34:48 host2 sshd[2411205]: Disconnected from invalid user els 103.187.165.26 port 57434 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.49
country_id: 2077456
description:
2025-11-02 02:36:54 dovecot_login authenticator failed for (ADMIN) [179.61.228.49]:20885: 535 Incorrect authentication data (set_id=info@simple-engineering.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.92.244
country_id: 6252001
description:
Nov  2 02:36:27 host2 sshd[2413011]: Disconnected from invalid user test 198.12.92.244 port 39270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.92.244
country_id: 6252001
description:
Nov  2 02:41:05 host2 sshd[2417570]: Disconnected from invalid user onkar 198.12.92.244 port 56990 [preauth]


