# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-11-13 06:51:45 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:46002: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 06:57:13 host2 sshd[2405768]: Disconnected from invalid user admin 2.57.121.112 port 6184 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.179.26
country_id: 732800
description:
2025-11-13 07:01:43 dovecot_login authenticator failed for ([213.91.179.26]) [213.91.179.26]:39002: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.112.28.181
country_id: 6252001
description:
2025-11-13 07:02:14 dovecot_login authenticator failed for ool-45701cb5.dyn.optonline.net [69.112.28.181]:46369: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-13 07:05:55 dovecot_plain authenticator failed for (inerily) [24.187.213.29]:52660: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.56
country_id: 6252001
description:
Nov 13 07:05:57 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.56, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<B0YM529DosrN0h84>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-13 07:05:36 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:32792: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 07:07:42 host2 sshd[2411896]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.226.49.236
country_id: 3469034
description:
2025-11-13 07:07:35 dovecot_login authenticator failed for 45-226-49-236.esadinet.com.br [45.226.49.236]:52396: 535 Incorrect authentication data


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 07:11:22 host2 sshd[2413692]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.61
country_id: 6252001
description:
Nov 13 07:12:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.61, lip=66.85.158.92, TLS: Connection closed, session=<uIwy/29DuKWnXpI9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 13 07:17:26 host2 sshd[2416738]: Disconnected from invalid user user1 165.22.63.108 port 39954 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-11-13 07:20:31 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:36279: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 13 07:23:19 host2 sshd[2420144]: Disconnected from invalid user dat 165.22.63.108 port 40064 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.36.56
country_id: 1819730
description:
Nov 13 07:27:26 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.36.56, lip=66.85.158.91, session=<hCDkM3BDkJ92wSQ4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.36.56
country_id: 1819730
description:
Nov 13 07:27:45 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.36.56, lip=66.85.158.91, session=<RH0KNXBDBMh2wSQ4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 13 07:28:40 host2 sshd[2423338]: Disconnected from invalid user management 165.22.63.108 port 52978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.22.63.108
country_id: 1880251
description:
Nov 13 07:29:58 host2 sshd[2424217]: Disconnected from invalid user user 165.22.63.108 port 45458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 118.193.36.56
country_id: 1819730
description:
Nov 13 07:31:58 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=118.193.36.56, lip=66.85.158.92, session=<f7EdRHBDsKZ2wSQ4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.140
country_id: 298795
description:
2025-11-13 07:33:24 dovecot_login authenticator failed for (ADMIN) [188.213.34.140]:40106: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.252.89
country_id: 3469034
description:
Nov 13 07:33:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.8.252.89, lip=66.85.158.91, TLS, session=<voeoSHBDko6xCPxZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.71.147
country_id: 3469034
description:
Nov 13 07:33:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=177.44.71.147, lip=66.85.158.91, TLS, session=<P6PqSXBDLqKxLEeT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Nov 13 07:34:21 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.119, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<QtKrTHBD88ui2JZ3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Nov 13 07:35:23 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=162.216.150.119, lip=66.85.158.91, TLS: read(size=403) failed: Connection reset by peer, session=<qGZUUHBDBP+i2JZ3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Nov 13 07:35:43 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 13 secs): user=<>, rip=162.216.150.119, lip=66.85.158.91, TLS: read(size=429) failed: Connection reset by peer, session=<ShCFUXBDhvWi2JZ3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.245.181
country_id: 2921044
description:
Nov 13 07:35:36 host2 sshd[2427484]: Disconnected from invalid user saas 91.108.245.181 port 47896 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.62.39
country_id: 1522867
description:
2025-11-13 07:37:18 dovecot_login authenticator failed for 37.151.62.39.dynamic.telecom.kz [37.151.62.39]:53283: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Nov 13 07:37:51 host2 sshd[2428494]: Disconnected from invalid user saas 103.132.243.250 port 52210 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.108.245.181
country_id: 2921044
description:
Nov 13 07:39:21 host2 sshd[2429177]: Disconnected from invalid user botuser 91.108.245.181 port 47446 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-11-13 07:39:41 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:57098: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.10.155
country_id: 6252001
description:
2025-11-13 07:40:09 dovecot_login authenticator failed for (50-82-10-155.client.mchsi.com) [50.82.10.155]:49734: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.132.243.250
country_id: 1269750
description:
Nov 13 07:40:34 host2 sshd[2429999]: Disconnected from invalid user jin 103.132.243.250 port 54494 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.119
country_id: 6252001
description:
Nov 13 07:40:34 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.119, lip=66.85.158.91, TLS, session=<Y7XmYnBDZumi2JZ3>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 07:41:07 host2 sshd[2430394]: Disconnected from invalid user  2.57.121.112 port 62991 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.132.243.250
country_id: 1269750
description:
Nov 13 07:43:13 host2 sshd[2431289]: Disconnected from invalid user tt 103.132.243.250 port 46162 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.143.252
country_id: 1880251
description:
Nov 13 07:45:14 host2 sshd[2432799]: Disconnected from invalid user ubadmin 101.47.143.252 port 59838 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.214.169.10
country_id: 2510769
description:
2025-11-13 07:45:46 dovecot_plain authenticator failed for (masping) [185.214.169.10]:57149: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.245.181
country_id: 2921044
description:
Nov 13 07:45:58 host2 sshd[2433623]: Disconnected from invalid user web 91.108.245.181 port 57828 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.108.245.181
country_id: 2921044
description:
Nov 13 07:48:42 host2 sshd[2434818]: Disconnected from invalid user myuser 91.108.245.181 port 55856 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-11-13 07:49:35 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:42340: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.51
country_id: 298795
description:
2025-11-13 07:49:52 dovecot_login authenticator failed for (88.255.189.51.static.ttnet.com.tr) [88.255.189.51]:39277: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.65
country_id: 1643084
description:
Nov 13 07:56:58 host2 sshd[2440016]: Disconnected from invalid user test1 103.189.235.65 port 56638 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.172.76.147
country_id: 6252001
description:
Nov 13 07:58:13 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.172.76.147, lip=66.85.158.92, TLS, session=<lfv/oXBDCtc2rEyT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.131
country_id: 6252001
description:
Nov 13 07:57:51 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.131, lip=66.85.158.92, TLS handshaking: Connection closed, session=<UZiooHBDxl9ChJmD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.110
country_id: 6252001
description:
2025-11-13 08:01:12 dovecot_login authenticator failed for (ADMIN) [173.244.56.110]:56486: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-11-13 08:01:40 dovecot_login authenticator failed for ([50.187.155.130]) [50.187.155.130]:45704: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.189.235.65
country_id: 1643084
description:
Nov 13 08:02:47 host2 sshd[2443200]: Disconnected from invalid user admin 103.189.235.65 port 41418 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.104
country_id: 798544
description:
Nov 13 08:03:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=128.127.94.104, lip=66.85.158.91, TLS, session=</BuitHBDLNuAf15o>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.111
country_id: 3469034
description:
Nov 13 08:04:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=187.120.72.111, lip=66.85.158.91, TLS, session=<3si/tXBDjpe7eEhv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.118.138
country_id: 732800
description:
2025-11-13 08:04:59 dovecot_login authenticator failed for ([62.182.118.138]) [62.182.118.138]:57702: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2025-11-13 08:05:19 dovecot_login authenticator failed for (nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:57086: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.235.65
country_id: 1643084
description:
Nov 13 08:05:56 host2 sshd[2445495]: Disconnected from invalid user andrew 103.189.235.65 port 51778 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.227.39.222
country_id: 798544
description:
Nov 13 08:07:24 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=46.227.39.222, lip=66.85.158.91, TLS, session=<LNvgwXBDQJ0u4yfe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.43
country_id: 6252001
description:
Nov 13 08:06:34 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.43, lip=66.85.158.92, TLS, session=<W7fYv3BDrOaTuYQr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.46.170.61
country_id: 798544
description:
Nov 13 08:07:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.46.170.61, lip=66.85.158.91, TLS, session=<6J7pwnBDXO25Lqo9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 08:11:43 host2 sshd[2449302]: Disconnected from invalid user admin 2.57.121.112 port 29123 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.143.252
country_id: 1880251
description:
Nov 13 08:19:08 host2 sshd[2453709]: Disconnected from invalid user ml 101.47.143.252 port 44926 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:20:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<1Ktz8XBDkLYDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.24.213.27
country_id: 6252001
description:
2025-11-13 08:19:44 dovecot_login authenticator failed for (ADMIN) [216.24.213.27]:23964: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:21:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<oqBe9HBDUIoDhBfJ>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 08:21:43 host2 sshd[2455377]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:22:24 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=</VN8+HBDbtwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.19
country_id: 6252001
description:
Nov 13 08:23:56 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=172.202.118.19, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Bi3x/XBDqrOsynYT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:23:56 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS, session=<3Iv9/XBDptMDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:24:36 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<AB1bAHFD+osDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:24:57 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<jmCSAXFDvL4DhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.37.10
country_id: 1269750
description:
Nov 13 08:26:14 host2 sshd[2457497]: Disconnected from invalid user consultor 103.52.37.10 port 21921 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:27:04 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Ni8nCXFDlrkDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:27:08 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<ugFjCXFDzOEDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 13 08:27:54 host2 sshd[2458095]: Disconnected from invalid user minecraft 102.140.97.134 port 51786 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov 13 08:28:09 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.92, session=<U0cRDXFD7rkD7r/l>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:28:21 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<iPDEDXFDALQDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:29:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<Sl2zEHFDFMEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:29:38 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<I5NTEnFDsMMDg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-13 08:30:19 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:51096: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-13 08:30:32 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:58172: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 13 08:30:34 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9nuqFXFDJqwDhBfJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:31:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<nC3bGXFDsNQDg9cm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.52.37.10
country_id: 1269750
description:
Nov 13 08:32:09 host2 sshd[2460637]: Disconnected from invalid user sonar 103.52.37.10 port 5725 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:32:47 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS, session=<8yKeHXFDJLoDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 13 08:32:58 host2 sshd[2461197]: Disconnected from invalid user adrian 186.103.169.12 port 55270 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:34:36 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<g1seJHFDDq0Dg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 13 08:34:45 host2 sshd[2462368]: Disconnected from invalid user radio 186.103.169.12 port 46846 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:36:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<i7rJK3FDPOEDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 08:38:37 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, TLS handshaking: Connection closed, session=<UMl8MnFDRqkDg9cm>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 08:39:55 host2 sshd[2466022]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 13 08:39:51 host2 sshd[2465999]: Disconnected from invalid user user1 186.103.169.12 port 60244 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.237.28
country_id: 6252001
description:
2025-11-13 08:41:54 dovecot_plain authenticator failed for c-73-213-237-28.hsd1.va.comcast.net (cphidding) [73.213.237.28]:33770: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.165
country_id: 6252001
description:
Nov 13 08:42:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.165, lip=66.85.158.91, TLS, session=<+00xP3FDMvzG6xil>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.106.155
country_id: 6252001
description:
Nov 13 08:42:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.106.155, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<aFP2P3FD3tgUQGqb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.103.169.12
country_id: 3895114
description:
Nov 13 08:43:18 host2 sshd[2467854]: Disconnected from invalid user testuser 186.103.169.12 port 54196 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2025-11-13 08:43:30 dovecot_login authenticator failed for ([106.0.166.123]) [106.0.166.123]:40888: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.217
country_id: 798544
description:
2025-11-13 08:43:02 dovecot_login authenticator failed for (ADMIN) [138.199.59.217]:38330: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-11-13 08:43:49 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:39518: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.52.37.10
country_id: 1269750
description:
Nov 13 08:44:47 host2 sshd[2469135]: Disconnected from invalid user aura 103.52.37.10 port 43291 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-13 08:45:22 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:36076: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.202
country_id: 1269750
description:
2025-11-13 08:46:23 dovecot_login authenticator failed for ([128.185.247.100]) [182.95.222.202]:51118: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.203.9.130
country_id: 2077456
description:
2025-11-13 08:46:40 dovecot_login authenticator failed for 14-203-9-130.tpgi.com.au [14.203.9.130]:48108: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.67.177.206
country_id: 6252001
description:
Nov 13 08:50:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.67.177.206, lip=66.85.158.91, session=<2RZ+W3FDMOYoQ7HO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-11-13 08:50:16 dovecot_plain authenticator failed for (unsis) [80.227.102.242]:46715: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.66.41.91
country_id: 3469034
description:
Nov 13 08:52:57 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=177.66.41.91, lip=66.85.158.91, TLS, session=<rniPZHFDhLixQilb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.32
country_id: 3469034
description:
Nov 13 08:53:18 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=186.209.249.32, lip=66.85.158.91, TLS, session=<HBrgZXFDN8m60fkg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 13 08:55:28 host2 sshd[2478726]: Disconnected from invalid user user1 102.140.97.134 port 44278 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.21.168.70
country_id: 6252001
description:
2025-11-13 08:59:44 dovecot_login authenticator failed for c-73-21-168-70.hsd1.fl.comcast.net [73.21.168.70]:48950: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-11-13 08:59:56 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:56148: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 13 09:00:22 host2 sshd[2482075]: Disconnected from invalid user user 102.140.97.134 port 49016 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.94
country_id: 1269750
description:
2025-11-13 09:00:32 dovecot_login authenticator failed for (static.bb.vda.117.223.152.94.bsnl.in) [117.223.152.94]:55202: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.254
country_id: 6252001
description:
Nov 13 09:03:03 host2 pure-ftpd[2483739]: (?@198.235.24.254) [INFO] New connection from 198.235.24.254


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.178.83.104
country_id: 6252001
description:
Nov 13 09:04:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=172.178.83.104, lip=66.85.158.92, session=<cA6NjXFD9IasslNo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-11-13 09:05:25 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:35981: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.198
country_id: 2635167
description:
2025-11-13 09:05:35 dovecot_login authenticator failed for (ADMIN) [98.159.234.198]:40025: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.145
country_id: 2186224
description:
2025-11-13 09:05:40 dovecot_login authenticator failed for ([121.73.162.145]) [121.73.162.145]:49078: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.143.93.21
country_id: 2510769
description:
Nov 13 09:06:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.143.93.21, lip=66.85.158.91, TLS, session=<euHSk3FDMrS5j10V>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.79.19.31
country_id: 953987
description:
Nov 13 09:06:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=41.79.19.31, lip=66.85.158.91, TLS, session=<WyEelXFDvZMpTxMf>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.184
country_id: 6252001
description:
Nov 13 09:08:25 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=162.216.150.184, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<umARnXFDGdai2Ja4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.184
country_id: 6252001
description:
Nov 13 09:09:23 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=162.216.150.184, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<+kuEoHFDHOGi2Ja4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.218
country_id: 953987
description:
Nov 13 09:13:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.34.218, lip=66.85.158.91, TLS, session=<wTChrXFDdq1mQCLa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.89.211.101
country_id: 3469034
description:
Nov 13 09:13:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=189.89.211.101, lip=66.85.158.91, TLS, session=<2cHornFDGty9WdNl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.150.184
country_id: 6252001
description:
Nov 13 09:15:14 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.150.184, lip=66.85.158.92, TLS, session=<pdZvtXFDKu2i2Ja4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-11-13 09:15:54 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:35720: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 13 09:16:04 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS: Connection closed, session=<I3xtuHFDBqNChJly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2025-11-13 09:16:21 dovecot_login authenticator failed for ([182.78.240.94]) [182.78.240.94]:51066: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-13 09:17:00 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:47400: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Nov 13 09:17:57 host2 sshd[2494087]: Disconnected from invalid user vaibhav 81.215.228.18 port 35948 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-11-13 09:17:25 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:38992: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2025-11-13 09:18:49 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:64605: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-11-13 09:18:40 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:59643: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Nov 13 09:21:15 host2 sshd[2496107]: Disconnected from invalid user splunk 81.215.228.18 port 59706 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 81.215.228.18
country_id: 298795
description:
Nov 13 09:23:49 host2 sshd[2497684]: Disconnected from invalid user mcserver 81.215.228.18 port 60736 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.210
country_id: 1269750
description:
2025-11-13 09:24:55 dovecot_login authenticator failed for (nsg-corporate-49.218.186.122.airtel.in) [103.251.31.210]:45106: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.65
country_id: 390903
description:
2025-11-13 09:24:39 dovecot_login authenticator failed for (ADMIN) [79.127.181.65]:57785: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2025-11-13 09:25:20 dovecot_login authenticator failed for p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp [60.40.45.223]:52891: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 09:26:08 host2 sshd[2499019]: Disconnected from invalid user admin 2.57.121.112 port 9674 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Nov 13 09:26:10 host2 sshd[2499047]: Disconnected from invalid user dominic 81.215.228.18 port 33510 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 81.215.228.18
country_id: 298795
description:
Nov 13 09:27:18 host2 sshd[2500024]: Disconnected from invalid user erp 81.215.228.18 port 33996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.62.39
country_id: 1522867
description:
2025-11-13 09:27:24 dovecot_login authenticator failed for 37.151.62.39.dynamic.telecom.kz [37.151.62.39]:37645: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.8
country_id: 798544
description:
2025-11-13 09:27:39 dovecot_login authenticator failed for 89-67-37-8.dynamic.play.pl [89.67.37.8]:52416: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.214.200.110
country_id: 953987
description:
Nov 13 09:29:51 host2 sshd[2501519]: Disconnected from invalid user jamshid 102.214.200.110 port 40926 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.214.200.110
country_id: 953987
description:
Nov 13 09:32:51 host2 sshd[2503496]: Disconnected from invalid user super 102.214.200.110 port 60112 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-13 09:33:00 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57117: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.127.40.150
country_id: 3469034
description:
Nov 13 09:34:40 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=189.127.40.150, lip=66.85.158.91, TLS, session=<KQ7V+XFDutq9fyiW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.97.28
country_id: 3865483
description:
Nov 13 09:35:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=190.181.97.28, lip=66.85.158.91, TLS, session=<SV8K+3FDwt++tWEc>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 09:40:51 host2 sshd[2508248]: Disconnected from invalid user 1234 2.57.121.112 port 62836 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 13 09:45:43 host2 sshd[2512404]: Disconnected from invalid user nadine 62.60.131.157 port 24480 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.106.171
country_id: 6252001
description:
2025-11-13 09:46:07 dovecot_login authenticator failed for (ADMIN) [191.96.106.171]:48556: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.206
country_id: 1880251
description:
Nov 13 09:47:12 host2 sshd[2513868]: Disconnected from invalid user shiny 101.47.49.206 port 45694 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.154.22
country_id: 298795
description:
2025-11-13 09:52:50 dovecot_plain authenticator failed for (oblen) [5.26.154.22]:55312: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 09:53:51 host2 sshd[2518030]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.140.124.119
country_id: 2802361
description:
Nov 13 09:54:32 host2 pure-ftpd[2518982]: (?@34.140.124.119) [INFO] New connection from 34.140.124.119


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.124.69
country_id: 690791
description:
Nov 13 09:54:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.17.124.69, lip=66.85.158.91, TLS, session=<tXkCQXJDosO5EXxF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 87.121.76.169
country_id: 732800
description:
Nov 13 09:54:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=87.121.76.169, lip=66.85.158.91, TLS, session=<WEcRQnJDY+tXeUyp>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.163
country_id: 2993457
description:
Nov 13 09:56:31 host2 pure-ftpd[2520389]: (?@194.165.16.163) [INFO] New connection from 194.165.16.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-11-13 10:04:05 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:39000: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.112
country_id: 6252001
description:
2025-11-13 10:03:48 dovecot_login authenticator failed for ([209.23.72.112]) [209.23.72.112]:41252: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.152.109
country_id: 6252001
description:
2025-11-13 10:04:39 dovecot_login authenticator failed for (ADMIN) [102.129.152.109]:53326: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.153
country_id: 3017382
description:
Nov 13 10:04:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.153, lip=66.85.158.92, session=<yzNFZ3JDM75bxJiZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.157
country_id: 3017382
description:
Nov 13 10:05:25 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=91.196.152.157, lip=66.85.158.92, session=<u9rgaHJDuYFbxJid>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.158
country_id: 3017382
description:
Nov 13 10:05:28 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.158, lip=66.85.158.92, session=<DxgTaXJDx+FbxJie>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.49.206
country_id: 1880251
description:
Nov 13 10:06:54 host2 sshd[2527948]: Disconnected from invalid user amine 101.47.49.206 port 45030 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2025-11-13 10:07:24 dovecot_login authenticator failed for customer-187-49-63-41.f1net.com.br [187.49.63.41]:52209: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-13 10:07:43 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:43148: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 10:12:04 host2 sshd[2531363]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.49.206
country_id: 1880251
description:
Nov 13 10:16:49 host2 sshd[2534592]: Disconnected from invalid user ceshi 101.47.49.206 port 39418 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2025-11-13 10:18:05 dovecot_plain authenticator failed for c-76-145-10-140.hsd1.ga.comcast.net (comai) [76.145.10.140]:60104: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-13 10:20:32 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:36496: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-13 10:20:44 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:60200: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.206.145
country_id: 2750405
description:
2025-11-13 10:24:39 dovecot_login authenticator failed for (ADMIN) [181.214.206.145]:20449: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-13 10:26:08 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:47701: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2025-11-13 10:26:19 dovecot_login authenticator failed for 201-61-215-87.bbone.telesp.net.br [201.61.215.87]:46888: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-13 10:26:37 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:46658: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 199.91.162.55
country_id: 3570311
description:
Nov 13 10:29:26 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=199.91.162.55, lip=66.85.158.91, TLS, session=<FD3IvXJD4pfHW6I3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.68.23
country_id: 1269750
description:
Nov 13 10:29:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr>, method=PLAIN, rip=103.56.68.23, lip=66.85.158.91, TLS, session=<76H2vnJDeqdnOEQX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 13 10:33:48 host2 sshd[2546579]: Disconnected from invalid user seekcy 103.137.194.125 port 54884 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2025-11-13 10:33:34 dovecot_plain authenticator failed for c-73-224-171-101.hsd1.fl.comcast.net (worihus) [73.224.171.101]:40894: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.48
country_id: 6252001
description:
Nov 13 10:35:13 host2 pure-ftpd[2547746]: (?@167.94.146.48) [INFO] New connection from 167.94.146.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-11-13 10:36:24 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:35072: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 13 10:37:56 host2 sshd[2549507]: Disconnected from invalid user matias 103.137.194.125 port 43258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-13 10:39:18 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:41452: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 13 10:39:16 host2 sshd[2550348]: Disconnected from invalid user jak 103.137.194.125 port 45730 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-13 10:38:53 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:44463: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.14
country_id: 1733045
description:
2025-11-13 10:39:09 dovecot_login authenticator failed for ([49.124.151.14]) [49.124.151.14]:48600: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-11-13 10:39:29 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:34446: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-13 10:41:24 dovecot_login authenticator failed for (Xsx49XK) [178.16.54.32]:62453: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 13 10:41:58 host2 sshd[2552500]: Disconnected from invalid user getosindex 103.137.194.125 port 60322 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.239
country_id: 6252001
description:
Nov 13 10:43:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.239, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Z+z58XJDaN/G6xjv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-13 10:43:21 dovecot_login authenticator failed for (IkuMQgI) [178.16.54.32]:53304: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 13 10:44:38 host2 sshd[2553977]: Disconnected from invalid user agent 103.137.194.125 port 54120 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.30
country_id: 1269750
description:
2025-11-13 10:45:04 dovecot_login authenticator failed for (nsg-corporate-81.166.185.122.airtel.in) [122.185.187.30]:41916: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.193.135
country_id: 3469034
description:
2025-11-13 10:44:20 dovecot_login authenticator failed for (fides217.static.host.gvt.net.br) [177.99.193.135]:56653: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-13 10:44:36 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:33386: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.155
country_id: 2328926
description:
2025-11-13 10:47:12 dovecot_login authenticator failed for (ADMIN) [146.70.65.155]:53686: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 10:48:19 host2 sshd[2556902]: Disconnected from invalid user user 2.57.121.25 port 33304 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 13 10:48:51 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.92, TLS: Connection closed, session=<zkczBHNDjtCLonQW>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.131.134
country_id: 3469034
description:
Nov 13 10:49:24 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=191.53.131.134, lip=66.85.158.91, TLS, session=<L00bBXNDidW/NYOG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.190.167.209
country_id: 3865483
description:
Nov 13 10:49:46 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=186.190.167.209, lip=66.85.158.91, TLS, session=<WF1bBnNDlau6vqfR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.186.177
country_id: 99237
description:
2025-11-13 10:56:40 dovecot_plain authenticator failed for (preming) [65.20.186.177]:47992: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.112.19.111
country_id: 2661886
description:
2025-11-13 11:02:28 dovecot_login authenticator failed for (ADMIN) [212.112.19.111]:10690: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.99.148.146
country_id: 6252001
description:
2025-11-13 11:05:40 dovecot_login authenticator failed for (ool-4b639492.static.optonline.net) [75.99.148.146]:39784: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-13 11:05:53 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:24664: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 13 11:10:07 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=<HV9KUHND8oGLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.30
country_id: 1168579
description:
2025-11-13 11:15:56 dovecot_login authenticator failed for (30.92.zcomnetworks.com.pk) [103.148.92.30]:36091: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.77
country_id: 1733045
description:
2025-11-13 11:15:30 dovecot_login authenticator failed for ([49.125.201.77]) [49.125.201.77]:35964: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-11-13 11:18:04 dovecot_login authenticator failed for ([59.98.144.36]) [59.98.144.36]:55947: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2025-11-13 11:17:35 dovecot_login authenticator failed for laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:54889: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.190.8.165
country_id: 1819730
description:
Nov 13 11:19:38 host2 sshd[2598505]: Disconnected from invalid user ftp_client 218.190.8.165 port 42410 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-11-13 11:21:58 dovecot_login authenticator failed for (nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:50392: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.142
country_id: 1269750
description:
2025-11-13 11:22:40 dovecot_login authenticator failed for ([128.185.247.127]) [182.95.223.142]:57378: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 85.221.254.177
country_id: 798544
description:
Nov 13 11:24:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=85.221.254.177, lip=66.85.158.91, TLS, session=<f6pFgnNDOcJV3f6x>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 218.190.8.165
country_id: 1819730
description:
Nov 13 11:24:37 host2 sshd[2601046]: Disconnected from invalid user sean 218.190.8.165 port 38202 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.38
country_id: 6251999
description:
Nov 13 11:24:44 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=86.54.31.38, lip=66.85.158.91, session=<Oe6GhHNDuuBWNh8m>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.41.117
country_id: 953987
description:
Nov 13 11:24:47 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr>, method=PLAIN, rip=102.64.41.117, lip=66.85.158.91, TLS, session=<G2x5g3NDL+VmQCl1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.44
country_id: 3625428
description:
2025-11-13 11:27:03 dovecot_login authenticator failed for (ADMIN) [95.181.237.44]:36862: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.190.8.165
country_id: 1819730
description:
Nov 13 11:28:35 host2 sshd[2603264]: Disconnected from invalid user administrator 218.190.8.165 port 39258 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-13 11:36:39 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (unisms) [24.127.53.61]:58444: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-11-13 11:39:39 dovecot_login authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:33472: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.41.172
country_id: 390903
description:
2025-11-13 11:40:38 dovecot_login authenticator failed for (149-210-41-172.mobile.nym.cosmote.net) [149.210.41.172]:60606: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.135.95
country_id: 1880251
description:
Nov 13 11:43:57 host2 sshd[2611262]: Disconnected from invalid user builder 101.47.135.95 port 60024 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.46
country_id: 3175395
description:
Nov 13 11:44:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.197.9.46, lip=66.85.158.91, TLS, session=<GvbTyXND7py5xQku>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.145.175
country_id: 690791
description:
Nov 13 11:44:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=37.221.145.175, lip=66.85.158.91, TLS, session=<IsYoy3NDos8l3ZGv>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.135.95
country_id: 1880251
description:
Nov 13 11:46:17 host2 sshd[2613332]: Disconnected from invalid user test 101.47.135.95 port 47886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.107.104.243
country_id: 1819730
description:
2025-11-13 11:47:44 dovecot_login authenticator failed for (ADMIN) [86.107.104.243]:19738: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.21.18
country_id: 3469034
description:
2025-11-13 11:49:02 dovecot_login authenticator failed for (187.95.21.18.netjacarei.NipCable.com) [187.95.21.18]:57323: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-11-13 11:49:23 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:59036: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-11-13 11:57:20 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:44893: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-11-13 11:57:31 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:55865: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2025-11-13 11:57:40 dovecot_login authenticator failed for ([31.148.174.234]) [31.148.174.234]:50334: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-11-13 12:08:11 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:53664: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-11-13 12:08:30 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:32815: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.58
country_id: 3625428
description:
2025-11-13 12:08:56 dovecot_login authenticator failed for (ADMIN) [95.181.237.58]:54386: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-11-13 12:10:45 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:40502: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.235
country_id: 6252001
description:
Nov 13 12:11:09 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.134.235, lip=66.85.158.91, TLS, session=<llmRKnRDRpFHBobr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-11-13 12:10:28 dovecot_login authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:46834: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.41.182
country_id: 1819730
description:
Nov 13 12:11:45 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=165.154.41.182, lip=66.85.158.92, session=<uyK0LHRDus2lmim2>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 165.154.41.182
country_id: 1819730
description:
Nov 13 12:11:46 host2 dovecot[43647]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=165.154.41.182, lip=66.85.158.92, session=<lUbHLHRDnM6lmim2>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Nov 13 12:12:39 host2 sshd[2628617]: Disconnected from invalid user etherpad 189.194.140.170 port 60348 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.194.140.170
country_id: 3996063
description:
Nov 13 12:13:56 host2 sshd[2629380]: Disconnected from invalid user admin 189.194.140.170 port 60612 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2025-11-13 12:13:59 dovecot_login authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:45770: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.24
country_id: 6252001
description:
Nov 13 12:14:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.24, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<EMdGNXRDH9KTuYQY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.103.253.48
country_id: 1820814
description:
2025-11-13 12:14:21 dovecot_login authenticator failed for (48-253.adsl.static.espeed.com.bn) [118.103.253.48]:41699: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.141.71
country_id: 1880251
description:
Nov 13 12:14:58 host2 sshd[2629745]: Disconnected from invalid user sonar 101.47.141.71 port 44560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Nov 13 12:19:00 host2 sshd[2632308]: Disconnected from invalid user zmarin 103.113.105.228 port 53698 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2025-11-13 12:22:15 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:47747: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.194.140.170
country_id: 3996063
description:
Nov 13 12:21:17 host2 sshd[2633706]: Disconnected from invalid user gabriel 189.194.140.170 port 33978 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-11-13 12:22:04 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:58825: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.181.42
country_id: 3686110
description:
Nov 13 12:26:42 host2 sshd[2636490]: Disconnected from invalid user zdy 152.200.181.42 port 40607 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 12:27:49 host2 sshd[2637087]: Disconnected from invalid user user 2.57.121.25 port 38205 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-11-13 12:28:02 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:57362: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.248
country_id: 2186224
description:
2025-11-13 12:28:06 dovecot_login authenticator failed for ([121.73.169.248]) [121.73.169.248]:52038: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.164.126.21
country_id: 1269750
description:
2025-11-13 12:28:13 dovecot_login authenticator failed for (abts-tn-dynamic-021.126.164.122.airtelbroadband.in) [122.164.126.21]:36311: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-13 12:28:24 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:40538: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.200.181.42
country_id: 3686110
description:
Nov 13 12:29:32 host2 sshd[2638356]: Disconnected from invalid user webapp 152.200.181.42 port 55541 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.28
country_id: 298795
description:
2025-11-13 12:30:43 dovecot_login authenticator failed for (ADMIN) [188.213.34.28]:58742: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-13 12:30:58 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:32947: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.113.105.228
country_id: 1269750
description:
Nov 13 12:32:07 host2 sshd[2640037]: Disconnected from invalid user adrian 103.113.105.228 port 48248 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-11-13 12:32:12 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:37244: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.248.127.243
country_id: 3865483
description:
2025-11-13 12:31:20 dovecot_login authenticator failed for ([207.248.127.243]) [207.248.127.243]:40115: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-13 12:32:01 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:55254: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 12:33:26 host2 sshd[2640907]: Disconnected from invalid user user 2.57.121.25 port 22000 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.141.71
country_id: 1880251
description:
Nov 13 12:34:54 host2 sshd[2641710]: Disconnected from invalid user zdy 101.47.141.71 port 36738 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.141.71
country_id: 1880251
description:
Nov 13 12:39:55 host2 sshd[2644739]: Disconnected from invalid user azureuser 101.47.141.71 port 58030 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.113.105.228
country_id: 1269750
description:
Nov 13 12:41:30 host2 sshd[2645816]: Disconnected from invalid user sbserver 103.113.105.228 port 34512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.0.111.246
country_id: 2233387
description:
2025-11-13 12:42:55 dovecot_login authenticator failed for (host-129.0.111.246.mtn.cm) [129.0.111.246]:63338: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.99
country_id: 1269750
description:
2025-11-13 12:43:09 dovecot_login authenticator failed for ([103.190.91.99]) [103.190.91.99]:54378: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2025-11-13 12:45:55 dovecot_login authenticator failed for ([49.124.146.42]) [49.124.146.42]:38384: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-11-13 12:48:12 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (rabalky) [73.129.57.71]:42886: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.106.68
country_id: 3175395
description:
Nov 13 12:49:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.208.106.68, lip=66.85.158.91, TLS, session=<b0NZsXRD3t+50GpE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.208
country_id: 3175395
description:
2025-11-13 12:49:22 dovecot_login authenticator failed for (ADMIN) [156.146.41.208]:35000: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.8.202
country_id: 3175395
description:
Nov 13 12:49:25 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.197.8.202, lip=66.85.158.91, TLS, session=<1BV0snRDPbW5xQjK>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 13 12:51:09 host2 sshd[2652273]: Disconnected from invalid user unique 62.60.131.157 port 16419 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.200.181.42
country_id: 3686110
description:
Nov 13 12:52:37 host2 sshd[2653042]: Disconnected from invalid user pq 152.200.181.42 port 33829 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 13:03:27 host2 sshd[2660908]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.224
country_id: 6252001
description:
2025-11-13 13:05:31 dovecot_login authenticator failed for ([208.69.161.224]) [208.69.161.224]:53884: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-13 13:05:46 dovecot_login authenticator failed for (gatecidos.static.gvt.net.br) [179.185.29.233]:59537: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.159.88
country_id: 2635167
description:
Nov 13 13:07:16 host2 sshd[2663154]: Disconnected from invalid user steam 188.166.159.88 port 46826 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.166.159.88
country_id: 2635167
description:
Nov 13 13:08:21 host2 sshd[2663677]: Disconnected from invalid user erp 188.166.159.88 port 45840 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.48.139
country_id: 6251999
description:
2025-11-13 13:09:27 dovecot_login authenticator failed for (ADMIN) [212.32.48.139]:54934: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.212
country_id: 2510769
description:
Nov 13 13:09:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=139.28.190.212, lip=66.85.158.91, TLS, session=<vtZi+3RDoM6LHL7U>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.24
country_id: 798544
description:
Nov 13 13:10:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=178.216.25.24, lip=66.85.158.91, TLS, session=<i4F6/HRD0quy2BkY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.149
country_id: 1733045
description:
2025-11-13 13:11:03 dovecot_login authenticator failed for ([49.124.155.149]) [49.124.155.149]:53908: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.22.200.86
country_id: 1269750
description:
2025-11-13 13:11:17 dovecot_login authenticator failed for ([125.22.200.86]) [125.22.200.86]:46156: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-11-13 13:10:24 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:37586: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-11-13 13:10:38 dovecot_login authenticator failed for ([103.219.154.156]) [103.219.154.156]:47880: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-13 13:11:41 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61769: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-11-13 13:11:43 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:35588: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.56.74
country_id: 953987
description:
Nov 13 13:15:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=102.129.56.74, lip=66.85.158.91, TLS, session=<1IJfEHVD7qRmgThK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.119.98
country_id: 3865483
description:
Nov 13 13:16:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=190.181.119.98, lip=66.85.158.91, TLS, session=<8uetEXVDEJe+tXdi>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.117.148
country_id: 1819730
description:
Nov 13 13:16:53 host2 sshd[2669419]: Disconnected from invalid user ubuntu 101.36.117.148 port 45440 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Nov 13 13:23:33 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<bpF6LXVDcljY2s5D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.67
country_id: 6252001
description:
Nov 13 13:24:08 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=216.218.206.67, lip=66.85.158.92, TLS: Connection closed, session=<xwaPL3VD+H3Y2s5D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.241.57.180
country_id: 3996063
description:
Nov 13 13:24:50 host2 sshd[2673352]: Disconnected from invalid user mohamed 189.241.57.180 port 37632 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 13 13:26:27 host2 sshd[2674279]: Disconnected from invalid user t 187.110.238.50 port 41268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.241.57.180
country_id: 3996063
description:
Nov 13 13:26:49 host2 sshd[2674504]: Disconnected from invalid user postgres 189.241.57.180 port 45004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.77
country_id: 1643084
description:
Nov 13 13:26:56 host2 sshd[2674546]: Disconnected from invalid user hong 103.49.239.77 port 41932 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2025-11-13 13:27:19 dovecot_plain authenticator failed for c-68-83-181-181.hsd1.pa.comcast.net (conoly) [68.83.181.181]:56176: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-11-13 13:27:58 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:57527: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 189.241.57.180
country_id: 3996063
description:
Nov 13 13:28:07 host2 sshd[2675234]: Disconnected from invalid user ksiegowosc 189.241.57.180 port 46252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.77
country_id: 1643084
description:
Nov 13 13:30:03 host2 sshd[2676335]: Disconnected from invalid user maman 103.49.239.77 port 48368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.234.6
country_id: 289688
description:
2025-11-13 13:31:06 dovecot_login authenticator failed for (ADMIN) [95.181.234.6]:10809: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 13 13:30:54 host2 sshd[2676838]: Disconnected from invalid user teamtalk 187.110.238.50 port 51870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.239.77
country_id: 1643084
description:
Nov 13 13:31:34 host2 sshd[2677272]: Disconnected from invalid user sally 103.49.239.77 port 46176 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.110.238.50
country_id: 3469034
description:
Nov 13 13:33:50 host2 sshd[2678310]: Disconnected from invalid user milad 187.110.238.50 port 58930 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.83.134.101
country_id: 3469034
description:
2025-11-13 13:34:12 dovecot_login authenticator failed for (179.83.135.1.dynamic.adsl.gvt.net.br) [179.83.134.101]:48739: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.49.239.77
country_id: 1643084
description:
Nov 13 13:34:36 host2 sshd[2678639]: Disconnected from invalid user postgres 103.49.239.77 port 49492 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.21.18
country_id: 3469034
description:
2025-11-13 13:46:28 dovecot_login authenticator failed for (187.95.21.18.netjacarei.NipCable.com) [187.95.21.18]:38800: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-13 13:46:29 dovecot_login authenticator failed for ([128.185.96.217]) [128.185.242.74]:33328: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-11-13 13:46:45 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:52919: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.125.4.6
country_id: 798544
description:
Nov 13 13:47:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.125.4.6, lip=66.85.158.91, TLS, session=<OOMmgXVDlaO5fQQG>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.159.184.22
country_id: 798544
description:
Nov 13 13:47:31 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=93.159.184.22, lip=66.85.158.91, TLS, session=<F74zgnVDktldn7gW>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 98.80.4.92
country_id: 6252001
description:
Denial of Service (DoS) attack was discovered from 98.80.4.92: 250 connections per 30 seconds to 8443 port.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.130
country_id: 1269750
description:
2025-11-13 13:53:06 dovecot_login authenticator failed for ([27.123.114.130]) [27.123.114.130]:44724: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 13:52:08 host2 sshd[2689246]: Disconnected from invalid user username 2.57.121.112 port 61674 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-11-13 13:52:24 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:37272: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.59.87
country_id: 1269750
description:
2025-11-13 13:52:53 dovecot_login authenticator failed for ([122.160.59.87]) [122.160.59.87]:38776: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-13 13:53:31 dovecot_login authenticator failed for ([125.20.220.9]) [128.185.199.14]:59422: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.108.174.56
country_id: 1269750
description:
2025-11-13 13:53:37 dovecot_login authenticator failed for (ADMIN) [103.108.174.56]:25719: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-11-13 13:53:45 dovecot_login authenticator failed for (abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:41982: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-13 13:54:01 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:36758: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-11-13 13:59:09 dovecot_login authenticator failed for ([128.185.229.126]) [128.185.229.126]:50978: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.28.151.87
country_id: 1694008
description:
2025-11-13 13:59:24 dovecot_login authenticator failed for ([120.28.151.87]) [120.28.151.87]:58364: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-13 13:59:07 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:31938: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
country_id: 294640
description:
2025-11-13 14:04:34 dovecot_plain authenticator failed for (eawdy) [37.25.36.197]:53553: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 14:06:16 host2 sshd[2698090]: Disconnected from invalid user user 2.57.121.25 port 21458 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.0.117.2
country_id: 226074
description:
Nov 13 14:10:25 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=196.0.117.2, lip=66.85.158.91, TLS, session=<kLb403VD7YLEAHUC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.173
country_id: 3175395
description:
Nov 13 14:10:43 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=171.22.235.173, lip=66.85.158.91, TLS, session=<pQUt1XVDXd+rFuut>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 13 14:15:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.91, TLS, session=<GXVr5nVDFJk2xDDo>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 14:19:11 host2 sshd[2704851]: Disconnected from invalid user admin 2.57.121.112 port 48946 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-11-13 14:22:51 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (guarte) [71.224.169.28]:44970: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
country_id: 390903
description:
2025-11-13 14:22:56 dovecot_plain authenticator failed for (fludommate) [62.74.225.186]:50002: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.204
country_id: 3175395
description:
Nov 13 14:25:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=185.208.189.204, lip=66.85.158.91, TLS, session=<BNpyCHZDVsy50L3M>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 13 14:24:28 host2 sshd[2707864]: Disconnected from invalid user dion 62.60.131.157 port 10314 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.89.136.241
country_id: 3469034
description:
Nov 13 14:24:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=190.89.136.241, lip=66.85.158.91, TLS, session=<7cY2B3ZDLs++WYjx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-11-13 14:27:52 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (subdizess) [24.91.103.202]:56126: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-13 14:28:33 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:40567: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-13 14:28:49 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:36450: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 14:31:22 host2 sshd[2712029]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 14:34:30 host2 sshd[2713356]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.130.185
country_id: 3469034
description:
Nov 13 14:38:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=191.53.130.185, lip=66.85.158.91, TLS, session=<QXcCOHZDm5S/NYK5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.44.140.22
country_id: 690791
description:
Nov 13 14:38:43 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=194.44.140.22, lip=66.85.158.91, TLS, session=<OQguOXZDNrbCLIwW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 14:44:36 host2 sshd[2719355]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.220
country_id: 1643084
description:
Nov 13 14:46:59 host2 sshd[2721235]: Disconnected from invalid user radio 103.172.204.220 port 56162 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 13 14:49:29 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<FkPUYHZD2o2LonHU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 14:54:18 host2 sshd[2725534]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.204.220
country_id: 1643084
description:
Nov 13 14:54:19 host2 sshd[2725543]: Disconnected from invalid user user02 103.172.204.220 port 34806 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.87
country_id: 3144096
description:
2025-11-13 14:55:33 dovecot_login authenticator failed for (ADMIN) [46.246.122.87]:36883: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.215.87
country_id: 3469034
description:
2025-11-13 14:56:57 dovecot_login authenticator failed for 201-61-215-87.bbone.telesp.net.br [201.61.215.87]:41070: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.126.26.213
country_id: 1861060
description:
2025-11-13 14:57:21 dovecot_login authenticator failed for knet202126026213.kvision.ne.jp [202.126.26.213]:59486: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.60.122
country_id: 953987
description:
Nov 13 14:58:36 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.129.60.122, lip=66.85.158.91, TLS, session=<zk07gHZDK8xmgTx6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.122.99.20
country_id: 3996063
description:
Nov 13 14:58:54 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=138.122.99.20, lip=66.85.158.91, TLS, session=<jsx+gXZD+sqKemMU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.204.220
country_id: 1643084
description:
Nov 13 15:01:22 host2 sshd[2730224]: Disconnected from invalid user lek 103.172.204.220 port 46592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.199.20
country_id: 3469034
description:
Nov 13 15:07:34 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.199.20, lip=66.85.158.91, session=<i4l7oXZDjquYIMcU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 15:15:44 host2 sshd[2740754]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.114
country_id: 6252001
description:
Nov 13 15:15:31 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.114, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ZqngvXZDdIJChJly>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.5
country_id: 3042225
description:
2025-11-13 15:15:34 dovecot_login authenticator failed for (ADMIN) [91.90.124.5]:53106: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 13 15:15:42 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<ltSKvnZDupkDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.14.33.177
country_id: 1880251
description:
Nov 13 15:17:12 host2 sshd[2741761]: Disconnected from invalid user git 103.14.33.177 port 52708 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 13 15:17:45 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<G/3nxXZD3NwDlTsa>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 13 15:19:04 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<0sSfynZDMLoDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.14.33.177
country_id: 1880251
description:
Nov 13 15:19:46 host2 sshd[2743215]: Disconnected from invalid user postgres 103.14.33.177 port 58620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-13 15:20:57 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:40702: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.14.33.177
country_id: 1880251
description:
Nov 13 15:20:59 host2 sshd[2744209]: Disconnected from invalid user walter 103.14.33.177 port 44592 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 13 15:20:07 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<f2peznZDMrADlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 13 15:20:13 host2 dovecot[43647]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.91, session=<b+CyznZDWLADlTsa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.51
country_id: 298795
description:
2025-11-13 15:20:33 dovecot_login authenticator failed for (88.255.189.51.static.ttnet.com.tr) [88.255.189.51]:50043: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.176
country_id: 798549
description:
Nov 13 15:21:42 host2 sshd[2744553]: Disconnected from invalid user andrew 89.44.137.176 port 44504 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.14.33.177
country_id: 1880251
description:
Nov 13 15:22:10 host2 sshd[2744928]: Disconnected from invalid user jenkins 103.14.33.177 port 58606 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 13 15:23:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<ousy2nZDOLgDlTsa>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 13 15:23:27 host2 dovecot[43647]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<gHZK2nZDPrgDlTsa>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.14.33.177
country_id: 1880251
description:
Nov 13 15:24:32 host2 sshd[2745948]: Disconnected from invalid user user 103.14.33.177 port 40892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.149.59.26
country_id: 6252001
description:
Nov 13 15:26:44 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.149.59.26, lip=66.85.158.92, session=<jjMG5nZDaMIDlTsa>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 89.44.137.176
country_id: 798549
description:
Nov 13 15:26:13 host2 sshd[2747452]: Disconnected from invalid user user 89.44.137.176 port 45802 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.144.212.209
country_id: 690791
description:
2025-11-13 15:26:33 dovecot_login authenticator failed for (9xeOcTG9dj) [45.144.212.209]:63450: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2025-11-13 15:26:42 dovecot_login authenticator failed for ([182.95.52.170]) [182.95.52.170]:51702: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.144.212.209
country_id: 690791
description:
2025-11-13 15:27:41 dovecot_login authenticator failed for (SE9y7nPM) [45.144.212.209]:49532: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.144.212.209
country_id: 690791
description:
2025-11-13 15:28:27 dovecot_login authenticator failed for (tSPkgm) [45.144.212.209]:65257: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.44.137.176
country_id: 798549
description:
Nov 13 15:29:46 host2 sshd[2749705]: Disconnected from invalid user rizal 89.44.137.176 port 46812 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.80.73
country_id: 2077456
description:
2025-11-13 15:30:43 dovecot_login authenticator failed for ([120.157.80.73]) [120.157.80.73]:42328: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-11-13 15:30:58 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:51380: 535 Incorrect authentication data (set_id=contacto)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 15:35:46 host2 sshd[2753036]: Disconnected from invalid user admin 2.57.121.112 port 7671 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Nov 13 15:37:50 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<8sa0DXdDioADWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.232.26
country_id: 3469034
description:
2025-11-13 15:40:13 dovecot_login authenticator failed for (187-40-1-41.user.veloxzone.com.br) [200.223.232.26]:51306: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-11-13 15:40:32 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:38198: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2025-11-13 15:40:57 dovecot_login authenticator failed for laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:48406: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-11-13 15:41:14 dovecot_login authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:59695: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.238.13
country_id: 6252001
description:
2025-11-13 15:44:49 dovecot_login authenticator failed for (ADMIN) [95.181.238.13]:33186: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.101.178
country_id: 3865483
description:
Nov 13 15:46:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=190.181.101.178, lip=66.85.158.91, TLS, session=<XJFKKndDgKG+tWWy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.237.173.220
country_id: 6252001
description:
Nov 13 15:46:11 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.237.173.220, lip=66.85.158.92, session=<NWqZK3dDUr0D7a3c>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.77.198
country_id: 3469034
description:
Nov 13 15:46:30 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=187.120.77.198, lip=66.85.158.91, TLS, session=<6S+SK3dDdo27eE3G>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 15:55:33 host2 sshd[2766098]: Disconnected from invalid user  2.57.121.112 port 62374 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov 13 15:56:15 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ccuTT3dDRhlChJl1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.206.115.50
country_id: 6290252
description:
Nov 13 15:58:20 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=109.206.115.50, lip=66.85.158.91, TLS, session=<JzILVndDW5xtznMy>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.11.95.18
country_id: 798544
description:
Nov 13 15:58:38 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=78.11.95.18, lip=66.85.158.91, TLS, session=<wh8cV3dD+MNOC18S>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2025-11-13 15:59:30 dovecot_plain authenticator failed for (phylling) [65.20.148.165]:60077: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-11-13 16:02:15 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:55392: 535 Incorrect authentication data (set_id=sales@gnetuniversals.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 16:02:37 host2 sshd[2769980]: Disconnected from invalid user  2.57.121.112 port 61685 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.155
country_id: 1819730
description:
2025-11-13 16:05:27 dovecot_login authenticator failed for (182.239.80.155.hk.chinamobile.com) [182.239.80.155]:47412: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-11-13 16:05:49 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:35688: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-13 16:06:06 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:60116: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2025-11-13 16:06:20 dovecot_login authenticator failed for 45-238-2-7.netmaisfibra.net.br [45.238.2.7]:43484: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.56.125
country_id: 6252001
description:
Nov 13 16:08:37 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.106.56.125, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<YaHLe3dDkIIUajh9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.44
country_id: 3625428
description:
2025-11-13 16:10:23 dovecot_login authenticator failed for (ADMIN) [95.181.237.44]:45220: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2025-11-13 16:10:36 dovecot_plain authenticator failed for c-71-224-169-28.hsd1.pa.comcast.net (ranes) [71.224.169.28]:40896: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-11-13 16:12:51 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:41390: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-11-13 16:13:03 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:52239: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.244.34
country_id: 1269750
description:
2025-11-13 16:13:41 dovecot_login authenticator failed for (nsg-corporate-34.244.186.122.airtel.in) [122.186.244.34]:59106: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-11-13 16:13:57 dovecot_login authenticator failed for (177-174-16-55.user.vivozap.com.br) [177.174.16.55]:60501: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.202.118.46
country_id: 6252001
description:
Nov 13 16:16:25 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=172.202.118.46, lip=66.85.158.91, TLS handshaking: Connection closed, session=<wX+rl3dDsNOsynYu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.221.60.108
country_id: 6252001
description:
Nov 13 16:19:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.221.60.108, lip=66.85.158.92, session=<3bqoondDooUU3Txs>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.224.64
country_id: 6252001
description:
Nov 13 16:19:49 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.15.224.64, lip=66.85.158.91, session=<+gnbo3dDYo8UD+BA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 13 16:23:05 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS: Connection closed, session=<wByOr3dDag1ChJmG>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.134
country_id: 6252001
description:
Nov 13 16:23:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.134, lip=66.85.158.92, TLS, session=<CwTcr3dDAKdChJmG>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 16:26:06 host2 sshd[2783688]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.139.180.141
country_id: 3175395
description:
Nov 13 16:28:11 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.139.180.141, lip=66.85.158.91, TLS, session=<kL6SwHdDWLC5i7SN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.248.149.21
country_id: 3175395
description:
Nov 13 16:28:30 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=178.248.149.21, lip=66.85.158.91, TLS, session=<VAXlwXdD5eqy+JUV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.189.80.73
country_id: 2510769
description:
2025-11-13 16:31:40 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:50312: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.21.235.162
country_id: 6252001
description:
2025-11-13 16:31:14 dovecot_login authenticator failed for ip-64-21-235-162.ideaone.net [64.21.235.162]:50312: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.216
country_id: 2186224
description:
2025-11-13 16:31:28 dovecot_login authenticator failed for ([121.73.168.216]) [121.73.168.216]:38100: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-13 16:31:30 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:46768: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.57.111
country_id: 1880251
description:
2025-11-13 16:33:06 dovecot_login authenticator failed for (ADMIN) [156.146.57.111]:30883: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 16:35:49 host2 sshd[2790224]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-13 16:35:48 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:34441: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-13 16:35:57 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:59326: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.64.71.57
country_id: 3865483
description:
Nov 13 16:44:00 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=186.64.71.57, lip=66.85.158.91, TLS, session=<o51A+XdD3Kq6QEc5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 194.146.234.29
country_id: 732800
description:
Nov 13 16:43:39 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=194.146.234.29, lip=66.85.158.91, TLS, session=<gMEc+HdDrQzCkuod>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.180
country_id: 921929
description:
2025-11-13 16:51:24 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:12580: 535 Incorrect authentication data (set_id=contacto@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-13 16:51:58 dovecot_plain authenticator failed for (cably) [23.30.11.253]:46223: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.218.164
country_id: 1269750
description:
2025-11-13 16:53:45 dovecot_login authenticator failed for ([182.79.218.164]) [182.79.218.164]:63128: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-13 16:55:46 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61819: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-13 16:57:27 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:58662: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.93
country_id: 3865483
description:
2025-11-13 17:00:30 dovecot_login authenticator failed for (static.91.254.104.190.cps.com.ar) [190.104.254.93]:37237: 535 Incorrect authentication data (set_id=admin@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.64.118
country_id: 3996063
description:
2025-11-13 17:00:41 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:39473: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.131
country_id: 1880251
description:
Nov 13 17:02:40 host2 sshd[2806178]: Disconnected from invalid user game 45.78.218.131 port 33084 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.196.65.62
country_id: 2510769
description:
Nov 13 17:03:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.196.65.62, lip=66.85.158.91, TLS, session=<y3kaQHhD9eW5xEE+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.203.52.22
country_id: 2963597
description:
Nov 13 17:04:06 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=37.203.52.22, lip=66.85.158.91, TLS, session=<Q/s7QXhDrNclyzQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-11-13 17:06:01 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:57596: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 13 17:05:28 host2 sshd[2808212]: Disconnected from invalid user like 12.156.67.18 port 55300 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-13 17:05:46 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:59990: 535 Incorrect authentication data (set_id=office@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.198.62.20
country_id: 6252001
description:
2025-11-13 17:07:27 dovecot_plain authenticator failed for c-98-198-62-20.hsd1.tx.comcast.net (hiling) [98.198.62.20]:54358: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 13 17:09:01 host2 sshd[2810099]: Disconnected from invalid user jenkins 12.156.67.18 port 43842 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 13 17:10:09 host2 sshd[2810848]: Disconnected from invalid user nexus 12.156.67.18 port 59902 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.218.131
country_id: 1880251
description:
Nov 13 17:11:41 host2 sshd[2811568]: Disconnected from invalid user manu 45.78.218.131 port 59172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 13 17:13:29 host2 sshd[2812481]: Disconnected from invalid user sammy 12.156.67.18 port 56526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 12.156.67.18
country_id: 6252001
description:
Nov 13 17:14:40 host2 sshd[2813522]: Disconnected from invalid user guest 12.156.67.18 port 53286 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.120
country_id: 6252001
description:
Nov 13 17:16:10 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.120, lip=66.85.158.91, TLS: Connection closed, session=<tCxmbXhDNilChJl4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 17:18:32 host2 sshd[2816305]: Disconnected from invalid user admin 2.57.121.112 port 15745 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.236
country_id: 6252001
description:
2025-11-13 17:19:55 dovecot_login authenticator failed for (ADMIN) [191.96.67.236]:51956: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-11-13 17:21:51 dovecot_login authenticator failed for ([125.23.235.136]) [128.185.252.110]:51628: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.204
country_id: 6251999
description:
Nov 13 17:24:30 host2 pure-ftpd[2820123]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.204
country_id: 6251999
description:
Nov 13 17:24:43 host2 pure-ftpd[2820247]: (?@148.113.214.204) [INFO] New connection from 148.113.214.204


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.218.131
country_id: 1880251
description:
Nov 13 17:25:12 host2 sshd[2820732]: Disconnected from invalid user chloe 45.78.218.131 port 42386 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 135.237.123.204
country_id: 6252001
description:
Nov 13 17:26:28 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=135.237.123.204, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<kYI5knhDyLeH7XvM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov 13 17:27:27 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<dTm9lXhDoM0D7r/l>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.54
country_id: 6252001
description:
Nov 13 17:28:21 host2 pure-ftpd[2822873]: (?@167.94.146.54) [INFO] New connection from 167.94.146.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2025-11-13 17:29:11 dovecot_login authenticator failed for ([167.250.118.3]) [167.250.118.3]:38847: 535 Incorrect authentication data (set_id=postmaster@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.186
country_id: 1269750
description:
2025-11-13 17:29:41 dovecot_login authenticator failed for ([125.23.235.41]) [182.95.49.186]:39008: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.177.78
country_id: 1269750
description:
2025-11-13 17:31:26 dovecot_login authenticator failed for ([152.52.234.170]) [182.95.177.78]:57740: 535 Incorrect authentication data (set_id=contact@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2025-11-13 17:31:39 dovecot_login authenticator failed for (syn-071-012-241-225.res.spectrum.com) [71.12.241.225]:56254: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.119.99.184
country_id: 6252001
description:
Nov 13 17:34:26 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.119.99.184, lip=66.85.158.91, TLS handshaking: Connection closed, session=<vxawrnhDQMwUd2O4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.82
country_id: 3017382
description:
2025-11-13 17:41:37 dovecot_login authenticator failed for (ADMIN) [203.188.183.82]:12949: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-13 17:42:50 dovecot_login authenticator failed for ([125.20.220.9]) [128.185.199.14]:55362: 535 Incorrect authentication data (set_id=support@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.77.184
country_id: 1269750
description:
2025-11-13 17:44:06 dovecot_login authenticator failed for (static.ftth.bgn.117.211.77.184.bsnl.in) [117.211.77.184]:57414: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.197.147
country_id: 1269750
description:
2025-11-13 17:43:44 dovecot_login authenticator failed for ([103.250.160.76]) [59.96.197.147]:44445: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.164.151.42
country_id: 1605651
description:
2025-11-13 17:47:15 dovecot_login authenticator failed for (mx-ll-110.164.151-42.static.3bb.co.th) [110.164.151.42]:46982: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-13 17:47:36 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:54478: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.98.241.4
country_id: 290557
description:
2025-11-13 17:47:57 dovecot_login authenticator failed for ([98.98.241.4]) [98.98.241.4]:42247: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2025-11-13 17:55:35 dovecot_login authenticator failed for ([49.231.31.220]) [49.231.31.220]:30122: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-13 17:55:18 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:58100: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.196.48.232
country_id: 6252001
description:
Nov 13 17:57:11 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=54.196.48.232, lip=66.85.158.92, TLS, session=<stwMAHlDTJw2xDDo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-11-13 17:57:52 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:59003: 535 Incorrect authentication data (set_id=test@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.191.219
country_id: 1821275
description:
2025-11-13 17:58:04 dovecot_login authenticator failed for nz191l219.bb18094.ctm.net [180.94.191.219]:60258: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.201.51.121
country_id: 130758
description:
Nov 13 17:58:06 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.201.51.121, lip=66.85.158.91, TLS, session=</Dk/AnlDKQm5yTN5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.227.226.100
country_id: 3057568
description:
Nov 13 17:58:25 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=91.227.226.100, lip=66.85.158.91, TLS, session=<8fNqA3lDsLJb4+Jk>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 66.69.42.134
country_id: 6252001
description:
Nov 13 18:00:26 host2 sshd[2848744]: error: maximum authentication attempts exceeded for root from 66.69.42.134 port 50568 ssh2 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.69.42.134
country_id: 6252001
description:
Nov 13 18:00:31 host2 sshd[2848804]: Disconnecting invalid user admin 66.69.42.134 port 52152: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 66.69.42.134
country_id: 6252001
description:
Nov 13 18:00:26 host2 sshd[2848744]: Disconnecting authenticating user root 66.69.42.134 port 50568: Too many authentication failures [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.22
country_id: 718075
description:
2025-11-13 18:02:53 dovecot_login authenticator failed for (ADMIN) [185.225.31.22]:56059: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.251.49.109
country_id: 6252001
description:
Nov 13 18:04:30 host2 pure-ftpd[2851746]: (?@47.251.49.109) [INFO] New connection from 47.251.49.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.49.109
country_id: 6252001
description:
2025-11-13 18:04:38 dovecot_plain authenticator failed for ([172.17.44.212]) [47.251.49.109]:64370: 535 Incorrect authentication data (set_id=homestead)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 18:06:19 host2 sshd[2852699]: Disconnected from invalid user admin 2.57.121.112 port 62814 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 18:08:21 host2 sshd[2853623]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 40.124.175.60
country_id: 6252001
description:
Nov 13 18:13:24 host2 pure-ftpd[2856927]: (?@40.124.175.60) [INFO] New connection from 40.124.175.60


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 46.39.212.85
country_id: 2510769
description:
Nov 13 18:14:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=46.39.212.85, lip=66.85.158.91, TLS, session=<HXq/PXlD6JwuJ9RV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.37.25
country_id: 953987
description:
Nov 13 18:14:25 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.37.25, lip=66.85.158.91, TLS, session=<8atlPHlD2MRmQCUZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.71.101.53
country_id: 6252001
description:
Nov 13 18:14:27 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=167.71.101.53, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<mUDTPXlDEN2nR2U1>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 18:18:12 host2 sshd[2860838]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-13 18:17:20 dovecot_login authenticator failed for ([122.184.120.98]) [122.184.120.98]:60610: 535 Incorrect authentication data (set_id=info@gnetuniversals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-11-13 18:17:36 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:51642: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 18:18:31 host2 sshd[2861014]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.238.191.229
country_id: 6252001
description:
Nov 13 18:21:05 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.238.191.229, lip=66.85.158.91, session=<c36OVXlDtrID7r/l>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.59
country_id: 1643084
description:
Nov 13 18:21:21 host2 sshd[2862751]: Disconnected from invalid user zte 103.186.1.59 port 37866 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 13 18:22:14 host2 sshd[2863149]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 58020


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.15
country_id: 3042058
description:
2025-11-13 18:22:20 dovecot_login authenticator failed for (ADMIN) [91.90.122.15]:63036: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-11-13 18:24:13 dovecot_login authenticator failed for ([45.136.194.120]) [45.136.194.120]:46460: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.201
country_id: 3469034
description:
2025-11-13 18:23:56 dovecot_login authenticator failed for ([189.97.236.201]) [189.97.236.201]:45689: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Nov 13 18:25:33 host2 sshd[2865343]: Disconnected from invalid user student 154.221.28.214 port 36006 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-11-13 18:27:12 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.186.1.59
country_id: 1643084
description:
Nov 13 18:27:36 host2 sshd[2866854]: Disconnected from invalid user skim 103.186.1.59 port 46032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.178
country_id: 1880251
description:
Nov 13 18:28:52 host2 sshd[2867687]: Disconnected from invalid user pacific 45.78.198.178 port 34154 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Nov 13 18:28:58 host2 sshd[2867975]: Disconnected from invalid user info 154.221.28.214 port 42446 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.43
country_id: 298795
description:
Nov 13 18:29:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=95.0.32.43, lip=66.85.158.91, TLS, session=<I+w7cnlD/7FfACAr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.40.75.58
country_id: 798544
description:
Nov 13 18:29:41 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=94.40.75.58, lip=66.85.158.91, TLS, session=<5CdRc3lDv4ReKEs6>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.186.1.59
country_id: 1643084
description:
Nov 13 18:30:29 host2 sshd[2869080]: Disconnected from invalid user ftpuser 103.186.1.59 port 58420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Nov 13 18:30:38 host2 sshd[2869161]: Disconnected from invalid user ubuntu 154.221.28.214 port 54614 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.178
country_id: 1880251
description:
Nov 13 18:34:19 host2 sshd[2871166]: Disconnected from invalid user jhlee 45.78.198.178 port 60014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.28.214
country_id: 1819730
description:
Nov 13 18:38:47 host2 sshd[2873660]: Disconnected from invalid user git 154.221.28.214 port 36930 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Nov 13 18:40:27 host2 sshd[2874862]: Disconnected from invalid user jhlee 154.221.28.214 port 58532 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.103.3
country_id: 6252001
description:
2025-11-13 18:44:01 dovecot_login authenticator failed for dedicated-zap819315-1.zap-srv.com (ADMIN) [191.96.103.3]:47038: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 47.251.49.109
country_id: 6252001
description:
Nov 13 18:44:04 host2 pure-ftpd[2877460]: (?@47.251.49.109) [INFO] New connection from 47.251.49.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.251.49.109
country_id: 6252001
description:
2025-11-13 18:44:07 dovecot_plain authenticator failed for ([172.17.44.212]) [47.251.49.109]:54614: 535 Incorrect authentication data (set_id=homestead)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov 13 18:45:57 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=148.113.221.195, lip=66.85.158.92, session=<gOhxrnlDKO2Ucd3D>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:46:14 host2 pure-ftpd[2878962]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:47:19 host2 pure-ftpd[2880006]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:47:23 host2 pure-ftpd[2880071]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:48:17 host2 pure-ftpd[2880709]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:48:15 host2 pure-ftpd[2880679]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:49:16 host2 pure-ftpd[2881347]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.163
country_id: 3469034
description:
Nov 13 18:50:12 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=187.120.72.163, lip=66.85.158.91, TLS, session=<7yuMvHlDGdG7eEij>


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:49:18 host2 pure-ftpd[2881392]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.124.218.118
country_id: 3865483
description:
Nov 13 18:49:51 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=186.124.218.118, lip=66.85.158.91, TLS, session=<M3NMu3lDO6i6fNp2>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:50:16 host2 pure-ftpd[2882403]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:50:21 host2 pure-ftpd[2882475]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:51:16 host2 pure-ftpd[2883091]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:51:15 host2 pure-ftpd[2883086]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:52:20 host2 pure-ftpd[2883842]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:52:16 host2 pure-ftpd[2883780]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:53:16 host2 pure-ftpd[2884415]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:53:15 host2 pure-ftpd[2884403]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:54:16 host2 pure-ftpd[2885445]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:54:18 host2 pure-ftpd[2885467]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:55:15 host2 pure-ftpd[2886522]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:55:16 host2 pure-ftpd[2886530]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.198.178
country_id: 1880251
description:
Nov 13 18:55:34 host2 sshd[2886672]: Disconnected from invalid user sammy 45.78.198.178 port 54162 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:56:15 host2 pure-ftpd[2887134]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:56:20 host2 pure-ftpd[2887207]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:57:15 host2 pure-ftpd[2887943]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:57:16 host2 pure-ftpd[2887963]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:58:15 host2 pure-ftpd[2888594]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:58:17 host2 pure-ftpd[2888643]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:59:15 host2 pure-ftpd[2889238]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 123.176.38.70
country_id: 1269750
description:
Nov 13 18:59:17 host2 pure-ftpd[2889284]: (?@123.176.38.70) [INFO] New connection from 123.176.38.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.22.87.35
country_id: 1861060
description:
2025-11-13 19:00:59 dovecot_login authenticator failed for (ADMIN) [149.22.87.35]:44770: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 19:03:58 host2 sshd[2893058]: Disconnected from invalid user user 2.57.121.25 port 50272 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 13 19:05:53 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<eV289XlD4LkDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 13 19:07:45 host2 sshd[2895152]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 63153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.254.16.242
country_id: 6252001
description:
2025-11-13 19:07:58 dovecot_login authenticator failed for ([195.78.55.31]) [165.254.16.242]:44256: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-11-13 19:08:16 dovecot_login authenticator failed for (abts-north-static-194.142.160.122.airtelbroadband.in) [117.247.239.202]:45266: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 13 19:09:07 host2 sshd[2896230]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 56539


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.247.71
country_id: 3469034
description:
Nov 13 19:10:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=186.209.247.71, lip=66.85.158.91, TLS, session=<LgTuA3pDEJC60fdH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.39.36.6
country_id: 3469034
description:
Nov 13 19:10:30 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=177.39.36.6, lip=66.85.158.91, TLS, session=<H2EnBXpDVd+xJyQG>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Nov 13 19:12:43 host2 sshd[2898398]: Disconnected from invalid user abhinav 201.186.40.250 port 52172 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-13 19:15:09 dovecot_login authenticator failed for (z7VlFe) [185.196.8.151]:63256: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Nov 13 19:14:27 host2 sshd[2899819]: Disconnected from invalid user publico 201.186.40.250 port 53580 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-13 19:15:32 dovecot_login authenticator failed for (xdSOf9m) [185.196.8.151]:51477: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Nov 13 19:16:06 host2 sshd[2900920]: Disconnected from invalid user fred 186.64.123.41 port 47993 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.186.40.250
country_id: 3895114
description:
Nov 13 19:16:10 host2 sshd[2900934]: Disconnected from invalid user tmp 201.186.40.250 port 54986 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Nov 13 19:16:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.137, lip=66.85.158.92, TLS: Connection closed, session=<H+3nGnpD3NlChJmJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.196.8.151
country_id: 2658434
description:
2025-11-13 19:16:19 dovecot_login authenticator failed for (50XpoK9n) [185.196.8.151]:60847: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.168.194.41
country_id: 1269750
description:
Nov 13 19:18:45 host2 sshd[2902403]: Disconnected from invalid user hik 122.168.194.41 port 46262 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-13 19:20:59 dovecot_plain authenticator failed for (estivens) [23.30.11.253]:35974: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.186.40.250
country_id: 3895114
description:
Nov 13 19:24:08 host2 sshd[2905684]: Disconnected from invalid user gm 201.186.40.250 port 33774 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 122.168.194.41
country_id: 1269750
description:
Nov 13 19:24:38 host2 sshd[2906131]: Disconnected from invalid user admin 122.168.194.41 port 41932 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.7
country_id: 3042225
description:
2025-11-13 19:28:29 dovecot_login authenticator failed for (ADMIN) [91.90.124.7]:43970: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.64.123.41
country_id: 3895114
description:
Nov 13 19:29:41 host2 sshd[2910142]: Disconnected from invalid user track 186.64.123.41 port 33751 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.168.194.41
country_id: 1269750
description:
Nov 13 19:32:00 host2 sshd[2911744]: Disconnected from invalid user debian 122.168.194.41 port 58850 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 13 19:41:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<9KcYdHpDIJsDgmBb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 13 19:43:22 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<UbPHe3pDBIQDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov 13 19:44:44 host2 sshd[2920876]: Disconnected from invalid user deploy 175.100.24.139 port 44922 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 13 19:46:01 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<8xhNhXpDXK8DgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.77
country_id: 1880251
description:
Nov 13 19:45:23 host2 sshd[2921859]: Disconnected from invalid user server 45.78.207.77 port 55342 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 13 19:46:16 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<9SgwhnpD1NkDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.126
country_id: 1819730
description:
Nov 13 19:47:09 host2 sshd[2923259]: Disconnected from invalid user admin 123.58.213.126 port 58734 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 13 19:48:12 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<SIocjXpDaM8DgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 13 19:47:27 host2 sshd[2923488]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 57965


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.166.136
country_id: 6252001
description:
2025-11-13 19:48:01 dovecot_login authenticator failed for (ADMIN) [181.214.166.136]:14127: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 13 19:48:18 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<Bf95jXpDrMMDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov 13 19:48:46 host2 sshd[2924320]: Disconnected from invalid user peer 175.100.24.139 port 45022 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 13 19:48:55 host2 dovecot[43647]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.91, session=<p36rj3pDdrMDgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.63.5.23
country_id: 3932488
description:
Nov 13 19:49:28 host2 sshd[2924738]: Disconnected from invalid user rustserver 179.63.5.23 port 47882 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 13 19:50:34 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<45KLlXpDzqEDgmBb>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 13 19:51:11 host2 dovecot[43647]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<N83Jl3pD3OwDgmBb>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 175.100.24.139
country_id: 1831722
description:
Nov 13 19:50:28 host2 sshd[2925364]: Disconnected from invalid user server 175.100.24.139 port 48068 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 19:51:39 host2 sshd[2926108]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.132.168
country_id: 6252001
description:
[2025-11-13 19:52:35 +0530] info [cpaneld] 124.198.132.168 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Nov 13 19:52:49 host2 sshd[2926605]: Disconnected from invalid user test 51.254.103.32 port 48536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 179.63.5.23
country_id: 3932488
description:
Nov 13 19:53:52 host2 sshd[2927230]: Disconnected from invalid user ester 179.63.5.23 port 44542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.178
country_id: 130758
description:
Nov 13 19:53:56 host2 sshd[2927259]: Disconnected from invalid user public 109.122.251.178 port 57414 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.130.96.91
country_id: 6252001
description:
Nov 13 19:53:15 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.130.96.91, lip=66.85.158.92, session=<uYQtn3pDaq0DgmBb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov 13 19:53:46 host2 sshd[2927063]: Disconnected from invalid user cockpit 175.100.24.139 port 54172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.100.24.139
country_id: 1831722
description:
Nov 13 19:56:57 host2 sshd[2929230]: Disconnected from invalid user ester 175.100.24.139 port 60270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Nov 13 19:56:17 host2 sshd[2928956]: Disconnected from invalid user FAKESSH 51.254.103.32 port 38092 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 179.63.5.23
country_id: 3932488
description:
Nov 13 19:56:38 host2 sshd[2929116]: Disconnected from invalid user admin 179.63.5.23 port 44904 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.58.213.126
country_id: 1819730
description:
Nov 13 19:57:53 host2 sshd[2929686]: Disconnected from invalid user cockpit 123.58.213.126 port 40290 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.205.4.189
country_id: 798544
description:
Nov 13 20:00:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=195.205.4.189, lip=66.85.158.91, TLS, session=<kotvtnpDYszDzQS9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Nov 13 20:00:08 host2 sshd[2931809]: Disconnected from invalid user bodega 51.254.103.32 port 49814 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.62.57
country_id: 953987
description:
Nov 13 19:59:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.129.62.57, lip=66.85.158.91, TLS, session=<5H8etXpD5ddmgT45>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 20:01:34 host2 sshd[2932499]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 104.248.183.117
country_id: 6252001
description:
Nov 13 20:02:50 host2 pure-ftpd[2933188]: (?@104.248.183.117) [INFO] New connection from 104.248.183.117


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 20:03:23 host2 sshd[2933854]: Disconnected from invalid user  2.57.121.112 port 62228 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.160
country_id: 2635167
description:
Nov 13 20:04:24 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 5 secs): user=<>, rip=35.203.210.160, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<NdsLx3pD0skjy9Kg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.254.103.32
country_id: 3017382
description:
Nov 13 20:04:29 host2 sshd[2934404]: Disconnected from invalid user vscode 51.254.103.32 port 55128 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.178
country_id: 130758
description:
Nov 13 20:05:07 host2 sshd[2934844]: Disconnected from invalid user ftpuser 109.122.251.178 port 58436 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.160
country_id: 2635167
description:
Nov 13 20:05:24 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 6 secs): user=<>, rip=35.203.210.160, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<vdScynpD+vojy9Kg>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.254.103.32
country_id: 3017382
description:
Nov 13 20:05:58 host2 sshd[2935270]: Disconnected from invalid user test_user 51.254.103.32 port 57568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 109.122.251.178
country_id: 130758
description:
Nov 13 20:08:00 host2 sshd[2936312]: Disconnected from invalid user bodega 109.122.251.178 port 58720 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.160
country_id: 2635167
description:
Nov 13 20:11:08 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.160, lip=66.85.158.91, TLS, session=<qM0i33pD6vYjy9Kg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.56
country_id: 2077456
description:
2025-11-13 20:11:58 dovecot_login authenticator failed for (ADMIN) [179.61.228.56]:20615: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.77
country_id: 1880251
description:
Nov 13 20:13:07 host2 sshd[2939217]: Disconnected from invalid user uos 45.78.207.77 port 50466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Nov 13 20:18:19 host2 sshd[2942278]: Disconnected from invalid user ubuntu 35.210.61.208 port 46138 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.239.45.43
country_id: 241170
description:
Nov 13 20:18:54 host2 sshd[2942474]: Disconnected from invalid user victor 156.239.45.43 port 55874 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.201.210
country_id: 3469034
description:
Nov 13 20:19:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=179.189.201.210, lip=66.85.158.91, TLS, session=<oA2l+npDXa2zvcnS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.64.19
country_id: 3469034
description:
Nov 13 20:19:31 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=177.72.64.19, lip=66.85.158.91, TLS, session=<brb5+3pDwp+xSEAT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.141.174
country_id: 798544
description:
Nov 13 20:20:47 host2 sshd[2943506]: Disconnected from invalid user ubuntu 51.68.141.174 port 35376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Nov 13 20:20:48 host2 sshd[2943520]: Disconnected from invalid user prueba 35.210.61.208 port 35828 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.210.61.208
country_id: 2802361
description:
Nov 13 20:21:57 host2 sshd[2944121]: Disconnected from invalid user debian 35.210.61.208 port 39178 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:22:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<RFYJBntDmsYDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.239.45.43
country_id: 241170
description:
Nov 13 20:21:21 host2 sshd[2943898]: Disconnected from invalid user saeed 156.239.45.43 port 56026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:22:41 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<jT5wCHtDTIMDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.241.83.2
country_id: 1269750
description:
Nov 13 20:22:45 host2 sshd[2944580]: Disconnected from invalid user user42 115.241.83.2 port 37568 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.141.174
country_id: 798544
description:
Nov 13 20:22:19 host2 sshd[2944407]: Disconnected from invalid user landi 51.68.141.174 port 56700 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.68.141.174
country_id: 798544
description:
Nov 13 20:23:32 host2 sshd[2944932]: Disconnected from invalid user prueba 51.68.141.174 port 41510 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:24:04 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<hJJjDXtDPtsDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.241.83.2
country_id: 1269750
description:
Nov 13 20:24:35 host2 sshd[2945704]: Disconnected from invalid user lee 115.241.83.2 port 47012 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:24:42 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<BYinD3tDMu0Dg9cm>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.68.141.174
country_id: 798544
description:
Nov 13 20:26:13 host2 sshd[2947360]: Disconnected from invalid user john 51.68.141.174 port 37112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.210.61.208
country_id: 2802361
description:
Nov 13 20:25:21 host2 sshd[2946686]: Disconnected from invalid user emilia 35.210.61.208 port 49240 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:25:58 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<GnYjFHtDOJYDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 13 20:27:07 host2 sshd[2948063]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 58971


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:27:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<YKugGHtD+tIDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.239.45.43
country_id: 241170
description:
Nov 13 20:26:35 host2 sshd[2947719]: Disconnected from invalid user pacs 156.239.45.43 port 56460 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:27:56 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<aHgwG3tDvr0Dg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:28:30 host2 dovecot[43647]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<gj8zHXtDCL4Dg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:29:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<58HgH3tDnMIDg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.24.183.203
country_id: 1269750
description:
Nov 13 20:30:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.24.183.203, lip=66.85.158.91, TLS, session=<1y/8I3tDXL1nGLfL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.153.147
country_id: 1269750
description:
Nov 13 20:30:59 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.65.153.147, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<gSseJntDTrafQZmT>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.107.226.235
country_id: 3865483
description:
Nov 13 20:31:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=200.107.226.235, lip=66.85.158.91, TLS, session=<5244JXtDRtvIa+Lr>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:30:15 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.91, session=<Ith4I3tDrLIDg9cm>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:30:29 host2 dovecot[43647]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<4WVUJHtD8osDg9cm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 13 20:32:08 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=66.85.158.92, session=<9lk6KntDFLUDg9cm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 115.241.83.2
country_id: 1269750
description:
Nov 13 20:32:25 host2 sshd[2954651]: Disconnected from invalid user gpadmin 115.241.83.2 port 46586 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.183.84
country_id: 3017382
description:
2025-11-13 20:34:43 dovecot_login authenticator failed for (ADMIN) [203.188.183.84]:57412: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 20:35:00 host2 sshd[2957614]: Disconnected from invalid user user 2.57.121.25 port 54577 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 13 20:36:58 host2 sshd[2959943]: Disconnected from invalid user hazel 62.60.131.157 port 65082 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.119.19.172
country_id: 2510769
description:
2025-11-13 20:38:33 dovecot_login authenticator failed for ([93.119.19.172]) [93.119.19.172]:54006: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.55.131.151
country_id: 1694008
description:
2025-11-13 20:39:02 dovecot_login authenticator failed for (122.55.143.46.static.pldt.net) [122.55.131.151]:46556: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-13 20:40:38 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49389: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.131
country_id: 6252001
description:
Nov 13 20:44:34 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=66.132.153.131, lip=66.85.158.91, TLS: Connection closed, session=<4b+nVntDXvdChJmD>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 20:46:40 host2 sshd[2970750]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-11-13 20:49:43 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (helten) [71.230.228.16]:52240: 535 Incorrect authentication data (set_id=it@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.65.136
country_id: 2328926
description:
2025-11-13 20:51:32 dovecot_login authenticator failed for (ADMIN) [146.70.65.136]:18081: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-13 20:57:18 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:58570: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-13 20:57:31 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:44602: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.224
country_id: 6252001
description:
Nov 13 21:02:44 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.224, lip=66.85.158.91, session=<7Eqll3tDA5FAPpzg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 13 21:02:48 host2 sshd[2988340]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 56890


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.222
country_id: 6252001
description:
Nov 13 21:02:57 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.222, lip=66.85.158.91, TLS: Connection closed, session=<PPNrmHtDziZAPpze>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 13 21:06:44 host2 sshd[2993314]: Disconnected from invalid user kms 162.241.87.197 port 50918 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 13 21:08:08 host2 sshd[2995018]: Disconnected from invalid user vlad 162.241.87.197 port 38536 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 21:09:31 host2 sshd[2996350]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 13 21:09:32 host2 sshd[2996425]: Disconnected from invalid user jeff 162.241.87.197 port 36858 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.87.197
country_id: 6252001
description:
Nov 13 21:11:01 host2 sshd[2998246]: Disconnected from invalid user matthew 162.241.87.197 port 56368 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.104
country_id: 1831722
description:
2025-11-13 21:12:03 dovecot_login authenticator failed for (ADMIN) [188.215.235.104]:65049: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.34.14
country_id: 953987
description:
Nov 13 21:15:30 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=102.64.34.14, lip=66.85.158.91, TLS, session=<jNAbxHtDHKFmQCIO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.70.126.74
country_id: 1269750
description:
Nov 13 21:15:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<jagath.peiris>, method=PLAIN, rip=103.70.126.74, lip=66.85.158.91, TLS, session=<T454xXtDvZRnRn5K>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 13 21:19:22 host2 sshd[3006549]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 55896


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 13 21:21:32 host2 sshd[3008877]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 54999


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.165.88.48
country_id: 3469034
description:
Nov 13 21:22:32 host2 sshd[3009786]: Disconnected from invalid user maksym 45.165.88.48 port 64420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.165.88.48
country_id: 3469034
description:
Nov 13 21:23:59 host2 sshd[3010926]: Disconnected from invalid user aaa 45.165.88.48 port 24076 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.223.133.104
country_id: 3469034
description:
2025-11-13 21:28:01 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:47367: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.151.46.98
country_id: 1861060
description:
2025-11-13 21:28:20 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [45.151.46.98]:33086: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.91
country_id: 2635167
description:
2025-11-13 21:29:14 dovecot_login authenticator failed for (ADMIN) [45.133.172.91]:59105: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.165.88.48
country_id: 3469034
description:
Nov 13 21:31:25 host2 sshd[3015223]: Disconnected from invalid user ubuntu 45.165.88.48 port 30554 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 13 21:32:38 host2 sshd[3015808]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 53280


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 21:35:51 host2 sshd[3020138]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.217.71.136
country_id: 3175395
description:
Nov 13 21:38:28 host2 pure-ftpd[3022122]: (?@185.217.71.136) [INFO] New connection from 185.217.71.136


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.134
country_id: 617790
description:
Nov 13 21:38:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=178.175.142.134, lip=66.85.158.91, session=<aUHaF3xDrLOyr46G>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.237.140
country_id: 3625428
description:
Nov 13 21:38:29 host2 pure-ftpd[3022127]: (?@95.181.237.140) [INFO] New connection from 95.181.237.140


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 98.159.36.27
country_id: 3277605
description:
Nov 13 21:38:35 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=98.159.36.27, lip=66.85.158.91, TLS handshaking: Connection closed, session=<+gnaF3xD0stinyQb>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 21:45:54 host2 sshd[3030000]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.228
country_id: 1269750
description:
2025-11-13 21:46:58 dovecot_login authenticator failed for (nsg-corporate-228.228.187.122.airtel.in) [122.187.228.228]:39916: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-11-13 21:46:23 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:60906: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.187.164.96
country_id: 6252001
description:
[2025-11-13 21:46:53 +0530] info [webmaild] 89.187.164.96 - env_eng@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-13 21:49:52 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:51180: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 13 21:51:10 host2 sshd[3047871]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 62690


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.198.132.168
country_id: 6252001
description:
Nov 13 21:52:47 host2 sshd[3049369]: Invalid user cloudtourssrilan_travel from 124.198.132.168 port 57090


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.53.170
country_id: 6252001
description:
Nov 13 21:56:00 host2 sshd[3053870]: Disconnected from invalid user user1 157.230.53.170 port 50102 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.53.170
country_id: 6252001
description:
Nov 13 21:57:06 host2 sshd[3054988]: Disconnected from invalid user delphi 157.230.53.170 port 59556 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 157.230.53.170
country_id: 6252001
description:
Nov 13 21:58:14 host2 sshd[3056054]: Disconnected from invalid user username 157.230.53.170 port 33552 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.16.25
country_id: 2300660
description:
Nov 13 21:58:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=41.139.16.25, lip=66.85.158.91, TLS, session=<08MbXnxDAOMpixAZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.25.132.170
country_id: 1269750
description:
Nov 13 21:59:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=103.25.132.170, lip=66.85.158.91, TLS, session=<UoyVYHxDI5FnGYSq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.235.186
country_id: 3175395
description:
Nov 13 21:59:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=171.22.235.186, lip=66.85.158.91, TLS, session=<M9nRYXxDJdyrFuu6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.11.195.106
country_id: 3865483
description:
Nov 13 21:58:54 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=190.11.195.106, lip=66.85.158.91, TLS, session=<qrlcX3xDPZ++C8Nq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.53.170
country_id: 6252001
description:
Nov 13 22:00:40 host2 sshd[3058804]: Disconnected from invalid user nvidia 157.230.53.170 port 60748 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.248
country_id: 6290252
description:
2025-11-13 22:02:36 dovecot_login authenticator failed for (dyn-33-248.kbcnet.rs) [109.207.33.248]:36272: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 157.230.53.170
country_id: 6252001
description:
Nov 13 22:01:50 host2 sshd[3060086]: Disconnected from invalid user vadim 157.230.53.170 port 40256 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.61.127.153
country_id: 798544
description:
2025-11-13 22:03:07 dovecot_login authenticator failed for 31.61.127.153.ipv4.public.orange.pl [31.61.127.153]:38038: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Nov 13 22:03:15 host2 sshd[3061740]: Disconnected from invalid user luciano 196.189.124.195 port 50846 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 196.189.124.195
country_id: 337996
description:
Nov 13 22:05:16 host2 sshd[3063877]: Disconnected from invalid user admin 196.189.124.195 port 52224 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 13 22:06:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS handshaking: Connection closed, session=<IsHpenxD0u1APpzA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 13 22:06:49 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.156.192, lip=66.85.158.92, TLS: Connection closed, session=<v7/WfHxDIG5APpzA>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.85
country_id: 6252001
description:
Nov 13 22:08:05 host2 pure-ftpd[3066715]: (?@147.185.132.85) [INFO] New connection from 147.185.132.85


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.185.231
country_id: 290557
description:
2025-11-13 22:08:22 dovecot_login authenticator failed for ([94.204.185.231]) [94.204.185.231]:50405: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-11-13 22:08:44 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:44953: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-13 22:07:51 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:54284: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 196.189.124.195
country_id: 337996
description:
Nov 13 22:09:25 host2 sshd[3067823]: Disconnected from invalid user vladimir 196.189.124.195 port 40116 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 179.189.199.222
country_id: 3469034
description:
Nov 13 22:11:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=179.189.199.222, lip=66.85.158.91, TLS, session=<xhqcjHxDnKazvcfe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 128.127.94.167
country_id: 798544
description:
Nov 13 22:11:11 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=128.127.94.167, lip=66.85.158.91, TLS, session=<ru92i3xDjNeAf16n>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 101.36.97.88
country_id: 2635167
description:
Nov 13 22:14:31 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=101.36.97.88, lip=66.85.158.92, session=<5YhgmHxDAp5lJGFY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 101.36.97.88
country_id: 2635167
description:
Nov 13 22:14:32 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=101.36.97.88, lip=66.85.158.92, TLS, session=<CFZrmHxD3J5lJGFY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-13 22:14:32 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:45180: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 22:15:27 host2 sshd[3073990]: Disconnected from invalid user admin 2.57.121.112 port 31891 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 13 22:16:58 host2 sshd[3075534]: Disconnected from invalid user user 2.57.121.25 port 15518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-13 22:17:39 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:37126: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 13 22:17:50 host2 sshd[3076410]: Disconnected from invalid user patience 62.60.131.157 port 11620 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-13 22:18:09 dovecot_login authenticator failed for ([125.23.229.142]) [125.19.248.170]:49528: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-11-13 22:24:58 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (cordervist) [76.157.219.158]:39452: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.34
country_id: 3996063
description:
2025-11-13 22:36:12 dovecot_login authenticator failed for ([201.173.97.34]) [201.173.97.34]:55614: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.247.105.217
country_id: 6251999
description:
2025-11-13 22:36:29 dovecot_login authenticator failed for (ADMIN) [84.247.105.217]:35494: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.67.18
country_id: 1643084
description:
2025-11-13 22:36:45 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.18]:56694: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.20.67
country_id: 6252001
description:
Nov 13 22:39:08 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.20.67, lip=66.85.158.92, session=<+zhn8HxDkEtBMRRD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.249.191
country_id: 3469034
description:
Nov 13 22:41:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=186.209.249.191, lip=66.85.158.91, TLS, session=<HhSA+HxDELq60fm/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.246.210.91
country_id: 798544
description:
Nov 13 22:42:00 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=91.246.210.91, lip=66.85.158.91, TLS, session=<qu6m+XxDWZtb9tJb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.104.127.56
country_id: 1269750
description:
Nov 13 22:45:20 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.104.127.56, lip=66.85.158.91, TLS, session=<FsmFBX1DvaZnaH84>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.76.184.8
country_id: 732800
description:
Nov 13 22:45:38 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=77.76.184.8, lip=66.85.158.91, TLS, session=<LoCpBn1Dic5NTLgI>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 13 22:58:07 host2 sshd[3114986]: Disconnected from invalid user admin 2.57.121.112 port 58863 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.88.97.37
country_id: 2921044
description:
2025-11-13 22:58:40 dovecot_login authenticator failed for (ADMIN) [45.88.97.37]:50000: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.119.19.172
country_id: 2510769
description:
2025-11-13 22:59:00 dovecot_login authenticator failed for ([93.119.19.172]) [93.119.19.172]:33420: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.227.91.154
country_id: 3469034
description:
2025-11-13 22:59:26 dovecot_login authenticator failed for ([186.227.91.154]) [186.227.91.154]:49667: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2025-11-13 23:00:05 dovecot_login authenticator failed for (nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:36825: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov 13 23:06:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<rLdqUn1D/By4aff+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.75
country_id: 6252001
description:
Nov 13 23:06:39 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=65.49.1.75, lip=66.85.158.92, session=<KJ7HUn1DwaBBMQFL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.66
country_id: 6252001
description:
Nov 13 23:06:50 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.66, lip=66.85.158.92, TLS: Connection closed, session=<zT11U31DlrlBMQFC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.38
country_id: 6252001
description:
Nov 13 23:06:51 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.38, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Gm+AU31D2bVBMQEm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.254
country_id: 6252001
description:
Nov 13 23:06:54 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=184.105.247.254, lip=66.85.158.91, TLS handshaking: Connection closed, session=<zMGrU31D7Ou4aff+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.118.133
country_id: 6252001
description:
Nov 13 23:07:18 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.56.118.133, lip=66.85.158.92, session=<Vu4gVX1DENYtOHaF>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.118.133
country_id: 6252001
description:
Nov 13 23:08:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=45.56.118.133, lip=66.85.158.92, session=<acHIV31DRhYtOHaF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.67
country_id: 6252001
description:
Nov 13 23:09:15 host2 pure-ftpd[3121674]: (?@198.235.24.67) [INFO] New connection from 198.235.24.67


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.247
country_id: 6252001
description:
Nov 13 23:11:11 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=162.216.149.247, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<7f8EY31DmMmi2JX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.56.118.133
country_id: 6252001
description:
Nov 13 23:11:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (no auth attempts in 1 secs): user=<>, rip=45.56.118.133, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher, session=<aY6dZX1DOqYtOHaF>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 64.62.156.192
country_id: 6252001
description:
Nov 13 23:12:08 host2 pure-ftpd[3123518]: (?@64.62.156.192) [INFO] New connection from 64.62.156.192


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.247
country_id: 6252001
description:
Nov 13 23:12:12 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=162.216.149.247, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<w++gZn1D5OKi2JX3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 162.216.149.247
country_id: 6252001
description:
Nov 13 23:16:22 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=162.216.149.247, lip=66.85.158.92, TLS, session=<i+iMdX1DLPyi2JX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.236.6
country_id: 614540
description:
2025-11-13 23:17:33 dovecot_login authenticator failed for (ADMIN) [95.181.236.6]:25162: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 23:21:17 host2 sshd[3128296]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.101.153
country_id: 3175395
description:
Nov 13 23:25:56 host2 sshd[3130810]: Disconnected from invalid user fabien 151.47.101.153 port 34714 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-11-13 23:28:07 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:59678: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.101.153
country_id: 3175395
description:
Nov 13 23:29:25 host2 sshd[3132611]: Disconnected from invalid user erp 151.47.101.153 port 34584 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 197.5.145.73
country_id: 2464461
description:
Nov 13 23:30:11 host2 sshd[3133097]: Disconnected from invalid user gt 197.5.145.73 port 50859 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 23:31:23 host2 sshd[3133799]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.101.153
country_id: 3175395
description:
Nov 13 23:32:03 host2 sshd[3134084]: Disconnected from invalid user odoo2 151.47.101.153 port 34606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.47.101.153
country_id: 3175395
description:
Nov 13 23:33:20 host2 sshd[3134618]: Disconnected from invalid user vera 151.47.101.153 port 34853 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.64.225.224
country_id: 3017382
description:
2025-11-13 23:39:31 dovecot_login authenticator failed for 82-64-225-224.subs.proxad.net [82.64.225.224]:58507: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-13 23:39:44 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:45650: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.102
country_id: 2921044
description:
2025-11-13 23:41:45 dovecot_login authenticator failed for (ADMIN) [191.101.157.102]:1962: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.17.133.138
country_id: 3469034
description:
Nov 13 23:42:17 host2 sshd[3139851]: Disconnected from invalid user vera 201.17.133.138 port 44794 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.186.21.117
country_id: 798544
description:
Nov 13 23:44:36 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=89.186.21.117, lip=66.85.158.91, TLS, session=</3CK2X1DuOFZuhV1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.43.19.42
country_id: 3175395
description:
Nov 13 23:44:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=185.43.19.42, lip=66.85.158.91, TLS, session=<XLCi2n1Dl8q5KxMq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2025-11-13 23:46:25 dovecot_plain authenticator failed for 68.129.5.84.rev.sfr.net (rueurara) [84.5.129.68]:49790: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 13 23:49:42 host2 sshd[3144582]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.155.216.248
country_id: 3469034
description:
2025-11-13 23:58:27 dovecot_login authenticator failed for (gbonline.com.br) [177.155.216.248]:58013: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-11-13 23:58:58 dovecot_login authenticator failed for 47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net [47.206.63.169]:51688: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-13 23:59:32 dovecot_login authenticator failed for ([125.17.158.129]) [182.95.115.38]:43390: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.4
country_id: 6252001
description:
Nov 14 00:00:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=74.82.47.4, lip=66.85.158.91, session=<Q8wEEn5DjOBKUi8E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.105
country_id: 3144096
description:
2025-11-14 00:02:48 dovecot_login authenticator failed for (ADMIN) [46.246.122.105]:24973: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.28.54
country_id: 2300660
description:
Nov 14 00:03:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 24 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=41.139.28.54, lip=66.85.158.91, TLS, session=<lZNiHn5DSrQpixw2>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.100.157
country_id: 3865483
description:
Nov 14 00:04:20 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=190.181.100.157, lip=66.85.158.91, TLS, session=<AprzH35D5MK+tWSd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Nov 14 00:05:05 host2 sshd[3154303]: Disconnected from invalid user term1 103.174.115.196 port 39234 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 00:08:19 host2 sshd[3155890]: Disconnected from invalid user pritchard 2.57.121.112 port 61382 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.236.172.11
country_id: 798544
description:
Nov 14 00:08:22 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=91.236.172.11, lip=66.85.158.91, TLS, session=<+bB6Ln5Duc1b7KwL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.160.174.228
country_id: 798544
description:
Nov 14 00:08:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=82.160.174.228, lip=66.85.158.91, TLS, session=<qPBmLX5Dy7hSoK7k>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Nov 14 00:08:53 host2 sshd[3156147]: Disconnected from invalid user in 103.174.115.196 port 44652 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.174.115.196
country_id: 1643084
description:
Nov 14 00:16:10 host2 sshd[3160862]: Disconnected from invalid user debian 103.174.115.196 port 46106 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.28
country_id: 6252001
description:
2025-11-14 00:17:34 dovecot_login authenticator failed for ([70.174.168.28]) [70.174.168.28]:49051: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-11-14 00:17:53 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:45256: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 00:18:33 host2 sshd[3162560]: Disconnected from invalid user admin 2.57.121.112 port 35247 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-11-14 00:20:04 dovecot_login authenticator failed for ([113.11.34.221]) [113.11.34.221]:44488: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-11-14 00:20:22 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:57149: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.174.115.196
country_id: 1643084
description:
Nov 14 00:21:41 host2 sshd[3164355]: Disconnected from invalid user mohamad 103.174.115.196 port 48118 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.133.172.198
country_id: 2635167
description:
2025-11-14 00:22:42 dovecot_login authenticator failed for (ADMIN) [45.133.172.198]:49676: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 00:28:32 host2 sshd[3167809]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 00:29:36 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:49770: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 14 00:32:08 host2 sshd[3170312]: Disconnected from invalid user sharan 205.185.115.224 port 42756 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.10.206
country_id: 2300660
description:
Nov 14 00:32:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=41.139.10.206, lip=66.85.158.91, TLS, session=</QSkg35DE4EpiwrO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.236.2
country_id: 798544
description:
Nov 14 00:32:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=109.125.236.2, lip=66.85.158.91, TLS, session=<1NLkhH5DBeZtfewC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.17.125.46
country_id: 690791
description:
Nov 14 00:33:49 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.17.125.46, lip=66.85.158.91, TLS, session=<9mGHiX5DQcO5EX0u>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.244.78
country_id: 798544
description:
Nov 14 00:34:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=109.125.244.78, lip=66.85.158.91, TLS, session=<cQeiin5DOqNtffRO>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 14 00:35:32 host2 sshd[3172132]: Disconnected from invalid user web 205.185.115.224 port 48176 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 14 00:36:42 host2 sshd[3172644]: Disconnected from invalid user vss 205.185.115.224 port 46284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 14 00:37:50 host2 sshd[3173170]: Disconnected from invalid user rocky 205.185.115.224 port 44396 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 00:38:36 host2 sshd[3173615]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 205.185.115.224
country_id: 6252001
description:
Nov 14 00:40:06 host2 sshd[3174570]: Disconnected from invalid user lam 205.185.115.224 port 40626 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-14 00:43:33 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (teracheal) [73.195.211.98]:39374: 535 Incorrect authentication data (set_id=ajith@simple-engineering.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.252.120
country_id: 6252001
description:
2025-11-14 00:44:19 dovecot_login authenticator failed for (ADMIN) [102.129.252.120]:52272: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 181.49.50.6
country_id: 3686110
description:
Nov 14 00:49:15 host2 sshd[3180919]: Disconnected from invalid user yxu 181.49.50.6 port 52044 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Nov 14 00:51:46 host2 sshd[3182591]: Disconnected from invalid user jiaxuan 181.49.50.6 port 51348 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 181.49.50.6
country_id: 3686110
description:
Nov 14 00:53:06 host2 sshd[3183316]: Disconnected from invalid user celka 181.49.50.6 port 50996 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Nov 14 01:04:03 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, TLS: Connection closed, session=<ohWm9n5DcItChJmE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.54.174
country_id: 6252001
description:
2025-11-14 01:07:14 dovecot_login authenticator failed for (ADMIN) [212.56.54.174]:63571: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.167
country_id: 6252001
description:
Nov 14 01:09:19 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.167, lip=66.85.158.91, TLS handshaking: Connection closed, session=</jB/CX9DTdzDuEyn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.205
country_id: 6252001
description:
Nov 14 01:09:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.205, lip=66.85.158.91, TLS: Connection closed, session=<56ccCn9DgePDuEzN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.160
country_id: 6252001
description:
Nov 14 01:09:37 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.160, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<h9OQCn9D/Y3DuEyg>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.228
country_id: 6252001
description:
Nov 14 01:09:41 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.228, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<gQLRCn9D/tXN0h/k>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.161
country_id: 6252001
description:
Nov 14 01:09:40 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.161, lip=66.85.158.91, TLS: Connection closed, session=<pJe/Cn9Dba7DuEyh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 01:15:01 host2 sshd[3196704]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.2.189.222
country_id: 798544
description:
Nov 14 01:17:38 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<training@v-deploy.com>, method=PLAIN, rip=83.2.189.222, lip=66.85.158.91, TLS, session=<XnwtJn9D3uZTAr3e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.41
country_id: 1733045
description:
2025-11-14 01:17:44 dovecot_login authenticator failed for ([49.124.146.41]) [49.124.146.41]:42096: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.140.218.210
country_id: 1269750
description:
2025-11-14 01:18:26 dovecot_login authenticator failed for (14.140.218.210.Static-bangalore-vsnl.net.in) [14.140.218.210]:49949: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-11-14 01:18:49 dovecot_login authenticator failed for (nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:59614: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 154.127.35.68
country_id: 2395170
description:
Nov 14 01:17:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<training>, method=PLAIN, rip=154.127.35.68, lip=66.85.158.91, TLS, session=<gBVTJ39DGZ+afyNE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2025-11-14 01:18:04 dovecot_login authenticator failed for ([125.17.70.25]) [125.20.251.70]:40942: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.104.144.93
country_id: 798549
description:
2025-11-14 01:23:35 dovecot_plain authenticator failed for (mater) [86.104.144.93]:35444: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.203.19.0
country_id: 6251999
description:
Nov 14 01:26:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=159.203.19.0, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</nHWR39DqMefyxMA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.21.189
country_id: 2750405
description:
2025-11-14 01:27:15 dovecot_login authenticator failed for (ADMIN) [158.173.21.189]:55370: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.107.226
country_id: 3469034
description:
Nov 14 01:33:14 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=191.53.107.226, lip=66.85.158.91, TLS, session=<SfL1XX9D+LO/NWvi>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.105.163
country_id: 798544
description:
Nov 14 01:32:54 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=178.219.105.163, lip=66.85.158.91, TLS, session=<uEfXXH9DlKqy22mj>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 01:38:26 host2 sshd[3210661]: Disconnected from invalid user admin 2.57.121.112 port 56575 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.233.209
country_id: 3175395
description:
Nov 14 01:47:39 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=171.22.233.209, lip=66.85.158.91, TLS, session=<4Y6akX9DZc6rFunR>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.128.12
country_id: 6252001
description:
Nov 14 01:47:49 host2 pure-ftpd[3216786]: (?@172.105.128.12) [INFO] New connection from 172.105.128.12


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.107
country_id: 3469034
description:
Nov 14 01:47:59 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=186.209.250.107, lip=66.85.158.91, TLS, session=<Heq6kn9D1am60fpr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.31.20
country_id: 718075
description:
2025-11-14 01:49:53 dovecot_login authenticator failed for (ADMIN) [185.225.31.20]:12656: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 01:50:58 host2 sshd[3218971]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.112.141.230
country_id: 2750405
description:
2025-11-14 01:52:17 dovecot_login authenticator failed for 50708de6.static.ziggozakelijk.nl [80.112.141.230]:39866: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.164.251.182
country_id: 6252001
description:
2025-11-14 01:52:20 dovecot_login authenticator failed for 216-164-251-182.s9140.c3-0.eas-cbr4.atw-eas.pa.cable.rcncustomer.com [216.164.251.182]:33046: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-11-14 01:52:35 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:60125: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.16.144.166
country_id: 1522867
description:
2025-11-14 01:52:42 dovecot_login authenticator failed for ([46.16.144.166]) [46.16.144.166]:42262: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Nov 14 01:52:43 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.11, lip=66.85.158.91, session=<ZgG4pH9D2tusaYAL>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.172.21
country_id: 6252001
description:
Nov 14 01:53:05 host2 dovecot[43647]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=45.79.172.21, lip=66.85.158.91, session=<c78Apn9DQrotT6wV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.128.205
country_id: 6252001
description:
Nov 14 01:53:56 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.128.205, lip=66.85.158.91, session=<dCwSqX9DjowtT4DN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.208
country_id: 6252001
description:
Nov 14 01:59:22 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.208, lip=66.85.158.91, session=<Ywh7vH9DqOGs7OTQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-14 01:59:52 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:46724: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-11-14 02:00:21 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:60413: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 45.79.207.129
country_id: 6252001
description:
Nov 14 02:05:20 host2 pure-ftpd[3228209]: (?@45.79.207.129) [INFO] New connection from 45.79.207.129


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 105.27.148.94
country_id: 192950
description:
Nov 14 02:07:16 host2 sshd[3229118]: Disconnected from invalid user es 105.27.148.94 port 57546 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.79.51
country_id: 6252001
description:
Nov 14 02:08:00 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=47.251.79.51, lip=66.85.158.92, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<tVNX239DQl8v+08z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.52.44
country_id: 798549
description:
2025-11-14 02:08:04 dovecot_login authenticator failed for (ADMIN) [143.244.52.44]:31075: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.125.4.12
country_id: 798544
description:
Nov 14 02:08:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.125.4.12, lip=66.85.158.91, TLS, session=<za/+239DGei5fQQM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.184
country_id: 798544
description:
Nov 14 02:08:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=91.238.166.184, lip=66.85.158.91, TLS, session=<DrgQ3X9Dc7Fb7qa4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 02:12:19 host2 sshd[3231968]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 105.27.148.94
country_id: 192950
description:
Nov 14 02:13:20 host2 sshd[3232508]: Disconnected from invalid user gerencia 105.27.148.94 port 44722 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 02:14:13 host2 sshd[3233474]: Disconnected from invalid user guest 2.57.121.112 port 61566 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 02:16:13 host2 sshd[3234668]: Disconnected from invalid user admin 2.57.121.112 port 13832 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.131.104.176
country_id: 6252001
description:
Nov 14 02:19:27 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=104.131.104.176, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<b4tIBIBDwIdog2iw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 14 02:20:09 host2 sshd[3236900]: Disconnected from invalid user web 92.185.99.40 port 58944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 14 02:21:10 host2 sshd[3237387]: Disconnected from invalid user ftpuser 143.110.137.94 port 36358 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 02:22:00 host2 sshd[3237743]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.216.178
country_id: 1861060
description:
Nov 14 02:22:17 host2 sshd[3237875]: Disconnected from invalid user edi 124.156.216.178 port 46366 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 14 02:23:54 host2 sshd[3238658]: Disconnected from invalid user user123 143.110.137.94 port 55286 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 14 02:25:12 host2 sshd[3239435]: Disconnected from invalid user cloud 92.185.99.40 port 34484 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 14 02:26:26 host2 sshd[3240116]: Disconnected from invalid user postgres 92.185.99.40 port 41444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.216.178
country_id: 1861060
description:
Nov 14 02:26:45 host2 sshd[3240269]: Disconnected from invalid user wow 124.156.216.178 port 52198 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.216.178
country_id: 1861060
description:
Nov 14 02:28:04 host2 sshd[3240801]: Disconnected from invalid user user3 124.156.216.178 port 52558 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.219
country_id: 798544
description:
2025-11-14 02:29:15 dovecot_login authenticator failed for (ADMIN) [138.199.59.219]:57020: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 14 02:29:58 host2 sshd[3241909]: Disconnected from invalid user haproxy 92.185.99.40 port 52852 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.156.216.178
country_id: 1861060
description:
Nov 14 02:30:35 host2 sshd[3242521]: Disconnected from invalid user jia 124.156.216.178 port 53258 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 14 02:31:21 host2 sshd[3243204]: Disconnected from invalid user edi 143.110.137.94 port 60026 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-14 02:36:30 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (flare) [81.225.30.107]:58853: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 14 02:37:00 host2 sshd[3246447]: Disconnected from invalid user user3 143.110.137.94 port 45360 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 143.110.137.94
country_id: 6252001
description:
Nov 14 02:40:44 host2 sshd[3248706]: Disconnected from invalid user jerry 143.110.137.94 port 47380 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.191
country_id: 3017382
description:
Nov 14 02:43:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=91.196.152.191, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<R5yJW4BD5etbxJi/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.221
country_id: 3017382
description:
Nov 14 02:43:54 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.221, lip=66.85.158.91, TLS: Connection closed, session=<n6W5W4BDN5tbxJjd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.185
country_id: 3017382
description:
Nov 14 02:43:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=91.196.152.185, lip=66.85.158.91, TLS handshaking: Connection closed, session=<K/UdWoBDF7pbxJi5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.216
country_id: 3017382
description:
Nov 14 02:43:39 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=91.196.152.216, lip=66.85.158.91, TLS: Connection closed, session=<DWrhWoBDpYNbxJjY>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.207
country_id: 6252001
description:
Nov 14 02:47:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.207, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kGd1aIBDx8fG6xjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-11-14 02:55:24 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (reburga) [24.1.200.187]:54822: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.75.222.34
country_id: 3077311
description:
Nov 14 02:55:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=217.75.222.34, lip=66.85.158.91, TLS, session=<3KgVhIBD+YjZS94i>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.43.231.85
country_id: 798544
description:
Nov 14 02:54:59 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=193.43.231.85, lip=66.85.158.91, TLS, session=</w9mgoBD343BK+dV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-14 02:57:49 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:42458: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-14 02:57:58 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:26392: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.120
country_id: 3703430
description:
2025-11-14 03:15:44 dovecot_login authenticator failed for (ADMIN) [91.90.126.120]:42584: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-11-14 03:17:29 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:58406: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-11-14 03:17:57 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:54902: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.60
country_id: 6252001
description:
Nov 14 03:21:06 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=167.94.146.60, lip=66.85.158.91, TLS: Connection closed, session=<+crP4IBD2sOnXpI8>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.129
country_id: 6252001
description:
Nov 14 03:21:19 host2 pure-ftpd[3273823]: (?@66.132.153.129) [INFO] New connection from 66.132.153.129


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.55
country_id: 6252001
description:
Nov 14 03:24:33 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.55, lip=66.85.158.91, TLS, session=<6/MZ7YBDZPiTuYQ3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.189.219
country_id: 3175395
description:
Nov 14 03:27:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.208.189.219, lip=66.85.158.91, TLS, session=<gnnl9YBDf4i50L3b>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.129.61.155
country_id: 953987
description:
Nov 14 03:27:38 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=102.129.61.155, lip=66.85.158.91, TLS, session=<U4cO94BDIq9mgT2b>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-11-14 03:31:50 dovecot_login authenticator failed for ([128.185.211.102]) [128.185.211.102]:58224: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-11-14 03:32:19 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:49167: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.130.169.197
country_id: 3469034
description:
Nov 14 03:33:30 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.130.169.197, lip=66.85.158.91, TLS, session=<VZv3C4FD2NixgqnF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.37.11.59
country_id: 3469034
description:
Nov 14 03:33:51 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=191.37.11.59, lip=66.85.158.91, TLS, session=<1XxJDYFD1IK/JQs7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.154.241.24
country_id: 290557
description:
Nov 14 03:33:52 host2 pure-ftpd[3281902]: (?@165.154.241.24) [INFO] New connection from 165.154.241.24


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 14 03:33:28 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.123, lip=66.85.158.92, TLS handshaking: Connection closed, session=<62EBDYFDnF1ChJl7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 209.97.141.134
country_id: 2635167
description:
Nov 14 03:33:28 host2 pure-ftpd[3281634]: (?@209.97.141.134) [INFO] New connection from 209.97.141.134


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.105.128.11
country_id: 6252001
description:
Nov 14 03:35:55 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.105.128.11, lip=66.85.158.91, session=<dZrEFYFDQrOsaYAL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.239
country_id: 798544
description:
2025-11-14 03:39:28 dovecot_login authenticator failed for (ADMIN) [138.199.59.239]:55888: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.120.101
country_id: 6252001
description:
Nov 14 03:40:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.168.120.101, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<wkwCJ4FD+OsUqHhl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.106.57.141
country_id: 6252001
description:
Nov 14 03:41:20 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.106.57.141, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<I/0sKYFDHoAUajmN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-11-14 03:43:10 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (snonrapoly) [73.144.27.228]:57054: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-14 03:46:21 dovecot_plain authenticator failed for (mican) [12.150.243.22]:10592: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.248
country_id: 1733045
description:
2025-11-14 03:51:35 dovecot_login authenticator failed for ([49.124.150.248]) [49.124.150.248]:60404: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.133
country_id: 6252001
description:
Nov 14 03:51:49 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.133, lip=66.85.158.91, TLS handshaking: Connection closed, session=<COShToFDVA5ChJmF>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 03:53:09 host2 sshd[3296461]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.132.205
country_id: 6252001
description:
2025-11-14 03:57:15 dovecot_login authenticator failed for (ADMIN) [79.127.132.205]:24620: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 03:57:45 host2 sshd[3300766]: Disconnected from invalid user jaydon 62.60.131.157 port 49975 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 04:02:44 host2 sshd[3304917]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.190.38
country_id: 3175395
description:
Nov 14 04:09:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=185.208.190.38, lip=66.85.158.91, TLS, session=<l3LNjIFDHo650L4m>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 139.28.190.42
country_id: 2510769
description:
Nov 14 04:09:47 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=139.28.190.42, lip=66.85.158.91, TLS, session=<YFjmjYFDJcWLHL4q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 04:12:24 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63842: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.121
country_id: 6252001
description:
Nov 14 04:14:44 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.121, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<z+qSoIFDONnG6xh5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.138.162.14
country_id: 290557
description:
2025-11-14 04:17:45 dovecot_login authenticator failed for (ADMIN) [217.138.162.14]:56446: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.87
country_id: 2635167
description:
Nov 14 04:21:10 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.210.87, lip=66.85.158.91, session=<fMKft4FDpuMjy9JX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-11-14 04:21:45 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (fingly) [24.15.216.41]:36018: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 40.142.136.45
country_id: 6252001
description:
[2025-11-14 04:22:35 +0530] info [cpaneld] 40.142.136.45 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.21.246
country_id: 6252001
description:
[2025-11-14 04:22:36 +0530] info [cpaneld] 152.42.21.246 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.63.16.176
country_id: 6252001
description:
[2025-11-14 04:22:50 +0530] info [cpaneld] 71.63.16.176 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.59.7.100
country_id: 6252001
description:
[2025-11-14 04:22:52 +0530] info [whostmgrd] 173.59.7.100 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 63.247.33.60
country_id: 6252001
description:
[2025-11-14 04:23:03 +0530] info [cpaneld] 63.247.33.60 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.12.186.253
country_id: 6252001
description:
[2025-11-14 04:23:13 +0530] info [cpaneld] 172.12.186.253 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.86.191.114
country_id: 6252001
description:
[2025-11-14 04:23:14 +0530] info [cpaneld] 174.86.191.114 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.92
country_id: 6252001
description:
Nov 14 04:27:53 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.92, lip=66.85.158.91, TLS, session=<zbSlz4FD8O7N0h9c>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.119.37.24
country_id: 6252001
description:
[2025-11-14 04:30:03 +0530] info [whostmgrd] 172.119.37.24 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.203.89.130
country_id: 6252001
description:
[2025-11-14 04:29:41 +0530] info [cpaneld] 71.203.89.130 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.87.18.81
country_id: 6252001
description:
[2025-11-14 04:29:46 +0530] info [cpaneld] 172.87.18.81 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.79.109.53
country_id: 6252001
description:
[2025-11-14 04:29:54 +0530] info [cpaneld] 74.79.109.53 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.95.137.26
country_id: 6252001
description:
[2025-11-14 04:30:19 +0530] info [cpaneld] 71.95.137.26 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.87.168.89
country_id: 6252001
description:
[2025-11-14 04:30:21 +0530] info [cpaneld] 108.87.168.89 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-11-14 04:36:26 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:54830: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.49.63.41
country_id: 3469034
description:
2025-11-14 04:36:40 dovecot_login authenticator failed for customer-187-49-63-41.f1net.com.br [187.49.63.41]:34773: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 14 04:36:49 host2 sshd[3337220]: Disconnected from invalid user felix 101.36.116.29 port 54576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.88
country_id: 6251999
description:
2025-11-14 04:37:18 dovecot_login authenticator failed for (ADMIN) [66.56.80.88]:19599: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.244
country_id: 3469034
description:
Nov 14 04:40:08 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.53.165.244, lip=66.85.158.91, TLS, session=<MoVJ+oFDhM2xNaX0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.169.124
country_id: 3175395
description:
Nov 14 04:40:26 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.15.169.124, lip=66.85.158.91, TLS, session=<fVeD+4FDBJW5D6l8>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 14 04:41:02 host2 sshd[3339581]: Disconnected from invalid user visitor 101.36.116.29 port 51150 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-14 04:41:55 dovecot_login authenticator failed for (nsg-corporate-97.172.186.122.airtel.in) [152.52.236.158]:51420: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-14 04:42:10 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:35352: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 14 04:42:23 host2 sshd[3340173]: Disconnected from invalid user ftpuser 101.36.116.29 port 38744 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 95.0.32.88
country_id: 298795
description:
Nov 14 04:43:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=95.0.32.88, lip=66.85.158.91, TLS, session=<Wg9mBYJDFLxfACBY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.255.206.217
country_id: 3469034
description:
Nov 14 04:43:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=138.255.206.217, lip=66.85.158.91, TLS, session=<6U6QBoJDTL6K/87Z>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.220.10.3
country_id: 1269750
description:
Nov 14 04:46:15 host2 sshd[3343036]: Disconnected from invalid user ammar 117.220.10.3 port 50969 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 04:46:48 host2 sshd[3343267]: Disconnected from invalid user landen 62.60.131.157 port 43555 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 14 04:47:53 host2 sshd[3343824]: Disconnected from invalid user teamspeak 101.36.116.29 port 39480 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.116.29
country_id: 1819730
description:
Nov 14 04:49:26 host2 sshd[3344917]: Disconnected from invalid user systems 101.36.116.29 port 35860 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.102.50
country_id: 1269750
description:
2025-11-14 04:52:27 dovecot_login authenticator failed for ([27.123.102.50]) [27.123.102.50]:51586: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-11-14 04:52:55 dovecot_login authenticator failed for ([125.23.235.136]) [128.185.252.110]:33244: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-14 04:54:52 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:52222: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
country_id: 2661886
description:
2025-11-14 04:55:06 dovecot_login authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:57123: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.194.158
country_id: 1880251
description:
Nov 14 04:55:18 host2 sshd[3349143]: Disconnected from invalid user admin 124.156.194.158 port 47758 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.82.203.138
country_id: 3469034
description:
[2025-11-14 04:56:50 +0530] info [whostmgrd] 170.82.203.138 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.220.10.3
country_id: 1269750
description:
Nov 14 04:57:14 host2 sshd[3350421]: Disconnected from invalid user hik 117.220.10.3 port 51281 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.194.158
country_id: 1880251
description:
Nov 14 04:58:07 host2 sshd[3350872]: Disconnected from invalid user arjun 124.156.194.158 port 56764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.220.10.3
country_id: 1269750
description:
Nov 14 05:00:44 host2 sshd[3352818]: Disconnected from invalid user elsearch 117.220.10.3 port 55808 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.27.203.82
country_id: 1605651
description:
[2025-11-14 05:01:13 +0530] info [webmaild] 103.27.203.82 - washeera@lezzarotech.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.194.158
country_id: 1880251
description:
Nov 14 05:02:08 host2 sshd[3353591]: Disconnected from invalid user sammy 124.156.194.158 port 39254 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 183.12.223.154
country_id: 1814991
description:
[2025-11-14 05:03:00 +0530] info [cpaneld] 183.12.223.154 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.215.255
country_id: 1733045
description:
[2025-11-14 05:03:03 +0530] info [cpaneld] 113.211.215.255 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.117.17.100
country_id: 6252001
description:
[2025-11-14 05:03:07 +0530] info [cpaneld] 69.117.17.100 - dragon "GET /login/?login_only=1&user=dragon&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.201.0.153
country_id: 290291
description:
[2025-11-14 05:03:11 +0530] info [whostmgrd] 88.201.0.153 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 81.61.99.160
country_id: 2510769
description:
[2025-11-14 05:03:25 +0530] info [cpaneld] 81.61.99.160 - drago "GET /login/?login_only=1&user=drago&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user drago (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.215.169.13
country_id: 3017382
description:
[2025-11-14 05:03:34 +0530] info [cpaneld] 109.215.169.13 - dra "GET /login/?login_only=1&user=dra&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dra (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.71.253.161
country_id: 3469034
description:
[2025-11-14 05:03:18 +0530] info [cpaneld] 189.71.253.161 - dragonlk "GET /login/?login_only=1&user=dragonlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dragonlk (has_cpuser_file failed)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 107.170.40.70
country_id: 6252001
description:
Nov 14 05:03:22 host2 pure-ftpd[3354611]: (?@107.170.40.70) [INFO] New connection from 107.170.40.70


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.191.195.44
country_id: 1562822
description:
[2025-11-14 05:03:27 +0530] info [cpaneld] 14.191.195.44 - drag "GET /login/?login_only=1&user=drag&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user drag (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 197.120.200.167
country_id: 357994
description:
[2025-11-14 05:03:36 +0530] info [cpaneld] 197.120.200.167 - dr "GET /login/?login_only=1&user=dr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user dr (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 168.0.224.112
country_id: 3469034
description:
Nov 14 05:03:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=168.0.224.112, lip=66.85.158.91, TLS, session=<sRp+T4JDdbeoAOBw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.220.10.3
country_id: 1269750
description:
Nov 14 05:04:13 host2 sshd[3355100]: Disconnected from invalid user egarcia 117.220.10.3 port 43536 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.85.63.28
country_id: 3469034
description:
Nov 14 05:04:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=177.85.63.28, lip=66.85.158.91, TLS, session=<RejDUIJDLbmxVT8c>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 124.156.194.158
country_id: 1880251
description:
Nov 14 05:04:41 host2 sshd[3355294]: Disconnected from invalid user agent 124.156.194.158 port 33296 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.68
country_id: 2264397
description:
Nov 14 05:06:36 host2 pure-ftpd[3356369]: (?@109.105.210.68) [INFO] New connection from 109.105.210.68


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.69
country_id: 2264397
description:
Nov 14 05:06:35 host2 pure-ftpd[3356365]: (?@109.105.210.69) [INFO] New connection from 109.105.210.69


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.67
country_id: 2264397
description:
Nov 14 05:06:36 host2 pure-ftpd[3356381]: (?@109.105.210.67) [INFO] New connection from 109.105.210.67


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 109.105.210.70
country_id: 2264397
description:
Nov 14 05:06:37 host2 pure-ftpd[3356392]: (?@109.105.210.70) [INFO] New connection from 109.105.210.70


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.164.39.32
country_id: 3202326
description:
2025-11-14 05:09:28 dovecot_plain authenticator failed for 39-32.dsl.iskon.hr ([31.57.166.48]) [89.164.39.32]:51470: 535 Incorrect authentication data (set_id=info@dragon.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 124.156.194.158
country_id: 1880251
description:
Nov 14 05:09:59 host2 sshd[3358031]: Disconnected from invalid user omer 124.156.194.158 port 32992 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.151.62.163
country_id: 6252001
description:
[2025-11-14 05:14:10 +0530] info [cpaneld] 47.151.62.163 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.117.47.172
country_id: 6252001
description:
[2025-11-14 05:14:12 +0530] info [cpaneld] 73.117.47.172 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.56.190.64
country_id: 6252001
description:
[2025-11-14 05:14:41 +0530] info [whostmgrd] 108.56.190.64 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.12.43.147
country_id: 6252001
description:
[2025-11-14 05:14:46 +0530] info [cpaneld] 24.12.43.147 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.207.163.132
country_id: 6252001
description:
[2025-11-14 05:14:50 +0530] info [cpaneld] 98.207.163.132 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.34.108.54
country_id: 6252001
description:
[2025-11-14 05:15:05 +0530] info [cpaneld] 73.34.108.54 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.150.19.159
country_id: 6252001
description:
[2025-11-14 05:17:32 +0530] info [cpaneld] 47.150.19.159 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.156.49.86
country_id: 6252001
description:
[2025-11-14 05:17:36 +0530] info [cpaneld] 47.156.49.86 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.107.167.30
country_id: 6252001
description:
[2025-11-14 05:17:48 +0530] info [cpaneld] 174.107.167.30 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.117.220.255
country_id: 6252001
description:
[2025-11-14 05:18:01 +0530] info [whostmgrd] 99.117.220.255 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.253.38
country_id: 6252001
description:
[2025-11-14 05:18:06 +0530] info [cpaneld] 172.58.253.38 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.236.172.85
country_id: 6252001
description:
[2025-11-14 05:18:13 +0530] info [cpaneld] 24.236.172.85 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.136.130.96
country_id: 6252001
description:
[2025-11-14 05:18:18 +0530] info [cpaneld] 69.136.130.96 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.113
country_id: 6252001
description:
Nov 14 05:18:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=66.132.153.113, lip=66.85.158.92, TLS: Connection closed, session=<Kk6zhYJD7oNChJlx>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.75
country_id: 2264397
description:
Nov 14 05:19:40 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=45.156.129.75, lip=66.85.158.92, TLS, session=<0gXViIJD6s0tnIFL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 45.156.129.76
country_id: 2264397
description:
Nov 14 05:19:40 host2 dovecot[43647]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=45.156.129.76, lip=66.85.158.92, TLS, session=<r/DSiIJDp8EtnIFM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.76
country_id: 2264397
description:
Nov 14 05:19:40 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low (no auth attempts in 0 secs): user=<>, rip=45.156.129.76, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1420918C:SSL routines:tls_early_post_process_client_hello:version too low, session=<YMrYiIJDKdItnIFM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.156.129.78
country_id: 2264397
description:
Nov 14 05:19:41 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=45.156.129.78, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<n6rciIJDN9ktnIFO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.6.240
country_id: 6252001
description:
2025-11-14 05:22:06 dovecot_plain authenticator failed for c-71-62-6-240.hsd1.va.comcast.net (skswoo) [71.62.6.240]:60044: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 80.82.77.139
country_id: 2750405
description:
Nov 14 05:22:09 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=80.82.77.139, lip=66.85.158.91, TLS, session=<k3q1kYJDjuhQUk2L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.50
country_id: 732800
description:
2025-11-14 05:22:34 dovecot_login authenticator failed for (ADMIN) [94.156.14.50]:35802: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 80.82.77.139
country_id: 2750405
description:
Nov 14 05:22:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 1 secs): user=<>, rip=80.82.77.139, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<xqi+kYJDbO1QUk2L>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.239
country_id: 6252001
description:
Nov 14 05:25:59 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=147.185.132.239, lip=66.85.158.92, session=<5whvn4JDLOaTuYTv>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 05:33:39 host2 sshd[3370904]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2025-11-14 05:33:13 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:34710: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.101.69
country_id: 3144096
description:
2025-11-14 05:33:28 dovecot_login authenticator failed for ([46.212.101.69]) [46.212.101.69]:38766: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-11-14 05:33:44 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:57874: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.4
country_id: 1733045
description:
2025-11-14 05:33:49 dovecot_login authenticator failed for ([49.124.153.4]) [49.124.153.4]:50346: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-14 05:34:21 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:47708: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.219.114.145
country_id: 3996063
description:
[2025-11-14 05:35:38 +0530] info [whostmgrd] 189.219.114.145 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.103.80.92
country_id: 1210997
description:
[2025-11-14 05:40:24 +0530] info [cpaneld] 117.103.80.92 - lezzarot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lezzarot (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.118
country_id: 6252001
description:
Nov 14 05:42:08 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.118, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<jtoi2YJDB8nG6xh2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 14 05:42:21 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<sYnr2YJD9OGLonQW>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 05:43:16 host2 sshd[3375610]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.132
country_id: 2635167
description:
Nov 14 05:44:20 host2 dovecot[43647]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.132, lip=66.85.158.91, TLS, session=<zqUB4YJDE8ZX7LCE>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.177.113.56
country_id: 3175395
description:
Nov 14 05:45:24 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=195.177.113.56, lip=66.85.158.91, TLS, session=<YZjL44JD4rrDsXE4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.38.145
country_id: 953987
description:
Nov 14 05:45:45 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.64.38.145, lip=66.85.158.91, TLS, session=<CQ355IJDRaRmQCaR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.48
country_id: 3625428
description:
2025-11-14 05:47:36 dovecot_login authenticator failed for (ADMIN) [95.181.237.48]:41906: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.52
country_id: 1733045
description:
2025-11-14 05:55:58 dovecot_login authenticator failed for ([49.124.149.52]) [49.124.149.52]:50602: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.52.132
country_id: 6252001
description:
[2025-11-14 05:56:39 +0530] info [whostmgrd] 172.58.52.132 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.164.33.133
country_id: 6252001
description:
[2025-11-14 05:57:03 +0530] info [whostmgrd] 184.164.33.133 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.80.71.87
country_id: 1861060
description:
2025-11-14 05:56:30 dovecot_login authenticator failed for 58x80x71x87.ap58.ftth.ucom.ne.jp [58.80.71.87]:46464: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.241.213.133
country_id: 3895114
description:
[2025-11-14 05:58:17 +0530] info [whostmgrd] 201.241.213.133 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-11-14 05:58:36 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:57347: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.203.231.87
country_id: 6252001
description:
[2025-11-14 05:59:59 +0530] info [whostmgrd] 170.203.231.87 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Nov 14 06:00:35 host2 sshd[3386817]: Disconnected from invalid user test 93.113.63.124 port 57446 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 93.113.63.124
country_id: 298795
description:
Nov 14 06:04:21 host2 sshd[3389014]: Disconnected from invalid user nam 93.113.63.124 port 37378 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 201.182.148.37
country_id: 3658394
description:
Nov 14 06:04:49 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=201.182.148.37, lip=66.85.158.91, TLS, session=<Kh02KYNDeuPJtpQl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 171.22.234.211
country_id: 3175395
description:
Nov 14 06:05:06 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=171.22.234.211, lip=66.85.158.91, TLS, session=<KBJXKoNDZYKrFurT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 93.113.63.124
country_id: 298795
description:
Nov 14 06:05:32 host2 sshd[3389744]: Disconnected from invalid user foundry 93.113.63.124 port 53310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 06:06:47 host2 sshd[3390437]: Disconnected from invalid user  2.57.121.112 port 62955 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.190
country_id: 2510769
description:
2025-11-14 06:07:18 dovecot_login authenticator failed for (ADMIN) [212.102.49.190]:59307: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.238
country_id: 6252001
description:
Nov 14 06:07:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.238, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZBoRNYNDYtjG6xju>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.116
country_id: 1643084
description:
Nov 14 06:14:44 host2 sshd[3394962]: Invalid user cloudtourssrilan_travel from 182.8.225.116 port 13367


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.116
country_id: 1643084
description:
[2025-11-14 06:14:45 +0530] info [cpaneld] 182.8.225.116 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.8.251.154
country_id: 3469034
description:
Nov 14 06:14:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.8.251.154, lip=66.85.158.91, TLS, session=<fTbvS4ND8p+xCPua>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 182.8.225.116
country_id: 1643084
description:
Nov 14 06:14:43 host2 pure-ftpd[3394959]: (?@182.8.225.116) [INFO] New connection from 182.8.225.116


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-14 06:15:05 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:52661: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.170.204
country_id: 3175395
description:
Nov 14 06:14:49 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=185.15.170.204, lip=66.85.158.91, TLS, session=<7nEWTYNDQ+S5D6rM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-14 06:15:27 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:45422: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.8.225.116
country_id: 1643084
description:
[2025-11-14 06:16:20 +0530] info [cpaneld] 182.8.225.116 - cloudtourssrilan_travel "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cloudtourssrilan_travel (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.8.225.116
country_id: 1643084
description:
Nov 14 06:16:19 host2 sshd[3395878]: Invalid user cloudtourssrilan_travel from 182.8.225.116 port 43936


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 182.8.225.116
country_id: 1643084
description:
Nov 14 06:16:17 host2 pure-ftpd[3395874]: (?@182.8.225.116) [INFO] New connection from 182.8.225.116


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.46.147.157
country_id: 6252001
description:
[2025-11-14 06:18:05 +0530] info [whostmgrd] 99.46.147.157 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.113.20.208
country_id: 3895114
description:
[2025-11-14 06:22:26 +0530] info [whostmgrd] 191.113.20.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.68.122.214
country_id: 953987
description:
[2025-11-14 06:25:38 +0530] info [whostmgrd] 102.68.122.214 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.25.40
country_id: 3686110
description:
[2025-11-14 06:25:39 +0530] info [whostmgrd] 181.189.25.40 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.121
country_id: 6252001
description:
Nov 14 06:25:53 host2 pure-ftpd[3400539]: (?@66.132.153.121) [INFO] New connection from 66.132.153.121


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.37.29.135
country_id: 6252001
description:
[2025-11-14 06:28:03 +0530] info [cpaneld] 76.37.29.135 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.231.133.99
country_id: 6252001
description:
[2025-11-14 06:28:21 +0530] info [whostmgrd] 104.231.133.99 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.198.169.217
country_id: 6252001
description:
[2025-11-14 06:28:36 +0530] info [cpaneld] 47.198.169.217 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.7.181.190
country_id: 3469034
description:
[2025-11-14 06:28:57 +0530] info [whostmgrd] 177.7.181.190 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 76.39.146.78
country_id: 6252001
description:
[2025-11-14 06:28:12 +0530] info [cpaneld] 76.39.146.78 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.211.154.151
country_id: 6252001
description:
[2025-11-14 06:28:14 +0530] info [cpaneld] 72.211.154.151 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.49.42
country_id: 6252001
description:
[2025-11-14 06:28:24 +0530] info [cpaneld] 172.58.49.42 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.13.127.160
country_id: 6252001
description:
[2025-11-14 06:28:47 +0530] info [cpaneld] 172.13.127.160 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.100.134.90
country_id: 3658394
description:
[2025-11-14 06:31:22 +0530] info [whostmgrd] 157.100.134.90 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.94.249.18
country_id: 3469034
description:
[2025-11-14 06:31:32 +0530] info [whostmgrd] 177.94.249.18 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.128.110.158
country_id: 953987
description:
Nov 14 06:32:42 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.128.110.158, lip=66.85.158.91, TLS, session=<FfLajINDvp1mgG6e>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 5.194.121.154
country_id: 290557
description:
[2025-11-14 06:32:10 +0530] info [whostmgrd] 5.194.121.154 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 217.26.178.70
country_id: 3175395
description:
Nov 14 06:32:20 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=217.26.178.70, lip=66.85.158.91, TLS, session=<Y+20i4ND0ITZGrJG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.177.238.104
country_id: 290557
description:
[2025-11-14 06:33:45 +0530] info [whostmgrd] 109.177.238.104 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.215.235.116
country_id: 1831722
description:
2025-11-14 06:34:01 dovecot_login authenticator failed for (ADMIN) [188.215.235.116]:33423: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.97.180.94
country_id: 3469034
description:
Nov 14 06:34:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=138.97.180.94, lip=66.85.158.91, TLS, session=<dXUfkoNDTpOKYbRe>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.15.171.155
country_id: 3175395
description:
Nov 14 06:34:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.15.171.155, lip=66.85.158.91, TLS, session=<8r9Dk4NDRby5D6ub>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.108.12.155
country_id: 3439705
description:
[2025-11-14 06:36:37 +0530] info [whostmgrd] 190.108.12.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.153.19.215
country_id: 3625428
description:
[2025-11-14 06:38:14 +0530] info [whostmgrd] 190.153.19.215 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.168
country_id: 2635167
description:
Nov 14 06:39:31 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=185.247.137.168, lip=66.85.158.92, TLS, session=<bERbpoND36G594mo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.153.181.80
country_id: 1861060
description:
2025-11-14 06:45:56 dovecot_login authenticator failed for m106153181080.v4.enabler.ne.jp [106.153.181.80]:41674: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.222.177.146
country_id: 6252001
description:
2025-11-14 06:46:10 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:50659: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 06:49:14 host2 sshd[3415558]: Disconnected from invalid user admin 2.57.121.112 port 17397 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.234.237
country_id: 6252001
description:
2025-11-14 06:52:08 dovecot_login authenticator failed for (ADMIN) [102.129.234.237]:43695: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 163.182.103.137
country_id: 6252001
description:
[2025-11-14 06:53:56 +0530] info [cpaneld] 163.182.103.137 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.82.84.201
country_id: 6252001
description:
[2025-11-14 06:54:05 +0530] info [cpaneld] 161.82.84.201 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.127
country_id: 6252001
description:
Nov 14 06:55:31 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.127, lip=66.85.158.91, TLS: Connection closed, session=<fcag34NDNAtChJl/>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.205.235.112
country_id: 6252001
description:
[2025-11-14 06:59:22 +0530] info [whostmgrd] 107.205.235.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.57.6.12
country_id: 6252001
description:
[2025-11-14 06:59:30 +0530] info [cpaneld] 68.57.6.12 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.149.84.178
country_id: 6252001
description:
[2025-11-14 06:59:40 +0530] info [cpaneld] 99.149.84.178 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.194.152.122
country_id: 6252001
description:
[2025-11-14 06:59:49 +0530] info [cpaneld] 38.194.152.122 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.106.176.236
country_id: 6252001
description:
[2025-11-14 06:59:10 +0530] info [cpaneld] 174.106.176.236 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.19.113.82
country_id: 6252001
description:
[2025-11-14 06:59:14 +0530] info [cpaneld] 45.19.113.82 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.194.173.61
country_id: 6252001
description:
[2025-11-14 06:59:19 +0530] info [cpaneld] 162.194.173.61 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.117.191.173
country_id: 6252001
description:
[2025-11-14 06:59:59 +0530] info [cpaneld] 99.117.191.173 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 147.219.2.94
country_id: 6252001
description:
[2025-11-14 07:00:09 +0530] info [cpaneld] 147.219.2.94 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.130.124.132
country_id: 6252001
description:
[2025-11-14 07:00:15 +0530] info [cpaneld] 72.130.124.132 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.2.221.191
country_id: 6252001
description:
[2025-11-14 06:59:55 +0530] info [cpaneld] 73.2.221.191 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.152.225.144
country_id: 6252001
description:
[2025-11-14 07:00:01 +0530] info [cpaneld] 47.152.225.144 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.56.27.181
country_id: 6252001
description:
[2025-11-14 07:00:03 +0530] info [whostmgrd] 172.56.27.181 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.72.193.67
country_id: 6252001
description:
[2025-11-14 07:00:20 +0530] info [cpaneld] 173.72.193.67 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 07:03:31 host2 sshd[3425446]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.39.5.72
country_id: 102358
description:
[2025-11-14 07:03:44 +0530] info [whostmgrd] 51.39.5.72 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.194.153.188
country_id: 2510769
description:
[2025-11-14 07:05:59 +0530] info [whostmgrd] 213.194.153.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.30.1.241
country_id: 6252001
description:
[2025-11-14 07:07:10 +0530] info [whostmgrd] 98.30.1.241 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-14 07:13:45 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:56276: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 07:14:21 host2 sshd[3432541]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.22
country_id: 6252001
description:
Nov 14 07:23:21 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.22, lip=66.85.158.91, TLS handshaking: Connection closed, session=<5qUqQ4RD1YHDuEwW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.18
country_id: 6252001
description:
Nov 14 07:23:32 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=195.184.76.18, lip=66.85.158.91, TLS: Connection closed, session=<xLXTQ4RDO+rDuEwS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.112
country_id: 6252001
description:
Nov 14 07:23:41 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.112, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<e7laRIRD9ebDuExw>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.20
country_id: 6252001
description:
Nov 14 07:23:44 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.20, lip=66.85.158.91, TLS: Connection closed, session=<L6yJRIRDIYHDuEwU>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 07:23:58 host2 sshd[3438413]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.44.96.171
country_id: 3469034
description:
Nov 14 07:23:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=177.44.96.171, lip=66.85.158.91, TLS, session=<oLA+RIRDxdKxLGCr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.148.225
country_id: 690791
description:
Nov 14 07:24:15 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=37.221.148.225, lip=66.85.158.91, TLS, session=</iZqRYRDheMl3ZTh>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 07:26:14 host2 sshd[3439537]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.38.199.53
country_id: 6252001
description:
[2025-11-14 07:26:34 +0530] info [cpaneld] 24.38.199.53 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.252.220.111
country_id: 6252001
description:
[2025-11-14 07:26:36 +0530] info [cpaneld] 195.252.220.111 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.225.244.3
country_id: 1282988
description:
[2025-11-14 07:26:38 +0530] info [whostmgrd] 103.225.244.3 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 67.144.35.157
country_id: 6252001
description:
[2025-11-14 07:26:47 +0530] info [cpaneld] 67.144.35.157 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.149.160.92
country_id: 6252001
description:
[2025-11-14 07:26:49 +0530] info [whostmgrd] 47.149.160.92 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.50.240.221
country_id: 6252001
description:
[2025-11-14 07:26:54 +0530] info [cpaneld] 104.50.240.221 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.17.72.31
country_id: 6252001
description:
[2025-11-14 07:27:00 +0530] info [cpaneld] 47.17.72.31 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2025-11-14 07:27:30 dovecot_plain authenticator failed for c-24-98-45-238.hsd1.ga.comcast.net (ovenite) [24.98.45.238]:49966: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.223.22.105
country_id: 6252001
description:
[2025-11-14 07:26:53 +0530] info [cpaneld] 108.223.22.105 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.121.161.67
country_id: 6252001
description:
[2025-11-14 07:28:30 +0530] info [whostmgrd] 23.121.161.67 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.96.97.195
country_id: 290557
description:
[2025-11-14 07:30:28 +0530] info [whostmgrd] 86.96.97.195 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.114.180.81
country_id: 587116
description:
[2025-11-14 07:31:46 +0530] info [whostmgrd] 37.114.180.81 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.156.212
country_id: 6252001
description:
Nov 14 07:32:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.156.212, lip=66.85.158.92, TLS handshaking: Connection closed, session=<54UfYoRD6utAPpzU>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.137.80.146
country_id: 2510769
description:
[2025-11-14 07:32:33 +0530] info [whostmgrd] 2.137.80.146 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.202.156.153
country_id: 6252001
description:
[2025-11-14 07:32:44 +0530] info [cpaneld] 73.202.156.153 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.15.239.37
country_id: 6252001
description:
[2025-11-14 07:32:47 +0530] info [cpaneld] 73.15.239.37 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.100.226.165
country_id: 6252001
description:
[2025-11-14 07:33:09 +0530] info [whostmgrd] 97.100.226.165 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.82.89.25
country_id: 6252001
description:
[2025-11-14 07:33:24 +0530] info [whostmgrd] 71.82.89.25 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.65.160.55
country_id: 6252001
description:
[2025-11-14 07:33:32 +0530] info [cpaneld] 73.65.160.55 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.199.250.232
country_id: 6252001
description:
[2025-11-14 07:33:35 +0530] info [cpaneld] 73.199.250.232 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.102.64.229
country_id: 6252001
description:
[2025-11-14 07:33:38 +0530] info [cpaneld] 73.102.64.229 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.44.241.87
country_id: 6252001
description:
[2025-11-14 07:33:54 +0530] info [whostmgrd] 99.44.241.87 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 207.248.222.22
country_id: 3895114
description:
[2025-11-14 07:34:09 +0530] info [whostmgrd] 207.248.222.22 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.102.232.9
country_id: 3057568
description:
2025-11-14 07:35:22 dovecot_login authenticator failed for (ADMIN) [149.102.232.9]:27582: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 132.196.42.124
country_id: 6252001
description:
Nov 14 07:35:22 host2 pure-ftpd[3444896]: (?@132.196.42.124) [INFO] New connection from 132.196.42.124


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.228
country_id: 1880251
description:
Nov 14 07:35:37 host2 sshd[3444983]: Disconnected from invalid user kafka 45.78.206.228 port 51516 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.204.62.47
country_id: 3469034
description:
[2025-11-14 07:37:23 +0530] info [whostmgrd] 186.204.62.47 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 07:38:09 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=217.119.139.27, lip=66.85.158.91, session=<XocZeIRDpoDZd4sb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.185.76.118
country_id: 130758
description:
Nov 14 07:38:10 host2 sshd[3446010]: Disconnected from invalid user guo 130.185.76.118 port 45190 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.180.165.160
country_id: 3469034
description:
[2025-11-14 07:39:05 +0530] info [whostmgrd] 187.180.165.160 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.185.76.118
country_id: 130758
description:
Nov 14 07:39:58 host2 sshd[3447108]: Disconnected from invalid user jj 130.185.76.118 port 34466 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.55.158.171
country_id: 3865483
description:
[2025-11-14 07:40:19 +0530] info [whostmgrd] 190.55.158.171 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 130.185.76.118
country_id: 130758
description:
Nov 14 07:42:29 host2 sshd[3448731]: Disconnected from invalid user rstudio 130.185.76.118 port 50034 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 117.235.55.152
country_id: 1269750
description:
[2025-11-14 07:42:34 +0530] info [whostmgrd] 117.235.55.152 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.185.76.118
country_id: 130758
description:
Nov 14 07:43:43 host2 sshd[3449310]: Disconnected from invalid user st 130.185.76.118 port 44494 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Nov 14 07:43:25 host2 sshd[3449174]: Disconnected from invalid user ossuser 103.56.30.33 port 32650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.30.33
country_id: 1269750
description:
Nov 14 07:44:49 host2 sshd[3450508]: Disconnected from invalid user hunter 103.56.30.33 port 26142 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.158.127.31
country_id: 2017370
description:
[2025-11-14 07:45:43 +0530] info [whostmgrd] 146.158.127.31 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.45.133
country_id: 6252001
description:
[2025-11-14 07:45:41 +0530] info [whostmgrd] 98.97.45.133 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.174.239.61
country_id: 3469034
description:
[2025-11-14 07:45:04 +0530] info [whostmgrd] 45.174.239.61 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 130.185.76.118
country_id: 130758
description:
Nov 14 07:45:06 host2 sshd[3450881]: Disconnected from invalid user git 130.185.76.118 port 56076 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.56.30.33
country_id: 1269750
description:
Nov 14 07:46:15 host2 sshd[3452025]: Disconnected from invalid user dan 103.56.30.33 port 23232 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 174.175.226.208
country_id: 6252001
description:
[2025-11-14 07:46:48 +0530] info [whostmgrd] 174.175.226.208 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 184.98.88.203
country_id: 6252001
description:
[2025-11-14 07:46:54 +0530] info [whostmgrd] 184.98.88.203 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 178.175.142.134
country_id: 617790
description:
Nov 14 07:47:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=178.175.142.134, lip=66.85.158.91, session=<+Q3al4RDcMayr46G>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.153
country_id: 2993457
description:
Nov 14 07:47:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=95.181.233.153, lip=66.85.158.91, TLS handshaking: Connection closed, session=<hWTZl4RDupRftemZ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 95.181.233.150
country_id: 2993457
description:
Nov 14 07:47:04 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 6 secs): user=<>, rip=95.181.233.150, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TX34l4RDIqVftemW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 07:47:35 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:59976: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.129
country_id: 6252001
description:
Nov 14 07:48:42 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.129, lip=66.85.158.92, TLS handshaking: Connection closed, session=<uT7GnYRDhI5ChJmB>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.232.214.145
country_id: 3175395
description:
[2025-11-14 07:50:23 +0530] info [whostmgrd] 95.232.214.145 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 14 07:52:31 host2 sshd[3455542]: Disconnected from invalid user mongod 103.154.77.48 port 40942 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-14 07:52:40 dovecot_login authenticator failed for (49.206.201.253.actcorp.in) [49.206.201.253]:48710: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.180
country_id: 921929
description:
2025-11-14 07:52:57 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:13573: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.150.195.172
country_id: 6252001
description:
Nov 14 07:53:31 host2 pure-ftpd[3456287]: (?@20.150.195.172) [INFO] New connection from 20.150.195.172


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 14 07:55:10 host2 sshd[3458240]: Disconnected from invalid user naveen 103.154.77.48 port 36832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 07:55:33 host2 sshd[3458426]: Disconnected from invalid user ubnt 2.57.121.112 port 62943 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 14 07:56:21 host2 sshd[3458969]: Disconnected from invalid user elasticsearch 103.154.77.48 port 34770 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.3.213
country_id: 2661886
description:
2025-11-14 07:57:52 dovecot_login authenticator failed for (ADMIN) [46.246.3.213]:8497: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.180.231.157
country_id: 3469034
description:
[2025-11-14 07:56:57 +0530] info [whostmgrd] 187.180.231.157 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.154.77.48
country_id: 1643084
description:
Nov 14 07:57:36 host2 sshd[3459679]: Disconnected from invalid user steam 103.154.77.48 port 60940 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 155.94.170.106
country_id: 6252001
description:
Nov 14 07:58:22 host2 sshd[3460101]: Disconnected from invalid user barbara 155.94.170.106 port 47476 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.148.128.22
country_id: 3595528
description:
[2025-11-14 07:58:50 +0530] info [whostmgrd] 190.148.128.22 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.228
country_id: 1880251
description:
Nov 14 07:59:14 host2 sshd[3460846]: Disconnected from invalid user cacti 45.78.206.228 port 45350 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.153.132.112
country_id: 1269750
description:
Nov 14 07:59:41 host2 sshd[3461024]: Disconnected from invalid user stephen 20.153.132.112 port 46682 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.73
country_id: 6252001
description:
Nov 14 07:59:55 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.73, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JmzrxYRD5sjN0h9J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.206.228
country_id: 1880251
description:
Nov 14 08:01:42 host2 sshd[3462475]: Disconnected from invalid user jj 45.78.206.228 port 57352 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.22.167.1
country_id: 3658394
description:
[2025-11-14 08:00:54 +0530] info [whostmgrd] 171.22.167.1 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 99.35.14.155
country_id: 6252001
description:
[2025-11-14 08:02:10 +0530] info [whostmgrd] 99.35.14.155 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 08:02:16 host2 sshd[3462801]: Disconnected from invalid user user 2.57.121.25 port 33217 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 08:02:18 host2 sshd[3462864]: Disconnected from invalid user  2.57.121.112 port 61847 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.136.89.12
country_id: 3865483
description:
[2025-11-14 08:02:32 +0530] info [whostmgrd] 190.136.89.12 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.153.132.112
country_id: 1269750
description:
Nov 14 08:03:49 host2 sshd[3464113]: Disconnected from invalid user flash 20.153.132.112 port 46398 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.191.114.186
country_id: 6252001
description:
[2025-11-14 08:03:28 +0530] info [whostmgrd] 75.191.114.186 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.156.98.112
country_id: 1269750
description:
[2025-11-14 08:04:11 +0530] info [whostmgrd] 49.156.98.112 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.167
country_id: 6252001
description:
Nov 14 08:04:02 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.132.167, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<21+g1IRDWdKTuYSn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.17.233.57
country_id: 6252001
description:
[2025-11-14 08:05:30 +0530] info [cpaneld] 45.17.233.57 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.220.21.162
country_id: 6252001
description:
[2025-11-14 08:05:34 +0530] info [cpaneld] 47.220.21.162 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.94.199.25
country_id: 6252001
description:
[2025-11-14 08:05:42 +0530] info [whostmgrd] 71.94.199.25 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.241.114.91
country_id: 6252001
description:
[2025-11-14 08:06:15 +0530] info [cpaneld] 96.241.114.91 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.207.116.253
country_id: 6252001
description:
[2025-11-14 08:06:33 +0530] info [cpaneld] 75.207.116.253 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.43.243.240
country_id: 6252001
description:
[2025-11-14 08:05:55 +0530] info [whostmgrd] 68.43.243.240 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.37.89.224
country_id: 6252001
description:
[2025-11-14 08:06:06 +0530] info [cpaneld] 136.37.89.224 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 188.3.3.188
country_id: 298795
description:
[2025-11-14 08:06:16 +0530] info [whostmgrd] 188.3.3.188 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.167
country_id: 6252001
description:
Nov 14 08:09:28 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.167, lip=66.85.158.92, TLS, session=<9xYT6IRDruGTuYSn>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.123.22
country_id: 6252001
description:
Nov 14 08:09:42 host2 sshd[3467236]: Disconnected from invalid user ec2-user 198.12.123.22 port 52320 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.223
country_id: 6252001
description:
Nov 14 08:10:23 host2 pure-ftpd[3467791]: (?@198.235.24.223) [INFO] New connection from 198.235.24.223


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.115
country_id: 2635167
description:
Nov 14 08:11:58 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=35.203.210.115, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<pnb78IRDg9Ijy9Jz>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.123.22
country_id: 6252001
description:
Nov 14 08:12:38 host2 sshd[3469012]: Disconnected from invalid user sftpuser 198.12.123.22 port 44682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 08:12:42 host2 sshd[3468998]: Disconnected from invalid user magdalena 62.60.131.157 port 16368 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.124.49.49
country_id: 2542007
description:
[2025-11-14 08:12:56 +0530] info [whostmgrd] 196.124.49.49 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.115
country_id: 2635167
description:
Nov 14 08:17:55 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.115, lip=66.85.158.91, TLS, session=<w7ZMBoVDKOYjy9Jz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.56.86
country_id: 6252001
description:
2025-11-14 08:19:27 dovecot_login authenticator failed for (ADMIN) [173.244.56.86]:7838: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.123.22
country_id: 6252001
description:
Nov 14 08:19:30 host2 sshd[3473285]: Disconnected from invalid user xyx 198.12.123.22 port 52032 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.235.169.135
country_id: 798544
description:
[2025-11-14 08:20:23 +0530] info [whostmgrd] 178.235.169.135 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.89.220.58
country_id: 3469034
description:
[2025-11-14 08:22:25 +0530] info [whostmgrd] 189.89.220.58 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.123.22
country_id: 6252001
description:
Nov 14 08:25:49 host2 sshd[3477140]: Disconnected from invalid user username1 198.12.123.22 port 44310 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.178.110.152
country_id: 732800
description:
Nov 14 08:28:14 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.178.110.152, lip=66.85.158.91, session=<FMgtK4VDQNrDsm6Y>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.178.110.152
country_id: 732800
description:
Nov 14 08:28:13 host2 pure-ftpd[3478581]: (?@195.178.110.152) [INFO] New connection from 195.178.110.152


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.77.50.10
country_id: 3175395
description:
Nov 14 08:32:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.77.50.10, lip=66.85.158.91, TLS, session=<3L2nN4VDXLC5TTIK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.219.201.67
country_id: 953987
description:
Nov 14 08:32:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<jagath.peiris>, method=PLAIN, rip=102.219.201.67, lip=66.85.158.91, TLS, session=<m6ffOIVDjbFm28lD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.95
country_id: 1269750
description:
Nov 14 08:36:59 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=103.18.166.95, lip=66.85.158.91, TLS, session=<i0FQSYVDV5pnEqZf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.255.212.105
country_id: 732800
description:
Nov 14 08:37:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.255.212.105, lip=66.85.158.91, TLS, session=<3F2QSoVDQOa5/9Rp>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 08:39:13 host2 sshd[3484616]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-11-14 08:40:10 dovecot_plain authenticator failed for (ouffs) [2.55.122.202]:38535: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
country_id: 732800
description:
2025-11-14 08:40:13 dovecot_plain authenticator failed for (foonism) [92.62.243.174]:58505: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.60.67
country_id: 3017382
description:
2025-11-14 08:41:03 dovecot_login authenticator failed for ip67.ip-91-121-60.eu (ADMIN) [91.121.60.67]:37960: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.245
country_id: 2635167
description:
Nov 14 08:45:18 host2 dovecot[43647]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=87.236.176.245, lip=66.85.158.91, TLS, session=<iTk0aIVDD61X7LD1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.162
country_id: 2635167
description:
Nov 14 08:45:37 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.162, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<MJ5baYVD28FX7LCi>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.159
country_id: 2635167
description:
Nov 14 08:46:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.159, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<Jb9Xa4VDcYm594mf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.118.34.226
country_id: 1269750
description:
Nov 14 08:46:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr>, method=PLAIN, rip=45.118.34.226, lip=66.85.158.91, TLS, session=<yZwMa4VDe9ItdiLi>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Nov 14 08:46:42 host2 sshd[3491025]: Disconnected from invalid user test1 198.12.114.232 port 47848 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.171
country_id: 2635167
description:
Nov 14 08:46:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.171, lip=66.85.158.91, TLS handshaking: Connection closed, session=<StRSbYVDM5W594mr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.105.163
country_id: 798544
description:
Nov 14 08:46:03 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=178.219.105.163, lip=66.85.158.91, TLS, session=<PTDpaYVDpd2y22mj>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.164
country_id: 2635167
description:
Nov 14 08:47:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.164, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<wDdOb4VDkau594mk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.155
country_id: 2635167
description:
Nov 14 08:47:50 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.155, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<A7FJcYVDZ5RX7LCb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.158
country_id: 2635167
description:
Nov 14 08:48:23 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.158, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<VxhDc4VDVaO594me>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 158.51.124.122
country_id: 6252001
description:
Nov 14 08:49:03 host2 sshd[3492592]: Disconnected from invalid user user1 158.51.124.122 port 44356 [preauth]


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 121.127.245.132
country_id: 1819730
description:
Denial of Service (DoS) attack was discovered from 121.127.245.132: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.151
country_id: 2635167
description:
Nov 14 08:49:34 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=185.247.137.151, lip=66.85.158.91, TLS handshaking: Connection closed, session=<3RJ0d4VDBbO594mX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.181
country_id: 2635167
description:
Nov 14 08:48:57 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.181, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<JltAdYVDS6VX7LC1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.166
country_id: 2635167
description:
Nov 14 08:50:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.166, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<15BteYVDQ6RX7LCm>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Nov 14 08:50:16 host2 sshd[3493285]: Disconnected from invalid user wx 198.12.114.232 port 36458 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.159
country_id: 2635167
description:
Nov 14 08:50:40 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.159, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<Hfxoe4VDlZJX7LCf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.12.114.232
country_id: 6252001
description:
Nov 14 08:51:38 host2 sshd[3494042]: Disconnected from invalid user admin 198.12.114.232 port 43858 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 08:55:16 host2 sshd[3496627]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Nov 14 08:55:39 host2 sshd[3496794]: Disconnected from invalid user zzl 198.12.114.232 port 49842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 08:56:45 host2 sshd[3497349]: Disconnected from invalid user user 2.57.121.25 port 21543 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.12.114.232
country_id: 6252001
description:
Nov 14 08:57:09 host2 sshd[3497564]: Disconnected from invalid user krish 198.12.114.232 port 48098 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.24
country_id: 1880251
description:
Nov 14 08:59:24 host2 sshd[3499055]: Disconnected from invalid user prowlarr 45.78.207.24 port 57884 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 189.127.38.183
country_id: 3469034
description:
Nov 14 08:59:25 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=189.127.38.183, lip=66.85.158.91, TLS, session=<HUpzmYVDcN29fya3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.85.63.63
country_id: 3469034
description:
Nov 14 08:59:44 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr>, method=PLAIN, rip=177.85.63.63, lip=66.85.158.91, TLS, session=<aajQmoVDHIWxVT8/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-14 09:01:31 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:45994: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.220.130.169
country_id: 6252001
description:
[2025-11-14 09:03:29 +0530] info [cpaneld] 71.220.130.169 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.236
country_id: 798544
description:
2025-11-14 09:03:36 dovecot_login authenticator failed for (ADMIN) [138.199.59.236]:52018: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.211.42.208
country_id: 6252001
description:
[2025-11-14 09:03:52 +0530] info [cpaneld] 108.211.42.208 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.27.63.162
country_id: 6252001
description:
[2025-11-14 09:04:02 +0530] info [whostmgrd] 108.27.63.162 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 64.255.80.246
country_id: 6252001
description:
[2025-11-14 09:04:08 +0530] info [cpaneld] 64.255.80.246 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.156
country_id: 3017382
description:
Nov 14 09:04:08 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=91.231.89.156, lip=66.85.158.91, TLS handshaking: Connection closed, session=<YQ2Qq4VDachb51mc>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.153
country_id: 3017382
description:
Nov 14 09:04:21 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 13 secs): user=<>, rip=91.231.89.153, lip=66.85.158.91, TLS: Connection closed, session=<AVJerIVDE9Bb51mZ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 97.170.225.85
country_id: 6252001
description:
[2025-11-14 09:04:23 +0530] info [cpaneld] 97.170.225.85 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.153
country_id: 1733045
description:
2025-11-14 09:04:23 dovecot_login authenticator failed for ([49.124.154.153]) [49.124.154.153]:60306: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.89.9.190
country_id: 6252001
description:
[2025-11-14 09:04:00 +0530] info [cpaneld] 74.89.9.190 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.133.147.229
country_id: 6252001
description:
[2025-11-14 09:04:21 +0530] info [cpaneld] 72.133.147.229 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.248
country_id: 3017382
description:
Nov 14 09:04:34 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.248, lip=66.85.158.91, TLS: Connection closed, session=<OFQirYVDV5xb51n4>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 09:04:54 host2 sshd[3502497]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-11-14 09:04:58 dovecot_login authenticator failed for ([72.239.139.162]) [72.239.139.162]:35082: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:05:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<jz/FsIVDCMADjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 14 09:05:39 host2 sshd[3503125]: Disconnected from invalid user magdalena 62.60.131.157 port 18745 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-14 09:06:36 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:57428: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-14 09:06:44 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:48228: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:06:09 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<xr7IsoVDgo0DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:07:10 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<ypBktoVD/qoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.20
country_id: 6252001
description:
Nov 14 09:07:26 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.65.195.20, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<Jgtht4VD3O0UQcMU>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.207.24
country_id: 1880251
description:
Nov 14 09:08:59 host2 sshd[3505373]: Disconnected from invalid user nguyen 45.78.207.24 port 40622 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-11-14 09:09:18 dovecot_plain authenticator failed for (overs) [65.20.129.67]:48548: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:09:25 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<F9J5voVDEo8DjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:09:55 host2 dovecot[43647]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS, session=<7QhAwIVDfuoDjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:11:05 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QAVyxIVDVMgDjyE/>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.24
country_id: 1880251
description:
Nov 14 09:11:28 host2 sshd[3506920]: Disconnected from invalid user petra 45.78.207.24 port 42554 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:11:57 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.143.33.63, lip=66.85.158.92, TLS handshaking: Connection closed, session=<vZOKx4VDWL8DjyE/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.230.228.16
country_id: 6252001
description:
2025-11-14 09:12:31 dovecot_plain authenticator failed for c-71-230-228-16.hsd1.de.comcast.net (poseeler) [71.230.228.16]:58770: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.143.33.63
country_id: 6252001
description:
Nov 14 09:13:01 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.143.33.63, lip=66.85.158.91, TLS, session=<XAVey4VD6uADjyE/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 128.203.202.233
country_id: 6251999
description:
Nov 14 09:18:51 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=128.203.202.233, lip=66.85.158.91, TLS, session=<rr0x4IVDAraAy8rp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.214.137.39
country_id: 2510769
description:
Nov 14 09:19:48 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=185.214.137.39, lip=66.85.158.91, TLS, session=<0Syb4oVDXaW51okn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.0.142.98
country_id: 3865483
description:
Nov 14 09:20:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris>, method=PLAIN, rip=186.0.142.98, lip=66.85.158.91, TLS, session=<W0LA44VDT7+6AI5i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.240.205.57
country_id: 6252001
description:
2025-11-14 09:23:56 dovecot_login authenticator failed for (ADMIN) [151.240.205.57]:35240: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.135
country_id: 6252001
description:
Nov 14 09:35:12 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.135, lip=66.85.158.91, session=<9XeyGoZDXvyTuYSH>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:35:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<fl1mHYZDqt4DhpQ7>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 14 09:37:09 host2 sshd[3524239]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:37:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Qz8sIYZDUtIDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:37:57 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<CjiJJIZDuLgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:39:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<H0ElKoZDcosDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:40:16 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<8UvTLIZDsIkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:40:58 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Gn1HL4ZDGrUDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 09:43:13 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<d5pcN4ZDcKUDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.26
country_id: 798549
description:
2025-11-14 09:52:08 dovecot_login authenticator failed for (ADMIN) [143.244.54.26]:58520: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-11-14 09:55:25 dovecot_login authenticator failed for ([196.189.124.218]) [196.189.124.218]:56718: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2025-11-14 09:55:50 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:40696: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-14 09:55:01 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:52326: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-11-14 09:55:11 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:43743: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 09:57:52 host2 sshd[3544823]: Disconnected from invalid user admin 2.57.121.112 port 61687 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 09:58:42 host2 sshd[3545475]: Disconnected from invalid user admin 2.57.121.112 port 53805 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 195.88.114.188
country_id: 798544
description:
Nov 14 10:05:49 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=195.88.114.188, lip=66.85.158.91, TLS, session=<CsIrh4ZDEbXDWHK8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.83.27.168
country_id: 6252001
description:
Nov 14 10:06:07 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.83.27.168, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<xBhDiYZDjp4UUxuo>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 102.64.35.28
country_id: 953987
description:
Nov 14 10:06:11 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<587hr>, method=PLAIN, rip=102.64.35.28, lip=66.85.158.91, TLS, session=<bKVTiIZDXtpmQCMc>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-14 10:06:25 dovecot_login authenticator failed for (qf7Erk18b6) [141.98.11.48]:61015: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-11-14 10:06:40 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:47240: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.61
country_id: 6252001
description:
2025-11-14 10:06:55 dovecot_login authenticator failed for ([24.121.1.61]) [24.121.1.61]:57475: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-14 10:07:04 dovecot_login authenticator failed for (Y477NyvgWp) [141.98.11.48]:52091: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.48
country_id: 597427
description:
2025-11-14 10:10:25 dovecot_login authenticator failed for (FgMQafH8Xv) [141.98.11.48]:60079: 535 Incorrect authentication data


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.124.118
country_id: 6252001
description:
Nov 14 10:10:29 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=40.76.124.118, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<obramIZDZqsoTHx2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:16:43 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<1yEhr4ZDdroDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:17:12 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<e6HisIZD/OgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:18:12 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<gaJ4tIZDUqgDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:19:17 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS, session=<JBJQuIZD7uQDhpQ7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 217.119.139.27
country_id: 2017370
description:
Nov 14 10:19:24 host2 pure-ftpd[3565140]: (?@217.119.139.27) [INFO] New connection from 217.119.139.27


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.188.77
country_id: 3175395
description:
Nov 14 10:20:30 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=185.208.188.77, lip=66.85.158.91, TLS, session=<QbWuu4ZD98e50LxN>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:20:41 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: Connection closed, session=<L+hOvYZDiowDhpQ7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.218.239.163
country_id: 719819
description:
Nov 14 10:20:12 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=37.218.239.163, lip=66.85.158.91, TLS, session=<ihqjuoZD24Ml2u+j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:21:14 host2 dovecot[43647]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<DkBHv4ZD4JkDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 14 10:22:32 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<ysbyw4ZDVOYDhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.62
country_id: 2661886
description:
2025-11-14 10:30:23 dovecot_login authenticator failed for (ADMIN) [46.246.8.62]:3910: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.172.146
country_id: 6252001
description:
Nov 14 10:35:18 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.172.146, lip=66.85.158.92, session=<utOj8YZDbsUofKyS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.195.49
country_id: 6252001
description:
Nov 14 10:35:35 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.195.49, lip=66.85.158.91, session=<wdyh8oZDLLsUQcMx>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.25
country_id: 798549
description:
Nov 14 10:38:39 host2 sshd[3582806]: Disconnected from invalid user user 2.57.121.25 port 20665 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.21.80
country_id: 6251999
description:
2025-11-14 10:47:04 dovecot_login authenticator failed for (ADMIN) [140.228.21.80]:37373: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.67.18
country_id: 1643084
description:
2025-11-14 10:50:20 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.18]:64276: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.140.38.109
country_id: 1269750
description:
2025-11-14 10:50:40 dovecot_login authenticator failed for ([202.140.38.109]) [202.140.38.109]:40510: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.76.140
country_id: 6252001
description:
Nov 14 10:52:12 host2 sshd[3595493]: Disconnected from invalid user backupuser 104.168.76.140 port 55762 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.148
country_id: 6252001
description:
Nov 14 10:52:43 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.148, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Sh7mL4dDh9fG6xiU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 176.103.7.101
country_id: 690791
description:
Nov 14 10:57:00 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=176.103.7.101, lip=66.85.158.91, TLS, session=<BekmPodD4e2wZwdl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.76.140
country_id: 6252001
description:
Nov 14 10:57:14 host2 sshd[3599147]: Disconnected from invalid user headscale 104.168.76.140 port 41328 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.216.213.37
country_id: 933860
description:
Nov 14 10:57:22 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<jagath.peiris>, method=PLAIN, rip=41.216.213.37, lip=66.85.158.91, TLS, session=<5nBYP4dDPOUp2NUl>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.220.113.163
country_id: 130758
description:
Nov 14 11:02:56 host2 sshd[3602450]: Disconnected from invalid user cps 91.220.113.163 port 37684 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.76.140
country_id: 6252001
description:
Nov 14 11:03:57 host2 sshd[3603217]: Disconnected from invalid user chat 104.168.76.140 port 44374 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 14 11:08:36 host2 sshd[3605617]: Disconnected from invalid user noc 150.5.129.10 port 53720 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.158
country_id: 2782113
description:
2025-11-14 11:09:19 dovecot_login authenticator failed for (ADMIN) [156.146.60.158]:43889: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.76.140
country_id: 6252001
description:
Nov 14 11:09:25 host2 sshd[3606264]: Disconnected from invalid user nick 104.168.76.140 port 43774 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 91.220.113.163
country_id: 130758
description:
Nov 14 11:09:14 host2 sshd[3606174]: Disconnected from invalid user age 91.220.113.163 port 38122 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-14 11:10:14 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:50614: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 91.220.113.163
country_id: 130758
description:
Nov 14 11:10:28 host2 sshd[3607055]: Disconnected from invalid user blog 91.220.113.163 port 38236 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-14 11:10:39 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:52182: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.5.129.10
country_id: 1819730
description:
Nov 14 11:13:21 host2 sshd[3608854]: Disconnected from invalid user matin 150.5.129.10 port 36682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 14 11:14:21 host2 sshd[3609519]: Disconnected from invalid user admin 2.57.121.112 port 41699 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.172.131
country_id: 2658434
description:
Nov 14 11:14:31 host2 pure-ftpd[3609674]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.172.131
country_id: 2658434
description:
Nov 14 11:14:36 host2 pure-ftpd[3609747]: (?@35.216.172.131) [INFO] New connection from 35.216.172.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.185.231
country_id: 290557
description:
2025-11-14 11:16:59 dovecot_login authenticator failed for ([94.204.185.231]) [94.204.185.231]:33859: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.33.150
country_id: 1149361
description:
2025-11-14 11:17:11 dovecot_login authenticator failed for ([149.54.33.150]) [149.54.33.150]:45701: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-14 11:22:31 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:63947: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.49.189
country_id: 2510769
description:
2025-11-14 11:28:23 dovecot_login authenticator failed for (ADMIN) [212.102.49.189]:43220: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-14 11:32:15 dovecot_login authenticator failed for ([152.52.206.188]) [152.52.192.74]:39684: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 14 11:32:37 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.222.152.150, lip=66.85.158.92, session=<7YqdvodDLI4z3piW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.236.209.11
country_id: 6252001
description:
Nov 14 11:36:47 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=104.236.209.11, lip=66.85.158.92, session=<dCmDzYdDrpRo7NEL>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.89.76
country_id: 1880251
description:
Nov 14 11:37:45 host2 sshd[3624351]: Disconnected from invalid user cheeki 103.189.89.76 port 34252 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.189.89.76
country_id: 1880251
description:
Nov 14 11:40:45 host2 sshd[3626012]: Disconnected from invalid user ntuser 103.189.89.76 port 55826 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 188.164.195.81
country_id: 2510769
description:
Nov 14 11:40:15 host2 sshd[3625785]: Disconnected from invalid user lu 188.164.195.81 port 54854 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.164.195.81
country_id: 2510769
description:
Nov 14 11:41:27 host2 sshd[3626353]: Disconnected from invalid user alex 188.164.195.81 port 32964 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.164.195.81
country_id: 2510769
description:
Nov 14 11:43:40 host2 sshd[3627653]: Disconnected from invalid user admin 188.164.195.81 port 39134 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.189.89.76
country_id: 1880251
description:
Nov 14 11:48:37 host2 sshd[3631040]: Disconnected from invalid user sdtd 103.189.89.76 port 60890 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-11-14 11:51:05 dovecot_plain authenticator failed for (petiatand) [65.20.250.63]:36839: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-14 11:51:08 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (renestry) [87.103.126.54]:22847: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 23.180.120.243
country_id: 6252001
description:
Nov 14 11:50:12 host2 dovecot[43647]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=23.180.120.243, lip=66.85.158.91, session=<Pip0/YdDkOoXtHjz>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 23.180.120.243
country_id: 6252001
description:
Nov 14 11:50:11 host2 pure-ftpd[3632566]: (?@23.180.120.243) [INFO] New connection from 23.180.120.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.63.165
country_id: 3017382
description:
2025-11-14 11:51:28 dovecot_login authenticator failed for (ADMIN) [156.146.63.165]:7450: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.99.142.36
country_id: 2921044
description:
Nov 14 11:57:46 host2 pure-ftpd[3636852]: (?@167.99.142.36) [INFO] New connection from 167.99.142.36


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.73.219
country_id: 3469034
description:
Nov 14 11:59:52 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=187.120.73.219, lip=66.85.158.91, TLS, session=<uCoBH4hD3o+7eEnb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 207.248.113.76
country_id: 3996063
description:
Nov 14 12:00:10 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=207.248.113.76, lip=66.85.158.91, TLS, session=<GXgiIIhDaqzP+HFM>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.77.72.246
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 182.77.72.246 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.84.20
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 98.97.84.20 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.78.13
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.187.78.13 - gnetuniversals "GET /login/?login_only=1&user=gnetuniversals&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.158.40.150
country_id: 1694008
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 136.158.40.150 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.246.120
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 27.125.246.120 - gnetuniversal "GET /login/?login_only=1&user=gnetuniversal&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversal (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.242.191
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 180.75.242.191 - gnetunive "GET /login/?login_only=1&user=gnetunive&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetunive (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.19.123.24
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 186.19.123.24 - gnetuniversalscom "GET /login/?login_only=1&user=gnetuniversalscom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversalscom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.187.78.245
country_id: 99237
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 185.187.78.245 - gnetuniversa "GET /login/?login_only=1&user=gnetuniversa&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniversa (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 23.112.115.172
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 23.112.115.172 - gnetunivers "GET /login/?login_only=1&user=gnetunivers&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetunivers (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 223.181.18.42
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 223.181.18.42 - gnetuniver "GET /login/?login_only=1&user=gnetuniver&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniver (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.86.137.22
country_id: 3625428
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 82.86.137.22 - gnetuniv "GET /login/?login_only=1&user=gnetuniv&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuniv (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.200.147
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 171.225.200.147 - gnetun "GET /login/?login_only=1&user=gnetun&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetun (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.120.175.138
country_id: 690791
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 146.120.175.138 - gnetu "GET /login/?login_only=1&user=gnetu&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetu (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 79.106.127.178
country_id: 783754
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 79.106.127.178 - gnet "GET /login/?login_only=1&user=gnet&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnet (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.244.61.197
country_id: 3865483
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 190.244.61.197 - gn "GET /login/?login_only=1&user=gn&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gn (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 82.174.149.5
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 82.174.149.5 - gnetuni2 "GET /login/?login_only=1&user=gnetuni2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 107.199.23.10
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 107.199.23.10 - gnetuni "GET /login/?login_only=1&user=gnetuni&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.255.105.33
country_id: 3932488
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 38.255.105.33 - gne "GET /login/?login_only=1&user=gne&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gne (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.148.59.54
country_id: 1269750
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 202.148.59.54 - gnetuni1 "GET /login/?login_only=1&user=gnetuni1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user gnetuni1 (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.210.85
country_id: 3175395
description:
Nov 14 12:03:27 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris>, method=PLAIN, rip=94.198.210.85, lip=66.85.158.91, TLS, session=<NmPgK4hD34VextJV>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.239.36.238
country_id: 3175395
description:
Nov 14 12:03:09 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=178.239.36.238, lip=66.85.158.91, TLS, session=<6MXSKohDONKy7yTu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.68
country_id: 298795
description:
2025-11-14 12:06:53 dovecot_login authenticator failed for (ADMIN) [188.213.34.68]:44560: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.97.188
country_id: 798544
description:
Nov 14 12:09:02 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris>, method=PLAIN, rip=178.219.97.188, lip=66.85.158.91, TLS, session=<Kx/JP4hDSMiy22G8>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 89.231.35.47
country_id: 798544
description:
Nov 14 12:08:43 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<jagath.peiris@ajsstarlog.com>, method=PLAIN, rip=89.231.35.47, lip=66.85.158.91, TLS, session=<AG20PohDdL5Z5yMv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-11-14 12:15:00 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:52666: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-14 12:15:16 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:36475: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.52
country_id: 6252001
description:
Nov 14 12:18:01 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.52, lip=66.85.158.92, session=</abzYIhDevrG6xg0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.72.148
country_id: 3469034
description:
Nov 14 12:18:36 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=187.120.72.148, lip=66.85.158.91, TLS, session=<nRX0YYhDi8y7eEiU>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.43.231.85
country_id: 798544
description:
Nov 14 12:18:53 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<587hr>, method=PLAIN, rip=193.43.231.85, lip=66.85.158.91, TLS, session=<yGcbY4hDI4PBK+dV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 14 12:19:41 host2 sshd[3650538]: Disconnected from invalid user copyuser 139.59.64.179 port 50470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 14 12:21:12 host2 sshd[3651410]: Disconnected from invalid user rad 139.59.64.179 port 53752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.17.8.234
country_id: 3175395
description:
Nov 14 12:21:17 host2 sshd[3651469]: Disconnected from invalid user laci 79.17.8.234 port 59732 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 103.176.152.18
country_id: 1605651
description:
Nov 14 12:22:05 host2 pure-ftpd[3651825]: (?@103.176.152.18) [INFO] New connection from 103.176.152.18


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-14 12:26:29 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:48582: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.78
country_id: 6251999
description:
2025-11-14 12:26:30 dovecot_login authenticator failed for (ADMIN) [66.56.80.78]:46003: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.192
country_id: 6252001
description:
Nov 14 12:26:35 host2 pure-ftpd[3654542]: (?@198.235.24.192) [INFO] New connection from 198.235.24.192


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.112.186
country_id: 3469034
description:
2025-11-14 12:26:45 dovecot_login authenticator failed for ([187.12.112.186]) [187.12.112.186]:43525: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.17.8.234
country_id: 3175395
description:
Nov 14 12:26:20 host2 sshd[3654367]: Disconnected from invalid user dev 79.17.8.234 port 60844 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 139.59.64.179
country_id: 1269750
description:
Nov 14 12:27:17 host2 sshd[3654940]: Disconnected from invalid user mahsa 139.59.64.179 port 38158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.17.8.234
country_id: 3175395
description:
Nov 14 12:29:26 host2 sshd[3656096]: Disconnected from invalid user helloworld 79.17.8.234 port 33340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.49.238.104
country_id: 1643084
description:
Nov 14 12:38:08 host2 sshd[3661484]: Disconnected from invalid user aaa 103.49.238.104 port 36686 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 84.239.42.147
country_id: 690791
description:
Nov 14 12:38:18 host2 dovecot[43647]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=84.239.42.147, lip=66.85.158.91, session=<rg+DqYhDgs9U7yqT>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 77.81.142.139
country_id: 3996063
description:
Nov 14 12:38:18 host2 dovecot[43647]: imap-login: Disconnected: Input buffer full (disconnected before auth was ready, waited 0 secs): user=<>, rip=77.81.142.139, lip=66.85.158.91, session=<GeF/qYhDGIZNUY6L>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.239.139
country_id: 1227603
description:
Nov 14 12:38:15 host2 pure-ftpd[3661670]: (?@95.181.239.139) [INFO] New connection from 95.181.239.139


