# incident

plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.25.150
country_id: 1880251
description:
Nov 27 02:59:35 host2 sshd[190761]: Disconnected from invalid user server 43.134.25.150 port 43770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 03:01:32 host2 sshd[192312]: Disconnected from invalid user admin 2.57.121.112 port 38638 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-11-27 03:00:50 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:39504: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.134.25.150
country_id: 1880251
description:
Nov 27 03:02:09 host2 sshd[192834]: Disconnected from invalid user public 43.134.25.150 port 50628 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-11-27 03:04:00 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:55642: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.22
country_id: 1149361
description:
2025-11-27 03:04:24 dovecot_login authenticator failed for ([149.54.62.22]) [149.54.62.22]:34293: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.164.238.63
country_id: 6252001
description:
2025-11-27 03:05:09 dovecot_login authenticator failed for c-67-164-238-63.hsd1.il.comcast.net [67.164.238.63]:31591: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 03:08:56 host2 sshd[197572]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 03:14:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<order@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<kj7OTYZEWpQXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-11-27 03:16:37 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:53768: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-11-27 03:16:45 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:37509: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.66.124
country_id: 2921044
description:
Nov 27 03:17:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=64.226.66.124, lip=66.85.158.91, TLS, session=<pwG6WIZEthZA4kJ8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-11-27 03:25:42 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:40542: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.124
country_id: 6252001
description:
Nov 27 03:28:18 host2 pure-ftpd[211722]: (?@195.184.76.124) [INFO] New connection from 195.184.76.124


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.127
country_id: 6252001
description:
Nov 27 03:28:17 host2 pure-ftpd[211715]: (?@195.184.76.127) [INFO] New connection from 195.184.76.127


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 03:31:17 host2 sshd[213937]: Disconnected from invalid user jorden 62.60.131.157 port 9632 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-11-27 03:33:17 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:62664: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.144.150
country_id: 1269750
description:
2025-11-27 03:33:40 dovecot_login authenticator failed for ([152.52.118.1]) [122.185.144.150]:36822: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-27 03:40:23 dovecot_login authenticator failed for ([127.0.0.1]) [213.55.85.202]:3532: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-11-27 03:40:00 dovecot_login authenticator failed for ([127.0.0.1]) [49.249.76.221]:60334: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-27 03:40:41 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:52396: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-11-27 03:41:01 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:58966: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 34.122.105.182
country_id: 6252001
description:
Nov 27 03:46:10 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=34.122.105.182, lip=66.85.158.92, TLS: Connection closed, session=<HUBhvoZEWIEiemm2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.79.181.251
country_id: 6252001
description:
Nov 27 03:46:25 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=45.79.181.251, lip=66.85.158.92, session=<UqM+v4ZE3JAtT7X7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 03:47:38 host2 sshd[226175]: Disconnected from invalid user  2.57.121.112 port 62363 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-27 03:49:00 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:40816: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-27 03:49:16 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:48328: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 03:54:27 host2 sshd[231584]: Disconnected from invalid user admin 2.57.121.112 port 5965 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-27 03:57:23 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:52122: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 03:59:40 host2 sshd[236681]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.227
country_id: 1880251
description:
Nov 27 04:02:18 host2 sshd[239116]: Disconnected from invalid user admin1 206.238.40.227 port 57038 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-27 04:04:57 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:50276: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 206.238.40.227
country_id: 1880251
description:
Nov 27 04:08:02 host2 sshd[245387]: Disconnected from invalid user precio01 206.238.40.227 port 49440 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.115.112.108
country_id: 6252001
description:
2025-11-27 04:09:16 dovecot_login authenticator failed for 146-115-112-108.s362.c3-0.wak-ubr1.sbo-wak.ma.cable.rcncustomer.com [146.115.112.108]:40086: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.227
country_id: 1880251
description:
Nov 27 04:09:17 host2 sshd[246611]: Disconnected from invalid user fred 206.238.40.227 port 56324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2025-11-27 04:08:53 dovecot_login authenticator failed for ([152.52.144.161]) [128.185.212.178]:58702: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 27 04:10:23 host2 sshd[247742]: Disconnected from invalid user testuser 185.202.207.17 port 41922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 206.238.40.227
country_id: 1880251
description:
Nov 27 04:10:37 host2 sshd[247979]: Disconnected from invalid user tecnopos 206.238.40.227 port 43454 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 27 04:11:58 host2 sshd[249064]: Disconnected from invalid user hello 185.202.207.17 port 44302 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.202.207.17
country_id: 2510769
description:
Nov 27 04:15:46 host2 sshd[254149]: Disconnected from invalid user user10 185.202.207.17 port 34696 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 27 04:16:11 host2 sshd[254724]: User agentallianz from 62.60.135.41 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.74.194.86
country_id: 1522867
description:
2025-11-27 04:17:58 dovecot_login authenticator failed for (2-74-194-86.kcell.kz) [2.74.194.86]:60673: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-11-27 04:17:37 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:47928: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2025-11-27 04:19:07 dovecot_login authenticator failed for (secovi-rs.pae.gvt.net.br) [177.19.165.90]:60646: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-27 04:18:42 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:51338: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-27 04:18:53 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:45235: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.134.232
country_id: 6252001
description:
Nov 27 04:24:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=71.6.134.232, lip=66.85.158.92, session=<WDf0RYdEDKNHBobo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.15.163.174
country_id: 6252001
description:
Nov 27 04:25:26 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.15.163.174, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<8CLLSodE4KoUD6Ou>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.5.135
country_id: 798544
description:
2025-11-27 04:27:43 dovecot_login authenticator failed for 89-67-5-135.dynamic.play.pl [89.67.5.135]:55464: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.168.113.228
country_id: 6252001
description:
Nov 27 04:32:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.168.113.228, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<uFOxY4dEMLUUqHHk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-27 04:34:50 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:57192: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-11-27 04:35:05 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:37962: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 04:45:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<ttRWk4dEutUXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.127.53.61
country_id: 6252001
description:
2025-11-27 04:46:01 dovecot_plain authenticator failed for c-24-127-53-61.hsd1.mi.comcast.net (gradity) [24.127.53.61]:55976: 535 Incorrect authentication data (set_id=info@secondcoffeeinternational.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-27 04:52:08 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:39600: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-27 04:52:14 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:42418: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-27 04:52:23 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:38826: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.9
country_id: 1269750
description:
2025-11-27 04:52:39 dovecot_login authenticator failed for ([117.205.2.9]) [117.205.2.9]:37372: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 04:55:13 host2 sshd[293138]: Disconnected from invalid user kayden 62.60.131.157 port 26160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.183
country_id: 2017370
description:
2025-11-27 04:55:37 dovecot_login authenticator failed for ([46.8.246.183]) [46.8.246.183]:57540: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-11-27 04:55:58 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:42104: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-27 04:56:04 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:55698: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 05:00:04 host2 sshd[297123]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-27 05:01:38 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:48203: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-27 05:01:47 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:33862: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.183
country_id: 3017382
description:
Nov 27 05:08:08 host2 pure-ftpd[303841]: (?@91.196.152.183) [INFO] New connection from 91.196.152.183


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.196.152.208
country_id: 3017382
description:
Nov 27 05:08:09 host2 pure-ftpd[303850]: (?@91.196.152.208) [INFO] New connection from 91.196.152.208


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 05:14:04 host2 sshd[308977]: Disconnected from invalid user admin 2.57.121.112 port 39511 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-27 05:14:17 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (arapal) [174.59.253.88]:50868: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-27 05:15:02 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:49618: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.51.82
country_id: 1269750
description:
2025-11-27 05:15:04 dovecot_login authenticator failed for ([182.79.51.82]) [182.79.51.82]:38598: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-11-27 05:15:23 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:48583: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-27 05:14:57 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:50620: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-27 05:15:34 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:53910: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2025-11-27 05:23:00 dovecot_login authenticator failed for (104.214.46.200.psinetpa.net) [200.46.214.110]:48712: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.16
country_id: 1269750
description:
2025-11-27 05:22:49 dovecot_login authenticator failed for ([103.69.9.16]) [103.69.9.16]:50175: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 05:23:39 host2 sshd[316353]: Disconnected from invalid user kayden 62.60.131.157 port 17549 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-11-27 05:29:00 dovecot_login authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:59367: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
country_id: 1819730
description:
2025-11-27 05:30:18 dovecot_login authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:62501: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-27 05:30:00 dovecot_login authenticator failed for ([125.17.106.169]) [122.187.220.30]:34442: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.240.192.138
country_id: 6252001
description:
Nov 27 05:30:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=66.240.192.138, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<BQevNIhE7oBC8MCK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 66.240.192.138
country_id: 6252001
description:
Nov 27 05:30:50 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=66.240.192.138, lip=66.85.158.92, TLS, session=<frqsNIhEiu1C8MCK>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.46
country_id: 6252001
description:
Nov 27 05:33:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=205.210.31.46, lip=66.85.158.92, TLS, session=<Xm+fPohEtubN0h8u>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 27 05:37:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<xXrrS4hEEpqLonQW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
country_id: 3469034
description:
2025-11-27 05:38:50 dovecot_login authenticator failed for ([200.195.67.82]) [200.195.67.82]:35042: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.197.82
country_id: 2186224
description:
2025-11-27 05:39:04 dovecot_login authenticator failed for 219-89-197-82.adsl.xtra.co.nz [219.89.197.82]:39768: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.208.169
country_id: 2661886
description:
2025-11-27 05:39:13 dovecot_login authenticator failed for 94-255-208-169.cust.bredband2.com [94.255.208.169]:56010: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.50
country_id: 1269750
description:
2025-11-27 05:40:39 dovecot_login authenticator failed for ([128.185.212.50]) [128.185.212.50]:43276: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 05:41:21 host2 sshd[329052]: Disconnected from invalid user admin 2.57.121.112 port 19170 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-11-27 05:49:01 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:54202: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-11-27 05:49:17 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:33462: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 05:50:38 host2 sshd[336936]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.254
country_id: 6252001
description:
Nov 27 06:00:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.254, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<9sKXnYhEC9bG6xj+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-27 06:03:07 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:56568: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-27 06:03:24 dovecot_login authenticator failed for ([182.95.176.206]) [182.95.176.206]:52402: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-27 06:09:53 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:57803: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Nov 27 06:09:55 host2 sshd[353171]: Disconnected from invalid user syncthing 103.171.85.117 port 54266 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-27 06:09:46 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:38200: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Nov 27 06:16:47 host2 sshd[359925]: Disconnected from invalid user jmarquez 103.171.85.117 port 34156 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.171.85.117
country_id: 1643084
description:
Nov 27 06:18:37 host2 sshd[361444]: Disconnected from invalid user ionadmin 103.171.85.117 port 50168 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.92.0
country_id: 6252001
description:
Nov 27 06:18:52 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 3 secs): user=<>, rip=47.251.92.0, lip=66.85.158.92, session=<kxh84IhEWMUv+1wA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-11-27 06:20:27 dovecot_login authenticator failed for ([127.0.0.1]) [27.123.111.110]:60656: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2025-11-27 06:20:39 dovecot_login authenticator failed for ([127.0.0.1]) [125.19.158.2]:50106: 535 Incorrect authentication data (set_id=awanish)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2025-11-27 06:20:48 dovecot_login authenticator failed for ([125.21.153.217]) [182.95.46.186]:57386: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-27 06:20:17 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:47824: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Nov 27 06:22:12 host2 sshd[364137]: Disconnected from invalid user user2 103.171.85.117 port 35406 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-11-27 06:22:20 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:39163: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.248.127.243
country_id: 3865483
description:
2025-11-27 06:22:26 dovecot_login authenticator failed for ([207.248.127.243]) [207.248.127.243]:47683: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-27 06:22:38 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:38898: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-11-27 06:23:41 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:58551: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.244
country_id: 3996063
description:
2025-11-27 06:23:50 dovecot_login authenticator failed for ([177.236.146.244]) [177.236.146.244]:60813: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.171.85.117
country_id: 1643084
description:
Nov 27 06:25:58 host2 sshd[366792]: Disconnected from invalid user vtatis 103.171.85.117 port 55716 [preauth]


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 27 06:27:12 host2 sshd[367705]: User agentallianz from 62.60.135.41 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-11-27 06:28:04 dovecot_login authenticator failed for ([127.0.0.1]) [200.216.168.226]:42789: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.23.72.144
country_id: 6252001
description:
2025-11-27 06:28:12 dovecot_login authenticator failed for ([127.0.0.1]) [209.23.72.144]:59274: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 06:33:06 host2 sshd[371629]: Disconnected from invalid user admin 2.57.121.112 port 54292 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 105.112.17.192
country_id: 2328926
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 105.112.17.192 - jagath.peiris@ajsstarlog.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.79
country_id: 6252001
description:
Nov 27 06:39:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.79, lip=66.85.158.91, TLS, session=<TOhXK4lEBOzG6xhP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 27 06:40:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<QNwvLolE/JiSOC+J>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 06:44:52 host2 sshd[381587]: Disconnected from invalid user adrian 62.60.131.157 port 64955 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
country_id: 6252001
description:
2025-11-27 06:45:14 dovecot_plain authenticator failed for syn-050-074-136-134.biz.spectrum.com (exple) [50.74.136.134]:60848: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
country_id: 1512440
description:
2025-11-27 06:49:04 dovecot_login authenticator failed for ([213.230.127.217]) [213.230.127.217]:37044: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-11-27 06:49:15 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:50581: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 06:51:16 host2 sshd[386879]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-27 06:51:35 dovecot_login authenticator failed for ([128.185.222.216]) [128.185.242.74]:50864: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-11-27 06:51:51 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:36496: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 07:00:07 host2 sshd[394323]: Disconnected from invalid user admin 2.57.121.112 port 48157 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-27 07:03:30 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:59158: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-27 07:03:44 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:51218: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov 27 07:10:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<xOYxmYlEu/7CpRCn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2025-11-27 07:10:44 dovecot_plain authenticator failed for c-24-1-200-187.hsd1.il.comcast.net (resserao) [24.1.200.187]:43080: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.86
country_id: 6252001
description:
2025-11-27 07:12:14 dovecot_login authenticator failed for ([63.65.203.86]) [63.65.203.86]:58297: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-11-27 07:15:02 dovecot_login authenticator failed for ([85.133.161.162]) [85.133.161.162]:60706: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-27 07:15:41 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:49260: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-11-27 07:21:37 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:57497: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-11-27 07:21:51 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:50541: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Nov 27 07:27:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, session=<lC2D14lExNRBMQG2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.182
country_id: 6252001
description:
Nov 27 07:28:22 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=65.49.1.182, lip=66.85.158.91, session=<bxoD2YlEsB9BMQG2>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.47.35.194
country_id: 357994
description:
2025-11-27 07:28:46 dovecot_plain authenticator failed for (wally) [41.47.35.194]:44150: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-27 07:29:59 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:14915: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-27 07:29:21 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:11963: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.36.245
country_id: 6252001
description:
Nov 27 07:32:38 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.36.245, lip=66.85.158.92, session=<tzZF6IlEooulmiT1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.43.103.243
country_id: 3469034
description:
2025-11-27 07:35:21 dovecot_login authenticator failed for ([38.43.103.243]) [38.43.103.243]:49862: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.165
country_id: 2993457
description:
Nov 27 07:35:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=194.165.16.165, lip=66.85.158.92, session=<8Gzo8YlEev/CpRCl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-11-27 07:35:31 dovecot_login authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:65112: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.154.36.245
country_id: 6252001
description:
Nov 27 07:37:12 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=165.154.36.245, lip=66.85.158.91, session=<PHqZ+IlEMOylmiT1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-27 07:45:46 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:39109: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.86
country_id: 1269750
description:
2025-11-27 07:45:59 dovecot_login authenticator failed for ([27.123.113.86]) [27.123.113.86]:51456: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.100.116.34
country_id: 1831722
description:
Nov 27 07:51:20 host2 pure-ftpd[433726]: (?@175.100.116.34) [INFO] New connection from 175.100.116.34


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.100.116.34
country_id: 1831722
description:
Nov 27 07:51:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=175.100.116.34, lip=66.85.158.91, session=<lQVDK4pEr/GvZHQi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-27 07:54:36 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:53922: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.79.134
country_id: 1269750
description:
2025-11-27 07:55:01 dovecot_login authenticator failed for ([128.185.189.57]) [182.78.79.134]:36326: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 07:58:15 host2 sshd[438605]: Disconnected from invalid user ubnt 2.57.121.112 port 62516 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-11-27 08:03:19 dovecot_login authenticator failed for (ip-177-27-76-210.user.vivozap.com.br) [177.27.76.210]:36393: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2025-11-27 08:03:52 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:34548: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2025-11-27 08:06:56 dovecot_login authenticator failed for (nsg-static-97.152.75.182-airtel.com) [27.123.111.110]:36050: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-11-27 08:07:04 dovecot_login authenticator failed for ([65.20.250.163]) [65.20.250.163]:45692: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.242.142
country_id: 1269750
description:
2025-11-27 08:06:45 dovecot_login authenticator failed for ([182.78.242.142]) [182.78.242.142]:52104: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-27 08:11:09 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:49898: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-11-27 08:10:59 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:38359: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.100.116.34
country_id: 1831722
description:
Nov 27 08:11:53 host2 pure-ftpd[448258]: (?@175.100.116.34) [INFO] New connection from 175.100.116.34


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 175.100.116.34
country_id: 1831722
description:
Nov 27 08:11:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=175.100.116.34, lip=66.85.158.91, session=<binAdIpEucmvZHQi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2025-11-27 08:14:10 dovecot_login authenticator failed for ([49.124.205.169]) [49.124.205.169]:39642: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-11-27 08:14:32 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:58187: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Nov 27 08:17:09 host2 sshd[452795]: Disconnected from invalid user dolphinscheduler 213.6.203.226 port 34999 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 213.6.203.226
country_id: 6254930
description:
Nov 27 08:22:46 host2 sshd[455804]: Disconnected from invalid user odoo 213.6.203.226 port 39606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-11-27 08:22:29 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:49217: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.90.207.105
country_id: 2750405
description:
Nov 27 08:22:36 host2 sshd[455730]: Disconnected from invalid user vpn 164.90.207.105 port 54512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-11-27 08:22:39 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:58386: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.207.105
country_id: 2750405
description:
Nov 27 08:23:39 host2 sshd[456499]: Disconnected from invalid user hello 164.90.207.105 port 43686 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.90.207.105
country_id: 2750405
description:
Nov 27 08:24:38 host2 sshd[457130]: Disconnected from invalid user root1 164.90.207.105 port 46282 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 213.6.203.226
country_id: 6254930
description:
Nov 27 08:25:19 host2 sshd[457616]: Disconnected from invalid user old 213.6.203.226 port 48951 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-27 08:28:31 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:52778: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.56
country_id: 6252001
description:
Nov 27 08:31:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=167.94.146.56, lip=66.85.158.92, TLS: Connection closed, session=<+UILu4pEqoWnXpI4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.255
country_id: 6252001
description:
Nov 27 08:32:11 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.255, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<JE5FvYpEDNXN0h//>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-11-27 08:32:14 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:42823: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-11-27 08:32:30 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:33974: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2025-11-27 08:40:10 dovecot_login authenticator failed for ([103.56.85.65]) [128.185.227.166]:45826: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.203
country_id: 2186224
description:
2025-11-27 08:40:20 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:49280: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 27 08:41:17 host2 sshd[466671]: User agentallianz from 62.60.135.41 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.139.69
country_id: 6252001
description:
Nov 27 08:42:37 host2 pure-ftpd[467293]: (?@184.105.139.69) [INFO] New connection from 184.105.139.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-11-27 08:46:51 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:33250: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.48.24.152
country_id: 1269750
description:
2025-11-27 08:47:21 dovecot_login authenticator failed for (abts-kk-dynamic-152.24.48.171.airtelbroadband.in) [171.48.24.152]:49412: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 08:48:46 host2 sshd[472878]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 08:49:08 host2 sshd[473149]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 08:50:23 host2 sshd[474237]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.171
country_id: 6252001
description:
Nov 27 08:50:30 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.171, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<Cwq7/opEOMrG6xir>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.173.58.47
country_id: 6252001
description:
2025-11-27 08:51:20 dovecot_plain authenticator failed for c-67-173-58-47.hsd1.il.comcast.net (gadickle) [67.173.58.47]:54414: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-27 08:51:23 dovecot_login authenticator failed for ([152.52.92.105]) [152.52.192.74]:34804: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-11-27 08:51:13 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:54774: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 27 08:55:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<6PRWEotEgP8t4/6c>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.123.61
country_id: 2921044
description:
Nov 27 08:57:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.123.61, lip=66.85.158.91, TLS, session=<rejWFotEEj1A4ns9>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2025-11-27 08:58:53 dovecot_login authenticator failed for ([141.148.165.230]) [141.148.165.230]:42972: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-11-27 08:59:09 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:51718: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.17.163.44
country_id: 6252001
description:
2025-11-27 09:10:50 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:59694: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-11-27 09:10:35 dovecot_login authenticator failed for ([125.17.236.223]) [125.17.233.246]:42986: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.184
country_id: 2635167
description:
Nov 27 09:13:15 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.184, lip=66.85.158.92, TLS, session=<UX0WUItE8bW594m4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.39
country_id: 2635167
description:
Nov 27 09:13:16 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.39, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<PCAoUItER9pX7LAn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.56
country_id: 2635167
description:
Nov 27 09:13:49 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.56, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=</X8jUotExce594k4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.238
country_id: 6252001
description:
Nov 27 09:14:24 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=147.185.132.238, lip=66.85.158.91, session=<6MA+VItEzOGTuYTu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.54
country_id: 2635167
description:
Nov 27 09:14:55 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=185.247.137.54, lip=66.85.158.92, TLS handshaking: Connection closed, session=<hUcaVotEl7i594k2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.73
country_id: 2635167
description:
Nov 27 09:14:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.73, lip=66.85.158.92, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<WQUfVItEC+xX7LBJ>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.67
country_id: 2635167
description:
Nov 27 09:15:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=87.236.176.67, lip=66.85.158.92, TLS handshaking: Connection closed, session=<yM8VWItE/bdX7LBD>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.60
country_id: 2635167
description:
Nov 27 09:16:02 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=185.247.137.60, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<UT8PWotESaC594k8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.45
country_id: 2635167
description:
Nov 27 09:16:35 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.45, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<gnwMXItEEaa594kt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.60
country_id: 2635167
description:
Nov 27 09:17:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.60, lip=66.85.158.92, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<s+MHXotEDdy594k8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.63
country_id: 2635167
description:
Nov 27 09:17:42 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.63, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<WFIBYItEB4hX7LA/>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.58
country_id: 2635167
description:
Nov 27 09:18:15 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.58, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<tKn8YYtE08VX7LA6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.110.36.125
country_id: 3508796
description:
2025-11-27 09:23:41 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.125]:41629: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.247.80.227
country_id: 1269750
description:
2025-11-27 09:24:02 dovecot_login authenticator failed for ([47.247.80.227]) [47.247.80.227]:59996: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 09:28:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<Yr8BhotENNQXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.211.222
country_id: 1880251
description:
Nov 27 09:28:36 host2 sshd[503355]: Disconnected from invalid user ftpuser1 167.71.211.222 port 54598 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.16.71.254
country_id: 6252001
description:
2025-11-27 09:31:29 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:61546: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2025-11-27 09:31:40 dovecot_login authenticator failed for ([61.246.205.1]) [125.19.218.2]:51040: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.32.248
country_id: 1269750
description:
2025-11-27 09:32:12 dovecot_login authenticator failed for ([115.240.6.56]) [49.37.32.248]:58813: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.211.222
country_id: 1880251
description:
Nov 27 09:32:14 host2 sshd[505719]: Disconnected from invalid user admin 167.71.211.222 port 39430 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.71.211.222
country_id: 1880251
description:
Nov 27 09:34:51 host2 sshd[506986]: Disconnected from invalid user andy 167.71.211.222 port 50852 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-27 09:37:06 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:45204: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.201
country_id: 2635167
description:
Nov 27 09:36:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=35.203.210.201, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<dkfaoYtE780jy9LJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-11-27 09:36:57 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:56344: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.71.211.222
country_id: 1880251
description:
Nov 27 09:37:25 host2 sshd[508636]: Disconnected from invalid user user3 167.71.211.222 port 44668 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 09:39:08 host2 sshd[509471]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.201
country_id: 2635167
description:
Nov 27 09:42:58 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.201, lip=66.85.158.91, TLS, session=<FSpmuotE1vsjy9LJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-27 09:53:00 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:44840: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.248.4.85
country_id: 1269750
description:
2025-11-27 09:53:26 dovecot_login authenticator failed for ([115.248.4.85]) [115.248.4.85]:59913: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-27 09:54:32 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:53816: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 27 09:54:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=139.162.113.212, lip=66.85.158.92, TLS: Connection closed, session=<tAgY5ItEktyLonHU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-11-27 09:55:21 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:50756: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2025-11-27 09:55:59 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:53116: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-27 09:56:03 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12021: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2025-11-27 09:56:18 dovecot_login authenticator failed for ([41.59.200.166]) [41.59.200.166]:54855: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2025-11-27 09:56:33 dovecot_login authenticator failed for ([31.41.84.98]) [31.41.84.98]:48139: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-27 09:58:06 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:57129: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.98
country_id: 6252001
description:
2025-11-27 10:03:59 dovecot_login authenticator failed for ([70.174.168.98]) [70.174.168.98]:59790: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2025-11-27 10:04:10 dovecot_login authenticator failed for ([128.185.208.42]) [128.185.208.42]:46526: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.222.34.39
country_id: 3996063
description:
2025-11-27 10:11:59 dovecot_plain authenticator failed for 189.222.34.39.dsl.dyn.telnor.net (398XN2FAL8) [189.222.34.39]:49263: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-11-27 10:11:22 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:63352: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
country_id: 6252001
description:
2025-11-27 10:11:52 dovecot_login authenticator failed for ([38.148.95.217]) [38.148.95.217]:33512: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-11-27 10:15:35 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:40994: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
country_id: 1168579
description:
2025-11-27 10:15:41 dovecot_login authenticator failed for ([182.176.4.105]) [182.176.4.105]:53258: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-27 10:15:53 dovecot_login authenticator failed for ([128.185.135.33]) [122.185.145.54]:53710: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-11-27 10:21:08 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (thish) [174.169.224.27]:57596: 535 Incorrect authentication data (set_id=info@anandaobauae.org)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.94
country_id: 6252001
description:
Nov 27 10:22:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=205.210.31.94, lip=66.85.158.91, session=<fUE3SIxE9uXN0h9e>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Nov 27 10:22:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, TLS: Connection closed, session=<YwgrSYxE0shChJmE>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.132
country_id: 6252001
description:
Nov 27 10:23:06 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=66.132.153.132, lip=66.85.158.92, session=<wZfjSYxEdhdChJmE>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.117.170
country_id: 6252001
description:
Nov 27 10:24:09 host2 pure-ftpd[539728]: (?@172.202.117.170) [INFO] New connection from 172.202.117.170


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 10:26:37 host2 sshd[541711]: Disconnected from invalid user admin 2.57.121.112 port 6004 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Nov 27 10:28:00 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.92, session=<8uhwW4xExt9APsUR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.17
country_id: 6252001
description:
Nov 27 10:28:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.17, lip=66.85.158.92, TLS: Connection closed, session=<H18tXIxExKdAPsUR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.152
country_id: 6252001
description:
Nov 27 10:28:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.152, lip=66.85.158.92, TLS handshaking: Connection closed, session=<DdUoXIxEOopBMQGY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.107.1
country_id: 1269750
description:
2025-11-27 10:35:16 dovecot_login authenticator failed for ([144.24.107.1]) [144.24.107.1]:39634: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-11-27 10:35:34 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:58602: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 10:41:12 host2 sshd[553207]: Disconnected from invalid user  2.57.121.112 port 62252 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.156
country_id: 1733045
description:
2025-11-27 10:42:27 dovecot_login authenticator failed for ([49.124.154.156]) [49.124.154.156]:34644: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.62
country_id: 298795
description:
Nov 27 10:43:35 host2 sshd[554845]: Disconnected from invalid user master 45.94.4.62 port 4786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 27 10:44:06 host2 sshd[555236]: Disconnected from invalid user stperez 107.172.235.53 port 64560 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 27 10:45:45 host2 sshd[556935]: Disconnected from invalid user ansible 185.158.23.150 port 23569 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.252
country_id: 1880251
description:
Nov 27 10:46:46 host2 sshd[557417]: Disconnected from invalid user myuser 45.78.204.252 port 48860 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 27 10:47:34 host2 sshd[557864]: Disconnected from invalid user user2 129.154.42.120 port 9644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 27 10:48:10 host2 sshd[558234]: Disconnected from invalid user master 185.158.23.150 port 60167 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 27 10:48:57 host2 sshd[558566]: Disconnected from invalid user jmarquez 129.154.42.120 port 25224 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.94.4.62
country_id: 298795
description:
Nov 27 10:48:58 host2 sshd[558577]: Disconnected from invalid user actions 45.94.4.62 port 27908 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 185.158.23.150
country_id: 99237
description:
Nov 27 10:49:24 host2 sshd[558851]: Disconnected from invalid user zmarin 185.158.23.150 port 32695 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 27 10:50:14 host2 sshd[559460]: Disconnected from invalid user actions 107.172.235.53 port 33534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 27 10:50:16 host2 sshd[559462]: Disconnected from invalid user ansible 129.154.42.120 port 18106 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 129.154.42.120
country_id: 1269750
description:
Nov 27 10:51:36 host2 sshd[560228]: Disconnected from invalid user zmarin 129.154.42.120 port 19958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 27 10:51:19 host2 sshd[560138]: Disconnected from invalid user vtatis 107.172.235.53 port 17210 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-27 10:52:49 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:38666: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.49
country_id: 1269750
description:
Nov 27 10:52:50 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 25 secs): user=<587hr>, method=PLAIN, rip=103.18.166.49, lip=66.85.158.91, TLS, session=<ny7IsoxE04BnEqYx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.219.105.148
country_id: 798544
description:
Nov 27 10:52:20 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=178.219.105.148, lip=66.85.158.91, TLS, session=<H4JesYxERMCy22mU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-27 10:53:29 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:60838: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.172.235.53
country_id: 6252001
description:
Nov 27 10:53:28 host2 sshd[561201]: Disconnected from invalid user dd 107.172.235.53 port 63908 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.158.23.150
country_id: 99237
description:
Nov 27 10:53:10 host2 sshd[561014]: Disconnected from invalid user stperez 185.158.23.150 port 14525 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
country_id: 99237
description:
2025-11-27 10:55:07 dovecot_login authenticator failed for ([65.20.147.45]) [65.20.147.45]:40649: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2025-11-27 10:55:21 dovecot_login authenticator failed for ([152.52.144.161]) [128.185.212.178]:57458: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-11-27 10:57:16 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:63217: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Nov 27 10:56:52 host2 sshd[564535]: Disconnected from invalid user cc 107.173.160.152 port 53902 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.211
country_id: 6252001
description:
Nov 27 10:58:23 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.211, lip=66.85.158.92, TLS, session=<6oMSyIxEVvfG6xjT>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Nov 27 10:58:34 host2 sshd[565656]: Disconnected from invalid user temp 107.173.160.152 port 57542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 27 10:59:39 host2 sshd[566341]: Disconnected from invalid user hb 164.92.106.89 port 54720 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 27 11:00:50 host2 sshd[567196]: Disconnected from invalid user drcom 164.92.106.89 port 44212 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.196.243
country_id: 1269750
description:
Nov 27 11:00:52 host2 sshd[567199]: Disconnected from invalid user admin1234 66.116.196.243 port 34018 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.130
country_id: 6252001
description:
Nov 27 11:02:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.130, lip=66.85.158.91, TLS: Connection closed, session=<JRpg14xEnCRChJmC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 27 11:03:11 host2 sshd[569071]: Disconnected from invalid user gits 164.92.106.89 port 56278 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.173.160.152
country_id: 6252001
description:
Nov 27 11:03:32 host2 sshd[569261]: Disconnected from invalid user frontend 107.173.160.152 port 51886 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.138
country_id: 6252001
description:
Nov 27 11:03:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=147.185.132.138, lip=66.85.158.91, TLS, session=<KSDp2oxEFO6TuYSK>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 107.173.160.152
country_id: 6252001
description:
Nov 27 11:05:06 host2 sshd[570407]: Disconnected from invalid user redmine 107.173.160.152 port 38214 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.224
country_id: 6252001
description:
Nov 27 11:05:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.133.224, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<aVQZ4YxE196TuYXg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.252
country_id: 1880251
description:
Nov 27 11:05:26 host2 sshd[570657]: Disconnected from invalid user ionadmin 45.78.204.252 port 40466 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.196.243
country_id: 1269750
description:
Nov 27 11:04:57 host2 sshd[570142]: Disconnected from invalid user update 66.116.196.243 port 42582 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-27 11:05:59 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:36249: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.224
country_id: 6252001
description:
Nov 27 11:05:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=403) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=147.185.133.224, lip=66.85.158.92, TLS: read(size=403) failed: Connection reset by peer, session=<OqEw4oxEVuqTuYXg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-11-27 11:05:45 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:58357: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.106.89
country_id: 6252001
description:
Nov 27 11:05:54 host2 sshd[570950]: Disconnected from invalid user remote 164.92.106.89 port 54916 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.40.101.10
country_id: 6252001
description:
2025-11-27 11:07:41 dovecot_plain authenticator failed for c-98-40-101-10.hsd1.tn.comcast.net (dacially) [98.40.101.10]:59382: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 27 11:09:35 host2 sshd[573543]: Disconnected from invalid user vss 102.140.97.134 port 36630 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.236.206.240
country_id: 1880251
description:
Nov 27 11:08:42 host2 sshd[572892]: Disconnected from invalid user system 47.236.206.240 port 41160 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-27 11:08:52 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:37078: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2025-11-27 11:09:08 dovecot_login authenticator failed for ([180.188.253.150]) [180.188.253.150]:35334: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.224
country_id: 6252001
description:
Nov 27 11:10:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.224, lip=66.85.158.92, TLS, session=<r8Tg84xEoOaTuYXg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Nov 27 11:11:11 host2 sshd[574631]: Disconnected from invalid user airflow 191.185.168.78 port 49412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.196.243
country_id: 1269750
description:
Nov 27 11:11:18 host2 sshd[574709]: Disconnected from invalid user sftp 66.116.196.243 port 51872 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.116.196.243
country_id: 1269750
description:
Nov 27 11:12:37 host2 sshd[575506]: Disconnected from invalid user gits 66.116.196.243 port 38692 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 27 11:13:23 host2 sshd[575986]: Disconnected from invalid user student 102.140.97.134 port 45136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.252
country_id: 1880251
description:
Nov 27 11:16:02 host2 sshd[577544]: Disconnected from invalid user postgres 45.78.204.252 port 38792 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 191.185.168.78
country_id: 3469034
description:
Nov 27 11:16:51 host2 sshd[578002]: Disconnected from invalid user superman 191.185.168.78 port 38512 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.188.177.224
country_id: 3355338
description:
2025-11-27 11:17:05 dovecot_plain authenticator failed for (Q3OS5) [197.188.177.224]:61085: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 11:17:39 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<1sTmDI1E0uYXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 11:17:56 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<h4rlDY1EzJsXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.246
country_id: 2635167
description:
Nov 27 11:18:28 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.246, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<1vLmD41ET9K594n2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:18:39 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<w4eXEI1EasMDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.235
country_id: 2635167
description:
Nov 27 11:17:54 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.235, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<apzrDY1E+8lX7LDr>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.252
country_id: 1880251
description:
Nov 27 11:18:35 host2 sshd[579152]: Disconnected from invalid user gits 45.78.204.252 port 51766 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.128
country_id: 2635167
description:
Nov 27 11:17:54 host2 dovecot[3107204]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=87.236.176.128, lip=66.85.158.91, TLS, session=<mBLiDY1EvYZX7LCA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:18:48 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<q5ogEY1ErqcDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.247
country_id: 2635167
description:
Nov 27 11:19:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=679) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.247, lip=66.85.158.91, TLS handshaking: read(size=679) failed: Connection reset by peer, session=<U0ziEY1E44FX7LD3>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.249
country_id: 2635167
description:
Nov 27 11:19:34 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=693) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.249, lip=66.85.158.91, TLS handshaking: read(size=693) failed: Connection reset by peer, session=<vrLdE41ED7lX7LD5>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.220
country_id: 2635167
description:
Nov 27 11:20:07 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=612) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.220, lip=66.85.158.91, TLS handshaking: read(size=612) failed: Connection reset by peer, session=<2fzYFY1Ev7JX7LDc>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 191.185.168.78
country_id: 3469034
description:
Nov 27 11:20:29 host2 sshd[580332]: Disconnected from invalid user backend 191.185.168.78 port 43400 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.140.97.134
country_id: 2328926
description:
Nov 27 11:20:35 host2 sshd[580380]: Disconnected from invalid user dbadmin 102.140.97.134 port 35914 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:19:46 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<q1qWFI1ERocDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.242
country_id: 2635167
description:
Nov 27 11:21:14 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=87.236.176.242, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<e4jPGY1E0aFX7LDy>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.245
country_id: 2635167
description:
Nov 27 11:20:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=87.236.176.245, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<91TSF41EE9NX7LD1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:21:47 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS, session=<AD7MG41EBNcDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.247.137.237
country_id: 2635167
description:
Nov 27 11:21:47 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=598) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=185.247.137.237, lip=66.85.158.91, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<r+LKG41EYZK594nt>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.238
country_id: 2635167
description:
Nov 27 11:22:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher (no auth attempts in 0 secs): user=<>, rip=87.236.176.238, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:142090C1:SSL routines:tls_early_post_process_client_hello:no shared cipher, session=<F0PEHY1EC6hX7LDu>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 87.236.176.226
country_id: 2635167
description:
Nov 27 11:22:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share (no auth attempts in 0 secs): user=<>, rip=87.236.176.226, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share, session=<JYu/H41EHexX7LDi>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-27 11:23:16 dovecot_login authenticator failed for h17.83.184.173.dynamic.ip.windstream.net [173.184.83.17]:33318: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:23:37 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: Connection closed, session=<OORbIo1Eto8DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.252.61
country_id: 1210997
description:
2025-11-27 11:22:49 dovecot_login authenticator failed for ([103.115.252.60]) [103.115.252.61]:58927: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 11:23:53 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<X1lHI41Eer0DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-11-27 11:24:32 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:45998: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-11-27 11:24:45 dovecot_login authenticator failed for ([213.230.64.246]) [213.230.64.246]:33550: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 11:26:40 host2 sshd[583838]: Disconnected from invalid user jim 2.57.121.112 port 62475 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.203.37.225
country_id: 6252001
description:
2025-11-27 11:41:25 dovecot_login authenticator failed for 104-203-37-225.static4.bluestreamfiber.net [104.203.37.225]:34161: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-11-27 11:41:07 dovecot_login authenticator failed for (200216168226.user.veloxzone.com.br) [200.216.168.226]:38272: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 11:43:50 host2 sshd[595676]: Disconnected from invalid user admin 2.57.121.112 port 60656 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.199.79.69
country_id: 6252001
description:
Nov 27 11:46:12 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=198.199.79.69, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<8ioic41E0tjGx09F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.99
country_id: 6252001
description:
Nov 27 11:46:21 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=198.235.24.99, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<us+fc41EMcnG6xhj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2025-11-27 11:48:51 dovecot_login authenticator failed for ns3241969.ip-57-129-90.eu [57.129.90.215]:59846: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-27 11:49:12 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:48776: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Nov 27 11:57:13 host2 sshd[605425]: Disconnected from invalid user db2inst1 20.12.41.6 port 42542 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-27 11:58:38 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:61628: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2025-11-27 11:58:44 dovecot_login authenticator failed for (techday.com.ua) [46.149.83.62]:58720: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-27 11:58:53 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:37943: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.90
country_id: 1269750
description:
2025-11-27 11:59:13 dovecot_login authenticator failed for ([27.123.112.90]) [27.123.112.90]:41764: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Nov 27 12:00:12 host2 sshd[607247]: Disconnected from invalid user usuario 20.12.41.6 port 47666 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:01:31 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<AFzdqY1EurwDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 12:00:59 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=</PPbp41EEt0XXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.12.41.6
country_id: 6252001
description:
Nov 27 12:01:30 host2 sshd[608130]: Disconnected from invalid user soporte 20.12.41.6 port 50920 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:01:42 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.92, TLS handshaking: Connection closed, session=<J1qRqo1EaMkDhBfJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.12.41.6
country_id: 6252001
description:
Nov 27 12:02:57 host2 sshd[608950]: Disconnected from invalid user ubuntu 20.12.41.6 port 40488 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.33.187
country_id: 6251999
description:
2025-11-27 12:04:39 dovecot_login authenticator failed for (localhost.localdomain) [159.203.33.187]:37154: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 12:04:44 host2 sshd[610616]: Disconnected from invalid user khalid 62.60.131.157 port 26961 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:04:44 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<2sRotY1EuMADhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 78.28.117.27
country_id: 453733
description:
Nov 27 12:06:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=78.28.117.27, lip=66.85.158.91, TLS, session=<+coRuY1EkcxOHHUb>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.51.223.15
country_id: 1269750
description:
Nov 27 12:06:24 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts2>, method=PLAIN, rip=103.51.223.15, lip=66.85.158.91, TLS, session=<kW8zuo1Ex7dnM98P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.143.92.158
country_id: 2510769
description:
Nov 27 12:07:06 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 16 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=185.143.92.158, lip=66.85.158.91, TLS, session=<Q5ffvI1ERdm5j1ye>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:07:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<m/YPvo1EQsgDhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.238.106.146
country_id: 3865483
description:
Nov 27 12:07:49 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts>, method=PLAIN, rip=45.238.106.146, lip=66.85.158.91, TLS, session=<cuM7v41Elrot7mqS>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:08:55 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GzBZxI1EBMkDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.51.202
country_id: 3017382
description:
2025-11-27 12:09:31 dovecot_login authenticator failed for ([188.231.51.202]) [188.231.51.202]:47008: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:10:10 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<K0HXyI1EboMDhBfJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-11-27 12:09:49 dovecot_login authenticator failed for mail.sotus.co.th [171.100.156.38]:45091: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-27 12:11:30 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:54818: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.132.23.201
country_id: 6252001
description:
Nov 27 12:12:51 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.132.23.201, lip=66.85.158.91, TLS, session=<roZq0o1EKI4DhBfJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 27 12:23:20 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<sales@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<wHK/941EGpOSOC+J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.194.94
country_id: 1269750
description:
2025-11-27 12:28:16 dovecot_login authenticator failed for ([27.123.91.196]) [152.52.194.94]:41536: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-27 12:28:26 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:39435: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.21
country_id: 1269750
description:
2025-11-27 12:29:53 dovecot_login authenticator failed for (nsg-corporate-21.226.187.122.airtel.in) [122.187.226.21]:35534: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.39.177
country_id: 1861060
description:
2025-11-27 12:32:08 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [138.199.39.177]:24770: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-27 12:32:39 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:53914: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.38.83.209
country_id: 1269750
description:
2025-11-27 12:37:57 dovecot_login authenticator failed for (glcars.in) [198.38.83.209]:36086: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-11-27 12:40:38 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:42952: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-11-27 12:39:57 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:33720: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.100.253
country_id: 1269750
description:
2025-11-27 12:40:21 dovecot_login authenticator failed for (abts-mum-static-253.100.170.122.airtelbroadband.in) [122.170.100.253]:45053: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.170
country_id: 1269750
description:
2025-11-27 12:40:25 dovecot_login authenticator failed for ([182.95.52.170]) [182.95.52.170]:43018: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.0.54.119
country_id: 2510769
description:
2025-11-27 12:41:09 dovecot_login authenticator failed for (89.140.17.22.static.user.ono.com) [81.0.54.119]:33132: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.62.54
country_id: 1149361
description:
2025-11-27 12:41:27 dovecot_login authenticator failed for ([149.54.62.54]) [149.54.62.54]:35394: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.174
country_id: 2921044
description:
2025-11-27 12:46:49 dovecot_login authenticator failed for (nZ40LQY) [213.209.157.174]:55480: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.174
country_id: 2921044
description:
2025-11-27 12:47:58 dovecot_login authenticator failed for (8nJI6it) [213.209.157.174]:63464: 535 Incorrect authentication data (set_id=ajith)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 12:56:49 host2 sshd[645866]: Disconnected from invalid user alysia 62.60.131.157 port 42103 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-11-27 12:58:32 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:58090: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-11-27 12:58:18 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:55149: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-11-27 13:06:05 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:34073: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2025-11-27 13:06:54 dovecot_login authenticator failed for ([203.124.60.46]) [203.124.60.46]:45638: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5718
name: Attempt to login using a denied user.
abuser: 62.60.135.41
country_id: 130758
description:
Nov 27 13:08:41 host2 sshd[654030]: User agentallianz from 62.60.135.41 not allowed because a group is listed in DenyGroups


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.21
country_id: 1733045
description:
2025-11-27 13:13:50 dovecot_login authenticator failed for ([49.124.151.21]) [49.124.151.21]:59708: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.8
country_id: 1733045
description:
2025-11-27 13:14:22 dovecot_login authenticator failed for ([49.124.153.8]) [49.124.153.8]:43974: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Nov 27 13:14:59 host2 sshd[658698]: Disconnected from invalid user precio01 209.15.115.240 port 40720 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.143
country_id: 1643084
description:
Nov 27 13:16:36 host2 sshd[659855]: Disconnected from invalid user gitea 203.145.34.143 port 42606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 209.15.115.240
country_id: 1605651
description:
Nov 27 13:16:43 host2 sshd[659892]: Disconnected from invalid user github 209.15.115.240 port 43830 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.244.105.241
country_id: 1269750
description:
Nov 27 13:19:08 host2 sshd[661471]: Disconnected from invalid user seafile 20.244.105.241 port 55482 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 209.15.115.240
country_id: 1605651
description:
Nov 27 13:19:18 host2 sshd[661588]: Disconnected from invalid user es 209.15.115.240 port 44274 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 203.145.34.143
country_id: 1643084
description:
Nov 27 13:19:40 host2 sshd[661801]: Disconnected from invalid user superadmin 203.145.34.143 port 44504 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.78.217
country_id: 2921044
description:
Nov 27 13:20:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=64.226.78.217, lip=66.85.158.92, session=<xXtlxI5E+xJA4k7Z>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 165.232.67.168
country_id: 2921044
description:
Nov 27 13:20:32 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=165.232.67.168, lip=66.85.158.92, session=<4iR+xI5E9lSl6EOo>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.90
country_id: 6252001
description:
Nov 27 13:22:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.90, lip=66.85.158.91, session=<XQ37yY5ElYFAPsVa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-27 13:21:35 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:48786: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-11-27 13:21:52 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:44288: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.77
country_id: 6252001
description:
Nov 27 13:22:17 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.62.197.77, lip=66.85.158.91, TLS: Connection closed, session=<5uW4yo5EOBhAPsVN>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.244.105.241
country_id: 1269750
description:
Nov 27 13:23:31 host2 sshd[664405]: Disconnected from invalid user lch 20.244.105.241 port 56518 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-27 13:29:40 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3535: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.140.111
country_id: 1819730
description:
2025-11-27 13:29:57 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:21447: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.253.46
country_id: 1819730
description:
2025-11-27 13:39:27 dovecot_login authenticator failed for (161.81.253.46.hk.chinamobile.com) [161.81.253.46]:42364: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-11-27 13:39:38 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:33485: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.238
country_id: 6252001
description:
Nov 27 13:42:43 host2 pure-ftpd[677320]: (?@205.210.31.238) [INFO] New connection from 205.210.31.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-11-27 13:47:10 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:60979: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.97.196.106
country_id: 798549
description:
2025-11-27 13:47:25 dovecot_login authenticator failed for ([46.97.196.106]) [46.97.196.106]:54564: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Nov 27 13:48:15 host2 sshd[681360]: Disconnected from invalid user user2 154.221.28.214 port 33530 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 27 13:50:30 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<rp2gL49EXr0DiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Nov 27 13:51:29 host2 sshd[683952]: Disconnected from invalid user erpnext 154.221.28.214 port 51890 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 27 13:51:59 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<LE7wNI9EsokDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.221.28.214
country_id: 1819730
description:
Nov 27 13:53:03 host2 sshd[684891]: Disconnected from invalid user tuan 154.221.28.214 port 46038 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 27 13:53:24 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<xoQAOo9EprIDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.221.28.214
country_id: 1819730
description:
Nov 27 13:54:32 host2 sshd[686460]: Disconnected from invalid user 1 154.221.28.214 port 43822 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 27 13:54:49 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<944QP49EtNIDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-11-27 13:54:53 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:36565: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.92.115.73
country_id: 6252001
description:
2025-11-27 13:55:29 dovecot_login authenticator failed for ([168.92.115.73]) [168.92.115.73]:34178: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 27 13:55:29 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<wdh6QY9EaJgDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 27 13:57:00 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<ZQXbRo9EsoADiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 27 13:57:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<CU3BSY9EqKADiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 27 13:57:59 host2 dovecot[3107204]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, session=<tClnSo9EbJsDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 27 13:59:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<iutgT49EKO0DiUnd>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 27 13:59:32 host2 dovecot[3107204]: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<hl7tT49EiMoDiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 27 14:01:23 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, session=<g2KKVo9EYJ4DiUnd>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 159.65.152.2
country_id: 1269750
description:
Nov 27 14:02:02 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=159.65.152.2, lip=66.85.158.91, TLS, session=</CziWI9EOLefQZgC>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.89.240.89
country_id: 1210997
description:
Nov 27 14:05:56 host2 sshd[694387]: Disconnected from invalid user tidb 103.89.240.89 port 56968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.89.240.89
country_id: 1210997
description:
Nov 27 14:09:07 host2 sshd[696551]: Disconnected from invalid user amssys 103.89.240.89 port 49308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-27 14:09:19 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:36670: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-11-27 14:09:42 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.148.138.189
country_id: 6252001
description:
Nov 27 14:10:16 host2 sshd[697452]: Disconnected from invalid user 1 135.148.138.189 port 47280 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.89.240.89
country_id: 1210997
description:
Nov 27 14:10:32 host2 sshd[697592]: Disconnected from invalid user laravel 103.89.240.89 port 33934 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.148.138.189
country_id: 6252001
description:
Nov 27 14:11:23 host2 sshd[698275]: Disconnected from invalid user lucas 135.148.138.189 port 43098 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.197
country_id: 6252001
description:
Nov 27 14:13:11 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.197, lip=66.85.158.92, TLS, session=<CfC8gI9EbNCs7OTF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-27 14:12:21 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:36928: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-27 14:12:52 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:42489: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.200.12
country_id: 1861060
description:
Nov 27 14:14:04 host2 sshd[700206]: Disconnected from invalid user alex 160.251.200.12 port 44710 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.89.240.89
country_id: 1210997
description:
Nov 27 14:13:21 host2 sshd[699701]: Disconnected from invalid user ec2-user 103.89.240.89 port 36580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 135.148.138.189
country_id: 6252001
description:
Nov 27 14:13:30 host2 sshd[699815]: Disconnected from invalid user admin1 135.148.138.189 port 51396 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 135.148.138.189
country_id: 6252001
description:
Nov 27 14:14:34 host2 sshd[700479]: Disconnected from invalid user ec2-user 135.148.138.189 port 37196 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 14:16:35 host2 sshd[701793]: Disconnected from invalid user audra 62.60.131.157 port 49283 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.143
country_id: 1880251
description:
Nov 27 14:17:36 host2 sshd[702280]: Disconnected from invalid user postgres 101.47.48.143 port 34644 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 14:17:12 host2 sshd[702132]: Disconnected from invalid user admin 2.57.121.112 port 19341 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.143
country_id: 1880251
description:
Nov 27 14:20:00 host2 sshd[703456]: Disconnected from invalid user student1 101.47.48.143 port 40398 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.200.12
country_id: 1861060
description:
Nov 27 14:20:29 host2 sshd[703914]: Disconnected from invalid user test1 160.251.200.12 port 35314 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-11-27 14:23:59 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:44796: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-11-27 14:23:49 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:58818: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.47.48.143
country_id: 1880251
description:
Nov 27 14:24:46 host2 sshd[706295]: Disconnected from invalid user apagar 101.47.48.143 port 47010 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.203
country_id: 1733045
description:
2025-11-27 14:28:16 dovecot_login authenticator failed for ([49.124.149.203]) [49.124.149.203]:42098: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.185
country_id: 99237
description:
2025-11-27 14:28:26 dovecot_login authenticator failed for ([65.20.185.185]) [65.20.185.185]:43883: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.200.12
country_id: 1861060
description:
Nov 27 14:29:52 host2 sshd[709262]: Disconnected from invalid user grid 160.251.200.12 port 42078 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.138.74
country_id: 1269750
description:
2025-11-27 14:31:00 dovecot_login authenticator failed for ([128.185.241.213]) [125.19.138.74]:36346: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov 27 14:31:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.91, TLS: Connection closed, session=<Q02ewI9EottChJl1>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.128.149
country_id: 1819730
description:
Nov 27 14:31:10 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.128.149, lip=66.85.158.92, session=<Y28WwY9E8o6YIICV>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.166
country_id: 2993457
description:
Nov 27 14:30:35 host2 pure-ftpd[709873]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.128.149
country_id: 1819730
description:
Nov 27 14:31:29 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 18 secs): user=<>, rip=152.32.128.149, lip=66.85.158.92, session=<Dmc4wo9E/o6YIICV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.146.177
country_id: 130758
description:
Nov 27 14:31:41 host2 sshd[710380]: Disconnected from invalid user dmdba 62.60.146.177 port 40286 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-27 14:32:56 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:53928: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 102.23.122.235
country_id: 895949
description:
Nov 27 14:34:07 host2 sshd[711950]: Disconnected from invalid user admin 102.23.122.235 port 6268 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.252
country_id: 1733045
description:
2025-11-27 14:33:29 dovecot_login authenticator failed for ([49.124.150.252]) [49.124.150.252]:50846: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.143
country_id: 1880251
description:
Nov 27 14:34:14 host2 sshd[711991]: Disconnected from invalid user nexus 101.47.48.143 port 49552 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Nov 27 14:35:23 host2 sshd[713020]: Disconnected from invalid user laravel 107.175.159.248 port 54308 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.128.149
country_id: 1819730
description:
Nov 27 14:35:53 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.128.149, lip=66.85.158.91, session=<HPXp0Y9EAJ+YIICV>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 62.60.146.177
country_id: 130758
description:
Nov 27 14:36:32 host2 sshd[713818]: Disconnected from invalid user under 62.60.146.177 port 59814 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 152.32.128.149
country_id: 1819730
description:
Nov 27 14:36:13 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=152.32.128.149, lip=66.85.158.91, session=<ej4k049ENo2YIICV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.146.177
country_id: 130758
description:
Nov 27 14:37:41 host2 sshd[714798]: Disconnected from invalid user minecraft 62.60.146.177 port 35110 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.146.177
country_id: 130758
description:
Nov 27 14:38:49 host2 sshd[715662]: Disconnected from invalid user system 62.60.146.177 port 45158 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Nov 27 14:39:09 host2 sshd[715878]: Disconnected from invalid user superset 107.175.159.248 port 54522 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 102.23.122.235
country_id: 895949
description:
Nov 27 14:40:38 host2 sshd[717285]: Disconnected from invalid user support 102.23.122.235 port 6272 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 14:41:37 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<aZhV5o9EDJ4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-11-27 14:44:43 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (walike) [174.161.27.82]:33973: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-11-27 14:44:48 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:41274: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 158.94.210.79 - 22-mmc-moh "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.10.111
country_id: 927384
description:
2025-11-27 14:44:25 dovecot_login authenticator failed for ([196.216.10.111]) [196.216.10.111]:53680: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.91
country_id: 6252001
description:
Nov 27 14:46:06 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.91, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<9p159o9EON7G6xhb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 107.175.159.248
country_id: 6252001
description:
Nov 27 14:48:31 host2 sshd[724076]: Disconnected from invalid user daniel 107.175.159.248 port 54960 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-11-27 14:52:51 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:45317: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.241.234
country_id: 6252001
description:
2025-11-27 14:53:34 dovecot_login authenticator failed for (c-50-171-241-234.unallocated.comcastbusiness.net) [50.171.241.234]:52672: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 14:56:35 host2 sshd[730803]: Disconnected from invalid user  2.57.121.112 port 61536 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-11-27 14:58:41 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:58732: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2025-11-27 15:02:47 dovecot_login authenticator failed for ([103.174.145.35]) [103.174.145.35]:35766: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.104
country_id: 3996063
description:
2025-11-27 15:03:00 dovecot_login authenticator failed for (201.173.216.104-clientes-izzi.mx) [201.173.216.104]:49648: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.110.36.125
country_id: 3508796
description:
2025-11-27 15:06:02 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.125]:59798: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-11-27 15:06:23 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:39770: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.130
country_id: 1522867
description:
2025-11-27 15:11:44 dovecot_login authenticator failed for ([37.208.46.130]) [37.208.46.130]:35111: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2025-11-27 15:14:54 dovecot_login authenticator failed for ([65.20.187.47]) [65.20.187.47]:58231: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.58.114
country_id: 1269750
description:
2025-11-27 15:22:27 dovecot_login authenticator failed for ([182.95.58.114]) [182.95.58.114]:47518: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-11-27 15:22:42 dovecot_login authenticator failed for ([152.52.199.126]) [152.52.199.126]:44988: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 15:25:54 host2 sshd[750255]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-27 15:25:35 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:45712: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-11-27 15:25:46 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:51740: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-27 15:30:35 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:62271: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.201
country_id: 3469034
description:
2025-11-27 15:30:13 dovecot_login authenticator failed for (ofluminense.static.gvt.net.br) [189.97.236.201]:58088: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 15:33:16 host2 sshd[754980]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 15:33:17 host2 sshd[754970]: Disconnected from invalid user admin 2.57.121.112 port 16996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-11-27 15:43:08 dovecot_login authenticator failed for ([65.20.191.97]) [65.20.191.97]:58548: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.114
country_id: 1269750
description:
2025-11-27 15:43:21 dovecot_login authenticator failed for ([128.185.223.219]) [27.123.111.114]:59814: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-11-27 15:48:28 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:50120: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-11-27 15:48:47 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:58390: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.93
country_id: 3865483
description:
2025-11-27 16:01:24 dovecot_login authenticator failed for (static.90.254.104.190.cps.com.ar) [190.104.254.93]:40403: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.60.142
country_id: 1269750
description:
2025-11-27 16:01:48 dovecot_login authenticator failed for ([152.52.169.97]) [122.186.60.142]:33714: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-11-27 16:06:12 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:32840: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-11-27 16:06:27 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:46194: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.67
country_id: 99237
description:
2025-11-27 16:11:03 dovecot_plain authenticator failed for (unsia) [65.20.129.67]:52837: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-27 16:13:07 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:53128: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-27 16:15:58 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:50404: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.58
country_id: 1733045
description:
2025-11-27 16:16:38 dovecot_login authenticator failed for ([49.124.153.58]) [49.124.153.58]:60638: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 16:19:45 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<udtARZFETMYXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 86.54.31.40
country_id: 6251999
description:
Nov 27 16:25:00 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=86.54.31.40, lip=66.85.158.91, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<YGgpWJFEPKhWNh8o>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-11-27 16:30:31 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:40538: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-27 16:37:29 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:35680: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 209.38.220.179
country_id: 2921044
description:
Nov 27 16:37:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=209.38.220.179, lip=66.85.158.92, session=<v51thJFEl8PRJtyz>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.66.124
country_id: 2921044
description:
Nov 27 16:37:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.66.124, lip=66.85.158.92, session=<lUp7hJFEhslA4kJ8>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-11-27 16:37:43 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:59918: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 16:41:56 host2 sshd[797704]: Disconnected from invalid user  2.57.121.112 port 62886 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-11-27 16:45:24 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:57381: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.46
country_id: 1036973
description:
2025-11-27 16:45:42 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.46]:49850: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-27 16:48:58 dovecot_login authenticator failed for ([197.219.210.86]) [197.219.210.86]:34368: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.188.178.23
country_id: 6252001
description:
2025-11-27 16:49:18 dovecot_login authenticator failed for syn-108-188-178-023.biz.spectrum.com [108.188.178.23]:42101: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.112
country_id: 1880251
description:
Nov 27 16:51:44 host2 sshd[803924]: Disconnected from invalid user developer 45.78.224.112 port 40870 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 185.247.137.242
country_id: 2635167
description:
Nov 27 16:51:52 host2 pure-ftpd[804031]: (?@185.247.137.242) [INFO] New connection from 185.247.137.242


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Nov 27 16:52:52 host2 sshd[804532]: Disconnected from invalid user tibero 152.32.239.90 port 55382 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.253.214.172
country_id: 6252001
description:
Nov 27 16:54:34 host2 sshd[806589]: Disconnected from invalid user testuser 20.253.214.172 port 37058 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Nov 27 16:54:43 host2 sshd[806739]: Disconnected from invalid user vendas 152.32.239.90 port 33380 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.253.214.172
country_id: 6252001
description:
Nov 27 16:55:46 host2 sshd[807615]: Disconnected from invalid user username 20.253.214.172 port 38300 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.253.214.172
country_id: 6252001
description:
Nov 27 16:57:00 host2 sshd[808323]: Disconnected from invalid user astra 20.253.214.172 port 43064 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Nov 27 16:57:12 host2 sshd[808463]: Disconnected from invalid user dolphinscheduler 152.32.239.90 port 32436 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-11-27 16:58:10 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:47144: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.253.214.172
country_id: 6252001
description:
Nov 27 16:58:14 host2 sshd[809083]: Disconnected from invalid user roots 20.253.214.172 port 50872 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.254.239
country_id: 953987
description:
2025-11-27 16:58:21 dovecot_login authenticator failed for ([102.23.254.239]) [102.23.254.239]:48616: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.239.90
country_id: 1819730
description:
Nov 27 16:58:21 host2 sshd[809136]: Disconnected from invalid user ubuntu 152.32.239.90 port 59450 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.239.90
country_id: 1819730
description:
Nov 27 16:59:30 host2 sshd[809869]: Disconnected from invalid user hello 152.32.239.90 port 31472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 153.121.71.26
country_id: 1861060
description:
Nov 27 17:01:57 host2 sshd[811726]: Disconnected from invalid user vps 153.121.71.26 port 37460 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 153.121.71.26
country_id: 1861060
description:
Nov 27 17:03:16 host2 sshd[812841]: Disconnected from invalid user cloudera 153.121.71.26 port 52420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 46.101.184.248
country_id: 2921044
description:
Nov 27 17:03:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=46.101.184.248, lip=66.85.158.92, session=<6BCw4pFEgEUuZbj4>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.254.185
country_id: 2921044
description:
Nov 27 17:03:43 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=104.248.254.185, lip=66.85.158.92, session=<Vzig4pFEWURo+P65>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-27 17:05:01 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:52148: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2025-11-27 17:05:15 dovecot_login authenticator failed for ([101.168.17.20]) [101.168.17.20]:50296: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 153.121.71.26
country_id: 1861060
description:
Nov 27 17:05:44 host2 sshd[814673]: Disconnected from invalid user frappe 153.121.71.26 port 37402 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 153.121.71.26
country_id: 1861060
description:
Nov 27 17:06:57 host2 sshd[815365]: Disconnected from invalid user ftpuser 153.121.71.26 port 49716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.167.228.74
country_id: 933860
description:
Nov 27 17:08:31 host2 sshd[816349]: Disconnected from invalid user admin 168.167.228.74 port 32491 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.102
country_id: 1149361
description:
2025-11-27 17:10:07 dovecot_login authenticator failed for ([180.94.75.102]) [180.94.75.102]:60834: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2025-11-27 17:10:25 dovecot_login authenticator failed for ([62.201.228.210]) [62.201.228.210]:59498: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.167.228.74
country_id: 933860
description:
Nov 27 17:11:21 host2 sshd[818368]: Disconnected from invalid user afa 168.167.228.74 port 32493 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Nov 27 17:11:23 host2 sshd[818383]: Disconnected from invalid user ariel 64.227.176.54 port 59512 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.112
country_id: 1880251
description:
Nov 27 17:12:08 host2 sshd[818943]: Disconnected from invalid user odoo 45.78.224.112 port 37976 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 64.227.176.54
country_id: 1269750
description:
Nov 27 17:13:55 host2 sshd[819953]: Disconnected from invalid user zookeeper 64.227.176.54 port 36344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Nov 27 17:15:12 host2 sshd[820995]: Disconnected from invalid user test 64.227.176.54 port 33080 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-11-27 17:15:19 dovecot_login authenticator failed for ([118.26.153.84]) [118.26.153.84]:49070: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Nov 27 17:14:43 host2 sshd[820403]: Disconnected from invalid user toto 35.200.237.19 port 1131 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-27 17:14:46 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:47702: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.176.54
country_id: 1269750
description:
Nov 27 17:16:24 host2 sshd[821820]: Disconnected from invalid user guest 64.227.176.54 port 39412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Nov 27 17:17:26 host2 sshd[822500]: Disconnected from invalid user kyt 35.200.237.19 port 1114 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 17:18:47 host2 sshd[823405]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.112
country_id: 1880251
description:
Nov 27 17:19:25 host2 sshd[823793]: Disconnected from invalid user ventas01 45.78.224.112 port 45626 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.200.237.19
country_id: 1269750
description:
Nov 27 17:18:52 host2 sshd[823436]: Disconnected from invalid user service 35.200.237.19 port 1124 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.90
country_id: 6252001
description:
2025-11-27 17:20:23 dovecot_login authenticator failed for ([70.174.168.90]) [70.174.168.90]:34422: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.200.237.19
country_id: 1269750
description:
Nov 27 17:20:25 host2 sshd[824767]: Disconnected from invalid user zookeeper 35.200.237.19 port 1095 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-27 17:20:42 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:60470: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.224.112
country_id: 1880251
description:
Nov 27 17:21:47 host2 sshd[825620]: Disconnected from invalid user old 45.78.224.112 port 39696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 17:23:27 host2 sshd[826766]: Disconnected from invalid user malaysia 62.60.131.157 port 44504 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.209.229.158
country_id: 597427
description:
2025-11-27 17:24:34 dovecot_login authenticator failed for 5bjf.l.time4vps.cloud (t6wer.top) [80.209.229.158]:28136: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 17:26:12 host2 sshd[829310]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 17:28:00 host2 sshd[830522]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-11-27 17:27:50 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:45954: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-27 17:28:05 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:43001: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-11-27 17:32:44 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:57680: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.222.177.146
country_id: 6252001
description:
2025-11-27 17:40:30 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:50575: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2025-11-27 17:40:56 dovecot_login authenticator failed for ([103.147.248.23]) [103.147.248.23]:48586: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-27 17:49:24 dovecot_login authenticator failed for (7q9STfo4) [178.16.54.32]:53212: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-27 17:49:48 dovecot_login authenticator failed for (IZDR6z4z) [178.16.54.32]:61851: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-27 17:50:36 dovecot_login authenticator failed for (2EpzOAlk54) [178.16.54.32]:61874: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.32
country_id: 2750405
description:
2025-11-27 17:51:42 dovecot_login authenticator failed for (xGpaRECZv1) [178.16.54.32]:52932: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.62.50.36
country_id: 298795
description:
2025-11-27 17:56:33 dovecot_login authenticator failed for (dynamic-195-62-50-36.cgnat.wi.hiperonline.com.tr) [195.62.50.36]:59351: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-27 17:56:56 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:44114: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.172.177.191
country_id: 1269750
description:
Nov 27 17:57:31 host2 sshd[853610]: Disconnected from invalid user admin 52.172.177.191 port 37348 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.172.177.191
country_id: 1269750
description:
Nov 27 17:58:58 host2 sshd[854355]: Disconnected from invalid user admin123 52.172.177.191 port 47034 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 27 17:59:48 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<store@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<VoENq5JEwt+SOC+J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-27 18:02:18 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:60651: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.63.102.21
country_id: 1269750
description:
2025-11-27 18:03:05 dovecot_login authenticator failed for s-21-102-63-202.southernonline.net [202.63.102.21]:10690: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.172.177.191
country_id: 1269750
description:
Nov 27 18:03:41 host2 sshd[857732]: Disconnected from invalid user martin 52.172.177.191 port 33800 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-11-27 18:05:40 dovecot_login authenticator failed for (nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:52074: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-11-27 18:06:06 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:32957: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 192.81.217.140
country_id: 6252001
description:
Nov 27 18:06:59 host2 pure-ftpd[859832]: (?@192.81.217.140) [INFO] New connection from 192.81.217.140


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.232.140.38
country_id: 6252001
description:
Nov 27 18:06:59 host2 pure-ftpd[859830]: (?@165.232.140.38) [INFO] New connection from 165.232.140.38


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Nov 27 18:11:03 host2 sshd[862441]: Disconnected from invalid user testftp 103.118.114.22 port 42076 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
country_id: 1819730
description:
2025-11-27 18:11:57 dovecot_login authenticator failed for ([118.26.153.84]) [118.26.153.84]:47100: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.32.144.232
country_id: 6252001
description:
2025-11-27 18:12:17 dovecot_login authenticator failed for (syn-065-032-144-232.res.spectrum.com) [65.32.144.232]:53812: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 18:17:16 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<K12u6ZJEkJ0DhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.167.54.38
country_id: 6252001
description:
2025-11-27 18:18:26 dovecot_plain authenticator failed for ec2-54-167-54-38.compute-1.amazonaws.com (EC2AMAZ-F8HJOCC.ec2.internal) [54.167.54.38]:51937: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.167.54.38
country_id: 6252001
description:
2025-11-27 18:18:32 dovecot_login authenticator failed for ec2-54-167-54-38.compute-1.amazonaws.com (EC2AMAZ-F8HJOCC.ec2.internal) [54.167.54.38]:51937: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-11-27 18:20:04 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:40824: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-11-27 18:20:12 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:38742: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 18:19:43 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<u1Jw8pJEuLwDhpQ7>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 18:20:46 host2 dovecot[3107204]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<ZX009pJEis4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 18:20:46 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<TGUu9pJEgM4DhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 18:22:04 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<Kk/T+pJECsQDhpQ7>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.118.114.22
country_id: 1269750
description:
Nov 27 18:21:26 host2 sshd[869283]: Disconnected from invalid user ali 103.118.114.22 port 47624 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Nov 27 18:23:08 host2 sshd[870293]: Disconnected from invalid user cesar 103.118.114.22 port 49946 [preauth]


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 18:23:16 host2 dovecot[3107204]: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<XCoi/5JEeOwDhpQ7>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 18:23:21 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.92, session=<pwVr/5JEDLwDhpQ7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.118.114.22
country_id: 1269750
description:
Nov 27 18:24:53 host2 sshd[871233]: Disconnected from invalid user db2fenc1 103.118.114.22 port 52292 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 27 18:25:24 host2 dovecot[3107204]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=66.85.158.91, session=<g/O/BpNEhIADhpQ7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-11-27 18:26:32 dovecot_login authenticator failed for ([186.239.240.127]) [186.215.245.175]:53426: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.98
country_id: 6252001
description:
2025-11-27 18:27:04 dovecot_login authenticator failed for ([70.174.168.98]) [70.174.168.98]:54346: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.80.100.235
country_id: 6252001
description:
2025-11-27 18:28:14 dovecot_login authenticator failed for 216-80-100-235.il.subnet.cable.rcncustomer.com [216.80.100.235]:44561: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.209
country_id: 1733045
description:
2025-11-27 18:28:03 dovecot_login authenticator failed for ([49.124.149.209]) [49.124.149.209]:58702: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 18:28:10 host2 sshd[873106]: Disconnected from invalid user  2.57.121.112 port 62252 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.167.54.38
country_id: 6252001
description:
2025-11-27 18:30:43 dovecot_plain authenticator failed for ec2-54-167-54-38.compute-1.amazonaws.com (EC2AMAZ-F8HJOCC.ec2.internal) [54.167.54.38]:62608: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.167.54.38
country_id: 6252001
description:
2025-11-27 18:32:50 dovecot_plain authenticator failed for ec2-54-167-54-38.compute-1.amazonaws.com (EC2AMAZ-F8HJOCC.ec2.internal) [54.167.54.38]:53928: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Nov 27 18:33:27 host2 sshd[876890]: Disconnected from invalid user dangulo 103.143.238.173 port 42146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Nov 27 18:35:06 host2 sshd[878387]: Disconnected from invalid user grid 103.143.238.173 port 41398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.167.54.38
country_id: 6252001
description:
2025-11-27 18:35:39 dovecot_login authenticator failed for ec2-54-167-54-38.compute-1.amazonaws.com (EC2AMAZ-F8HJOCC.ec2.internal) [54.167.54.38]:53928: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-11-27 18:35:57 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:60709: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.143.238.173
country_id: 1819730
description:
Nov 27 18:36:26 host2 sshd[879358]: Disconnected from invalid user root1 103.143.238.173 port 56768 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 18:37:05 host2 sshd[879738]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.143.238.173
country_id: 1819730
description:
Nov 27 18:37:45 host2 sshd[880175]: Disconnected from invalid user bodega 103.143.238.173 port 46334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 18:42:59 host2 sshd[883155]: Disconnected from invalid user aubrie 62.60.131.157 port 32828 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-11-27 18:48:44 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:58630: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-11-27 18:48:56 dovecot_login authenticator failed for ([152.52.236.122]) [152.52.236.122]:46808: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.202
country_id: 6251999
description:
Nov 27 18:57:40 host2 pure-ftpd[892986]: (?@148.113.214.202) [INFO] New connection from 148.113.214.202


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.214.202
country_id: 6251999
description:
Nov 27 19:00:05 host2 pure-ftpd[894450]: (?@148.113.214.202) [INFO] New connection from 148.113.214.202


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.214.202
country_id: 6251999
description:
Nov 27 19:00:09 host2 pure-ftpd[894511]: (?@148.113.214.202) [INFO] New connection from 148.113.214.202


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-27 19:00:15 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:54340: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 27 19:06:02 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.193.59, lip=66.85.158.92, session=<2cANmJNEDsOUccE7>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 27 19:06:03 host2 pure-ftpd[898958]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 27 19:07:28 host2 pure-ftpd[899977]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 148.113.193.59
country_id: 6251999
description:
Nov 27 19:07:32 host2 pure-ftpd[900028]: (?@148.113.193.59) [INFO] New connection from 148.113.193.59


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.45
country_id: 1880251
description:
Nov 27 19:08:43 host2 sshd[901030]: Disconnected from invalid user adsl 45.78.227.45 port 43928 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.202.107
country_id: 6252001
description:
Nov 27 19:10:25 host2 sshd[902737]: Disconnected from invalid user zjw 137.184.202.107 port 53062 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-27 19:10:41 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:36454: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-27 19:10:57 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:50878: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 19:12:23 host2 sshd[904016]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 27 19:11:27 host2 sshd[903364]: Disconnected from invalid user mcserver 160.251.251.171 port 41226 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-27 19:11:51 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:50728: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.56
country_id: 1269750
description:
2025-11-27 19:12:14 dovecot_login authenticator failed for (nsg-corporate-56.234.187.122.airtel.in) [122.187.234.56]:52985: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 137.184.202.107
country_id: 6252001
description:
Nov 27 19:13:53 host2 sshd[905469]: Disconnected from invalid user student 137.184.202.107 port 53254 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.202.107
country_id: 6252001
description:
Nov 27 19:15:00 host2 sshd[906149]: Disconnected from invalid user andy 137.184.202.107 port 33160 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 27 19:14:53 host2 sshd[906087]: Disconnected from invalid user dmdba 160.251.251.171 port 49702 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.45
country_id: 1880251
description:
Nov 27 19:14:55 host2 sshd[906097]: Disconnected from invalid user ajay 45.78.227.45 port 35526 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Nov 27 19:16:30 host2 sshd[907321]: Disconnected from invalid user hello 35.237.94.18 port 57786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Nov 27 19:17:42 host2 sshd[908108]: Disconnected from invalid user git 35.237.94.18 port 59634 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 137.184.202.107
country_id: 6252001
description:
Nov 27 19:17:11 host2 sshd[907741]: Disconnected from invalid user test01 137.184.202.107 port 59182 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.237.94.18
country_id: 6252001
description:
Nov 27 19:18:50 host2 sshd[908941]: Disconnected from invalid user user5 35.237.94.18 port 33236 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 19:19:50 host2 sshd[909590]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 19:20:31 host2 sshd[910199]: Disconnected from invalid user admin 2.57.121.112 port 59567 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.237.94.18
country_id: 6252001
description:
Nov 27 19:21:18 host2 sshd[910708]: Disconnected from invalid user bkp 35.237.94.18 port 36934 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-27 19:22:37 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:34554: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.62
country_id: 3996063
description:
2025-11-27 19:22:46 dovecot_login authenticator failed for (201.173.216.62-clientes-izzi.mx) [201.173.216.62]:60672: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.45
country_id: 1880251
description:
Nov 27 19:22:20 host2 sshd[911315]: Disconnected from invalid user sonar 45.78.227.45 port 52698 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2025-11-27 19:22:20 dovecot_plain authenticator failed for c-73-145-107-251.hsd1.mi.comcast.net (ovelene) [73.145.107.251]:43010: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 19:27:18 host2 sshd[914925]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 160.251.251.171
country_id: 1861060
description:
Nov 27 19:28:04 host2 sshd[915658]: Disconnected from invalid user app 160.251.251.171 port 47848 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov 27 19:28:45 host2 sshd[916255]: Disconnected from invalid user 123 20.102.116.25 port 41068 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.26
country_id: 2017370
description:
2025-11-27 19:28:49 dovecot_login authenticator failed for ([46.8.240.26]) [46.8.240.26]:45332: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.226.192
country_id: 6251999
description:
2025-11-27 19:29:01 dovecot_login authenticator failed for host-24-224-226-192.public.eastlink.ca [24.224.226.192]:57766: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.185.24.228
country_id: 6252001
description:
Nov 27 19:29:10 host2 sshd[916535]: Disconnected from invalid user bwadmin 172.185.24.228 port 44962 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 27 19:29:53 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=51.222.152.150, lip=66.85.158.91, session=<1rZf7ZNE4rwz3piW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov 27 19:29:58 host2 sshd[917032]: Disconnected from invalid user peter 20.102.116.25 port 57384 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 27 19:30:23 host2 sshd[917510]: Disconnected from invalid user db2inst1 92.185.99.40 port 42910 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-11-27 19:30:29 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:33828: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-11-27 19:30:49 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:46430: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 27 19:31:24 host2 sshd[918207]: Disconnected from invalid user carlos 92.185.99.40 port 42792 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 27 19:31:46 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=51.222.152.150, lip=66.85.158.91, TLS: Connection closed, session=<QAgZ9JNEiswz3piW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 27 19:32:29 host2 sshd[919020]: Disconnected from invalid user user 92.185.99.40 port 46682 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.185.24.228
country_id: 6252001
description:
Nov 27 19:32:11 host2 sshd[918821]: Disconnected from invalid user opc 172.185.24.228 port 53684 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 51.222.152.150
country_id: 6251999
description:
Nov 27 19:33:12 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=51.222.152.150, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<vY0z+ZNE5MMz3piW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.185.24.228
country_id: 6252001
description:
Nov 27 19:33:31 host2 sshd[919756]: Disconnected from invalid user carlos 172.185.24.228 port 57604 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.185.99.40
country_id: 2510769
description:
Nov 27 19:33:33 host2 sshd[919781]: Disconnected from invalid user user1 92.185.99.40 port 53920 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.172
country_id: 6252001
description:
Nov 27 19:35:29 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 45 secs): user=<>, rip=147.185.133.172, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<UP5oAZREbsOTuYWs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov 27 19:35:13 host2 sshd[921222]: Disconnected from invalid user zjw 20.102.116.25 port 51320 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.185.24.228
country_id: 6252001
description:
Nov 27 19:36:19 host2 sshd[921935]: Disconnected from invalid user python 172.185.24.228 port 42906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov 27 19:36:31 host2 sshd[922034]: Disconnected from invalid user carlos 20.102.116.25 port 58712 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.102.116.25
country_id: 6252001
description:
Nov 27 19:37:52 host2 sshd[922943]: Disconnected from invalid user user 20.102.116.25 port 43408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.185.24.228
country_id: 6252001
description:
Nov 27 19:40:26 host2 sshd[925007]: Disconnected from invalid user operador 172.185.24.228 port 34060 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.172
country_id: 6252001
description:
Nov 27 19:40:44 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.172, lip=66.85.158.92, TLS, session=<u7guFJREZveTuYWs>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Nov 27 19:48:18 host2 sshd[930993]: Disconnected from invalid user vlad 190.181.27.22 port 58458 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-27 19:50:08 dovecot_plain authenticator failed for (rally) [178.250.191.189]:36870: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.236.140.19
country_id: 1643084
description:
Nov 27 19:50:58 host2 sshd[932888]: Disconnected from invalid user airflow 103.236.140.19 port 35114 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-11-27 19:53:41 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:46160: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Nov 27 19:53:16 host2 sshd[934413]: Disconnected from invalid user onkar 190.181.27.22 port 34140 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.51.50
country_id: 953987
description:
2025-11-27 19:53:22 dovecot_login authenticator failed for (102.221.51.50) [102.221.51.50]:37114: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Nov 27 19:54:47 host2 sshd[936188]: Disconnected from invalid user will 190.181.27.22 port 53534 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.236.140.19
country_id: 1643084
description:
Nov 27 19:55:00 host2 sshd[936296]: Disconnected from invalid user user 103.236.140.19 port 59738 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 190.181.27.22
country_id: 3923057
description:
Nov 27 19:57:33 host2 sshd[937839]: Disconnected from invalid user tempuser 190.181.27.22 port 44762 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.74
country_id: 1269750
description:
2025-11-27 19:58:15 dovecot_login authenticator failed for ([152.52.192.74]) [152.52.192.74]:55742: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2025-11-27 19:58:26 dovecot_login authenticator failed for ([182.79.86.102]) [182.79.86.102]:42228: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.227.45
country_id: 1880251
description:
Nov 27 19:58:28 host2 sshd[938289]: Disconnected from invalid user sales1 45.78.227.45 port 34112 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.181.27.22
country_id: 3923057
description:
Nov 27 19:58:58 host2 sshd[938548]: Disconnected from invalid user debian 190.181.27.22 port 45398 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2025-11-27 19:59:59 dovecot_login authenticator failed for (124-170-26-169.tpgi.com.au) [124.170.26.169]:56790: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-11-27 20:00:12 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:42151: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-11-27 20:00:19 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:57971: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-11-27 20:00:34 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:37151: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-11-27 20:00:58 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:45433: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-27 20:01:09 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:26118: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 20:02:17 host2 sshd[940638]: Disconnected from invalid user infant 62.60.131.157 port 22966 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.126
country_id: 1880251
description:
Nov 27 20:03:55 host2 sshd[942081]: Disconnected from invalid user airflow 45.78.204.126 port 33780 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.84.132.142
country_id: 192950
description:
Nov 27 20:09:22 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=41.84.132.142, lip=66.85.158.91, TLS, session=<rAxVeZRE++MpVISO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-11-27 20:09:28 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:36713: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2025-11-27 20:09:42 dovecot_login authenticator failed for ns3241969.ip-57-129-90.eu [57.129.90.215]:55414: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.121.195
country_id: 3865483
description:
Nov 27 20:09:46 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 21 secs): user=<587hr>, method=PLAIN, rip=190.181.121.195, lip=66.85.158.91, TLS, session=<Q/bEepREEpu+tXnD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 20:13:03 host2 sshd[947395]: Disconnected from invalid user  2.57.121.112 port 62247 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.204.126
country_id: 1880251
description:
Nov 27 20:17:57 host2 sshd[950025]: Disconnected from invalid user user10 45.78.204.126 port 56992 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-11-27 20:19:48 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:50014: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-27 20:20:05 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:45601: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.226.51
country_id: 1819730
description:
2025-11-27 20:28:14 dovecot_login authenticator failed for (223-197-226-51.static.imsbiz.com) [223.197.226.51]:65049: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-11-27 20:29:02 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:38694: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-27 20:29:12 dovecot_login authenticator failed for ([125.19.248.170]) [125.19.248.170]:58896: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-27 20:31:34 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:58021: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-27 20:33:48 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:18377: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.5.63.166
country_id: 1694008
description:
2025-11-27 20:33:58 dovecot_login authenticator failed for ([103.5.63.166]) [103.5.63.166]:41737: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.126
country_id: 1880251
description:
Nov 27 20:34:13 host2 sshd[960092]: Disconnected from invalid user asterisk 45.78.204.126 port 53402 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 27 20:42:21 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=207.90.244.14, lip=66.85.158.92, session=<ZWWC8JRExrDPWvQO>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 27 20:42:21 host2 dovecot[3107204]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, TLS, session=<XoCF8JREZINHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.146.130
country_id: 6252001
description:
Nov 27 20:42:21 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record (no auth attempts in 0 secs): user=<>, rip=71.6.146.130, lip=66.85.158.92, TLS: SSL_read failed: error:140940F5:SSL routines:ssl3_read_bytes:unexpected record, session=<yfmI8JREEIVHBpKC>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.54
country_id: 6252001
description:
Nov 27 20:43:05 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.54, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Mooi85RE0TdBMQE2>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Nov 27 20:43:23 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=65.49.1.52, lip=66.85.158.91, TLS handshaking: Connection closed, session=<ieYz9JRE+mRBMQE0>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 207.90.244.14
country_id: 6252001
description:
Nov 27 20:44:16 host2 dovecot[3107204]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=207.90.244.14, lip=66.85.158.91, session=<FqFe95REEKLPWvQO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-11-27 20:45:44 dovecot_login authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:57325: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-11-27 20:45:54 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:39234: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 20:53:51 host2 sshd[972839]: Disconnected from invalid user kaycee 62.60.131.157 port 28996 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.107.70
country_id: 3469034
description:
2025-11-27 20:56:34 dovecot_login authenticator failed for (72-107-226-38.edgetelecom.com.br) [38.226.107.70]:40425: 535 Incorrect authentication data (set_id=agro@maximsholdings.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.110.11.48
country_id: 2464461
description:
2025-11-27 20:56:48 dovecot_login authenticator failed for ([102.110.11.48]) [102.110.11.48]:2754: 535 Incorrect authentication data (set_id=agro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.225.255.82
country_id: 2510769
description:
2025-11-27 20:57:50 dovecot_login authenticator failed for (82.red.255.225.212.procono.es) [212.225.255.82]:34041: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2025-11-27 20:58:08 dovecot_login authenticator failed for ([102.23.242.223]) [102.23.242.223]:51610: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 21:01:14 host2 sshd[978211]: Disconnected from invalid user admin 2.57.121.112 port 27616 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.45.194
country_id: 2921044
description:
Nov 27 21:04:01 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=783) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=8.211.45.194, lip=66.85.158.92, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<9k38PZVErNEI0y3C>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 47.251.53.147
country_id: 6252001
description:
Nov 27 21:04:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=47.251.53.147, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<JYvLP5VE2o4v+zWT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.45.194
country_id: 2921044
description:
Nov 27 21:04:31 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=8.211.45.194, lip=66.85.158.92, TLS, session=<D0zIP5VEuNEI0y3C>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 21:06:57 host2 sshd[982242]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.106
country_id: 6252001
description:
Nov 27 21:08:41 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 46 secs): user=<>, rip=147.185.133.106, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<Zfe4TpVEutqTuYVq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.106
country_id: 6252001
description:
Nov 27 21:09:09 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 9 secs): user=<>, rip=147.185.133.106, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<FalhUJVEUO+TuYVq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Nov 27 21:13:21 host2 sshd[987225]: Disconnected from invalid user guest 20.123.146.92 port 53098 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 21:14:36 host2 sshd[988038]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 74.82.47.3
country_id: 6252001
description:
Nov 27 21:14:22 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=74.82.47.3, lip=66.85.158.92, TLS handshaking: Connection closed, session=<A5gAY5VEWH1KUi8D>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.106
country_id: 6252001
description:
Nov 27 21:15:04 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.106, lip=66.85.158.91, TLS, session=<x4qLZZVEfOmTuYVq>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.58
country_id: 6252001
description:
Nov 27 21:14:08 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.58, lip=66.85.158.92, session=<k1EzYpVEU0ZBMQE6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 65.49.1.52
country_id: 6252001
description:
Nov 27 21:14:19 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=65.49.1.52, lip=66.85.158.92, TLS: Connection closed, session=<wT7bYpVEFFhBMQE0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.93
country_id: 2750405
description:
Nov 27 21:17:09 host2 sshd[989821]: Disconnected from invalid user joe 20.123.146.93 port 61755 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-27 21:18:16 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:40542: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-27 21:18:26 dovecot_login authenticator failed for (nsg-corporate-199.227.187.122.airtel.in) [122.187.227.199]:38109: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 21:20:38 host2 dovecot[3107204]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<f1ZQeZVEBOgXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-27 21:20:58 dovecot_login authenticator failed for ([182.78.255.201]) [125.20.245.182]:49490: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-11-27 21:21:23 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:58739: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 158.94.210.79 - info "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user info (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Nov 27 21:22:14 host2 sshd[993454]: Disconnected from invalid user ariel 4.210.186.201 port 16677 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.250.9
country_id: 3469034
description:
Nov 27 21:25:40 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=186.209.250.9, lip=66.85.158.91, TLS, session=<MZdkipVEcuW60foJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.227.35.113
country_id: 3865483
description:
Nov 27 21:26:03 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<accounts2>, method=PLAIN, rip=45.227.35.113, lip=66.85.158.91, TLS, session=<8mmZi5VERJkt4yNx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.87.201.130
country_id: 3469034
description:
Nov 27 21:26:47 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 22 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.87.201.130, lip=66.85.158.91, TLS, session=<SzEijpVEoOOxV8mC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.41.175.52
country_id: 798544
description:
Nov 27 21:27:05 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=193.41.175.52, lip=66.85.158.91, TLS, session=<0M6Fj5VE0LPBKa80>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Nov 27 21:28:56 host2 sshd[998186]: Disconnected from invalid user git 20.123.146.92 port 56450 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.129.64.237
country_id: 2921044
description:
Nov 27 21:29:34 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 8 secs): user=<>, rip=57.129.64.237, lip=66.85.158.92, session=<CeVbmZVEGug5gUDt>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.123.146.92
country_id: 2750405
description:
Nov 27 21:30:16 host2 sshd[999097]: Disconnected from invalid user node 20.123.146.92 port 34057 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.24.76
country_id: 2921044
description:
Nov 27 21:35:57 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=157.230.24.76, lip=66.85.158.91, TLS handshaking: read(size=1026) failed: Connection reset by peer, session=<1XQysJVEu9+d5hhM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 157.230.24.76
country_id: 2921044
description:
Nov 27 21:36:09 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=157.230.24.76, lip=66.85.158.91, TLS handshaking: Connection closed, session=<z3ntsJVEqySd5hhM>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.179.135
country_id: 2921044
description:
Nov 27 21:36:32 host2 dovecot[3107204]: imap-login: Disconnected: Connection closed (no auth attempts in 20 secs): user=<>, rip=138.197.179.135, lip=66.85.158.91, TLS handshaking: Connection closed, session=<fi9PspVEWG6KxbOH>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Nov 27 21:38:20 host2 sshd[1004787]: Disconnected from invalid user dixi 20.123.146.95 port 45013 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Nov 27 21:39:39 host2 sshd[1014689]: Disconnected from invalid user test 4.210.186.201 port 63773 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.95
country_id: 2750405
description:
Nov 27 21:40:59 host2 sshd[1018942]: Disconnected from invalid user kyt 20.123.146.95 port 59832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.92
country_id: 2750405
description:
Nov 27 21:42:20 host2 sshd[1019803]: Disconnected from invalid user python 20.123.146.92 port 40186 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.210.194
country_id: 719819
description:
Nov 27 21:42:50 host2 sshd[1019990]: Disconnected from invalid user crafty 195.199.210.194 port 36172 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.210.194
country_id: 719819
description:
Nov 27 21:44:35 host2 sshd[1020968]: Disconnected from invalid user myuser 195.199.210.194 port 40070 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 195.199.210.194
country_id: 719819
description:
Nov 27 21:45:52 host2 sshd[1022105]: Disconnected from invalid user sahil 195.199.210.194 port 48170 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 4.210.186.201
country_id: 2750405
description:
Nov 27 21:46:24 host2 sshd[1022395]: Disconnected from invalid user debianuser 4.210.186.201 port 29683 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.123.146.94
country_id: 2750405
description:
Nov 27 21:47:48 host2 sshd[1023339]: Disconnected from invalid user zookeeper 20.123.146.94 port 49284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.62.8.17
country_id: 1269750
description:
Nov 27 21:47:16 host2 sshd[1023035]: Disconnected from invalid user intel 120.62.8.17 port 51334 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 20.197.33.53
country_id: 1269750
description:
Nov 27 21:49:05 host2 sshd[1024130]: Disconnected from invalid user ubuntu 20.197.33.53 port 57270 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 20.197.33.53
country_id: 1269750
description:
Nov 27 21:50:27 host2 sshd[1025315]: Disconnected from invalid user bodega 20.197.33.53 port 46968 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 195.199.210.194
country_id: 719819
description:
Nov 27 21:51:20 host2 sshd[1026114]: Disconnected from invalid user customer 195.199.210.194 port 58646 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.125
country_id: 6252001
description:
Nov 27 21:57:08 host2 pure-ftpd[1030923]: (?@66.132.153.125) [INFO] New connection from 66.132.153.125


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Nov 27 22:03:51 host2 sshd[1036082]: Disconnected from invalid user superadmin 201.249.205.94 port 34242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.163
country_id: 1643084
description:
Nov 27 22:05:50 host2 sshd[1037491]: Disconnected from invalid user cgpexpert 103.139.192.163 port 41126 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.233.136.201
country_id: 732800
description:
Nov 27 22:06:05 host2 sshd[1037654]: Disconnected from invalid user james 212.233.136.201 port 58236 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 22:07:15 host2 sshd[1038390]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.249.205.94
country_id: 3625428
description:
Nov 27 22:09:02 host2 sshd[1039682]: Disconnected from invalid user intell 201.249.205.94 port 39038 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 173.0.60.163
country_id: 6252001
description:
Nov 27 22:08:31 host2 sshd[1039299]: Disconnected from invalid user sinusbot 173.0.60.163 port 59712 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 27 22:09:13 host2 sshd[1039782]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 173.0.60.163
country_id: 6252001
description:
Nov 27 22:09:44 host2 sshd[1040183]: Disconnected from invalid user dbadmin 173.0.60.163 port 34166 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.163
country_id: 1643084
description:
Nov 27 22:09:52 host2 sshd[1040281]: Disconnected from invalid user dmdba 103.139.192.163 port 43276 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2025-11-27 22:10:11 dovecot_login authenticator failed for ([125.21.153.217]) [182.95.46.186]:47536: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Nov 27 22:10:20 host2 sshd[1040814]: Disconnected from invalid user bot 201.249.205.94 port 38150 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.96.151.198
country_id: 3996063
description:
Nov 27 22:10:24 host2 sshd[1040848]: Disconnected from invalid user terraria 186.96.151.198 port 52092 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-11-27 22:10:44 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:46084: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.233.136.201
country_id: 732800
description:
Nov 27 22:11:59 host2 sshd[1041899]: Disconnected from invalid user ali 212.233.136.201 port 46864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.196.50.91
country_id: 3469034
description:
Nov 27 22:11:09 host2 sshd[1041406]: Disconnected from invalid user bob 200.196.50.91 port 47099 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.96.151.198
country_id: 3996063
description:
Nov 27 22:11:32 host2 sshd[1041623]: Disconnected from invalid user superadmin 186.96.151.198 port 57746 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.249.205.94
country_id: 3625428
description:
Nov 27 22:12:46 host2 sshd[1042499]: Disconnected from invalid user astra 201.249.205.94 port 43340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 173.0.60.163
country_id: 6252001
description:
Nov 27 22:12:08 host2 sshd[1042016]: Disconnected from invalid user cacti 173.0.60.163 port 39516 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-27 22:12:30 dovecot_login authenticator failed for ([125.17.182.121]) [182.95.224.62]:42576: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.78
country_id: 2328926
description:
2025-11-27 22:13:49 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.78]:14891: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.139.192.163
country_id: 1643084
description:
Nov 27 22:13:56 host2 sshd[1043317]: Disconnected from invalid user kiosk 103.139.192.163 port 53842 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.196.50.91
country_id: 3469034
description:
Nov 27 22:14:24 host2 sshd[1043632]: Disconnected from invalid user max 200.196.50.91 port 43814 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.233.136.201
country_id: 732800
description:
Nov 27 22:14:59 host2 sshd[1043954]: Disconnected from invalid user adam 212.233.136.201 port 41152 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-11-27 22:14:18 dovecot_login authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:50712: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.139.192.163
country_id: 1643084
description:
Nov 27 22:15:52 host2 sshd[1044621]: Disconnected from invalid user gns3 103.139.192.163 port 38600 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.196.50.91
country_id: 3469034
description:
Nov 27 22:17:17 host2 sshd[1045571]: Disconnected from invalid user work 200.196.50.91 port 45498 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.65.192.160
country_id: 6252001
description:
Nov 27 22:18:25 host2 pure-ftpd[1046389]: (?@20.65.192.160) [INFO] New connection from 20.65.192.160


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 200.196.50.91
country_id: 3469034
description:
Nov 27 22:18:37 host2 sshd[1046479]: Disconnected from invalid user magento 200.196.50.91 port 60469 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.97
country_id: 6252001
description:
Nov 27 22:23:22 host2 pure-ftpd[1049786]: (?@198.235.24.97) [INFO] New connection from 198.235.24.97


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 54.145.225.58
country_id: 6252001
description:
Nov 27 22:23:31 host2 pure-ftpd[1049864]: (?@54.145.225.58) [INFO] New connection from 54.145.225.58


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 212.233.136.201
country_id: 732800
description:
Nov 27 22:29:44 host2 sshd[1054472]: Disconnected from invalid user admin 212.233.136.201 port 44968 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 66.132.153.131
country_id: 6252001
description:
Nov 27 22:33:12 host2 pure-ftpd[1057133]: (?@66.132.153.131) [INFO] New connection from 66.132.153.131


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 66.132.153.131
country_id: 6252001
description:
Nov 27 22:33:20 host2 pure-ftpd[1057224]: (?@66.132.153.131) [INFO] New connection from 66.132.153.131


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.166
country_id: 6252001
description:
Nov 27 22:40:38 host2 pure-ftpd[1062576]: (?@205.210.31.166) [INFO] New connection from 205.210.31.166


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Nov 27 22:43:58 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<LFBzo5ZEFprY2s5E>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 216.218.206.68
country_id: 6252001
description:
Nov 27 22:44:19 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 4 secs): user=<>, rip=216.218.206.68, lip=66.85.158.91, TLS handshaking: Connection closed, session=<9G6vpJZEHq7Y2s5E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-11-27 22:55:31 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (prent) [68.46.148.180]:37580: 535 Incorrect authentication data (set_id=info@systemtec.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 22:56:41 host2 sshd[1076878]: Disconnected from invalid user  2.57.121.112 port 61219 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 185.242.226.17
country_id: 6252001
description:
Nov 27 22:57:24 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (disconnected before auth was ready, waited 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.91, session=<UN9+05ZE0Le58uIR>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.242.226.17
country_id: 6252001
description:
Nov 27 22:59:01 host2 dovecot[1005950]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=185.242.226.17, lip=66.85.158.92, session=<+dxD2ZZEMpW58uIR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.74.12.86
country_id: 1269750
description:
2025-11-27 23:02:02 dovecot_login authenticator failed for ([182.74.12.86]) [182.74.12.86]:42126: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2025-11-27 23:01:42 dovecot_login authenticator failed for cable-84-43-254-214.mnet.bg [84.43.254.214]:43692: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.152.220
country_id: 2750405
description:
Nov 27 23:02:47 host2 sshd[1082392]: Disconnected from invalid user user1 51.158.152.220 port 60092 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.152.220
country_id: 2750405
description:
Nov 27 23:06:37 host2 sshd[1086427]: Disconnected from invalid user nagios 51.158.152.220 port 58370 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 51.158.152.220
country_id: 2750405
description:
Nov 27 23:08:44 host2 sshd[1088431]: Disconnected from invalid user user1 51.158.152.220 port 47170 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 23:14:11 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<R1VnD5dEQoUXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.158.152.220
country_id: 2750405
description:
Nov 27 23:15:07 host2 sshd[1093512]: Disconnected from invalid user test 51.158.152.220 port 43892 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 203.174.182.38
country_id: 2077456
description:
Nov 27 23:34:01 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 9 secs): user=<>, rip=203.174.182.38, lip=66.85.158.91, session=<bsZxVpdE8ezLrrYm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 197.255.201.114
country_id: 2413451
description:
Nov 27 23:34:04 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=197.255.201.114, lip=66.85.158.91, session=<RKFvVpdEbt/F/8ly>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.90.239.36
country_id: 1269750
description:
Nov 27 23:34:47 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<env_eng>, method=PLAIN, rip=103.90.239.36, lip=66.85.158.91, TLS, session=<E1kNWJdEk8BnWu8k>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.241.228.34
country_id: 1269750
description:
Nov 27 23:34:26 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<env_eng@lezzarotech.com>, method=PLAIN, rip=115.241.228.34, lip=66.85.158.91, TLS, session=<KBPGVpdE8uJz8eQi>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 14.29.244.70
country_id: 1814991
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 14.29.244.70 - yashihol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user yashihol (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 27 23:39:02 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<shipping@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<PgtLaJdEjLySOC+J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-27 23:40:57 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:56338: 535 Incorrect authentication data (set_id=barbier.ch.agri@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-27 23:41:20 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:33124: 535 Incorrect authentication data (set_id=barbier.ch.agri)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.17.133.138
country_id: 3469034
description:
Nov 27 23:46:51 host2 sshd[1118670]: Disconnected from invalid user will 201.17.133.138 port 54364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.17.133.138
country_id: 3469034
description:
Nov 27 23:48:57 host2 sshd[1120048]: Disconnected from invalid user guest 201.17.133.138 port 60886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.13
country_id: 1880251
description:
Nov 27 23:49:17 host2 sshd[1120262]: Disconnected from invalid user kapsch 45.78.207.13 port 45932 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 201.17.133.138
country_id: 3469034
description:
Nov 27 23:50:27 host2 sshd[1121338]: Disconnected from invalid user userm 201.17.133.138 port 33616 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.17.133.138
country_id: 3469034
description:
Nov 27 23:52:04 host2 sshd[1122650]: Disconnected from invalid user user 201.17.133.138 port 34582 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 27 23:53:28 host2 sshd[1123616]: Disconnected from invalid user admin 2.57.121.112 port 45393 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.17.133.138
country_id: 3469034
description:
Nov 27 23:53:48 host2 sshd[1123833]: Disconnected from invalid user test 201.17.133.138 port 35554 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.142.154.101
country_id: 1819730
description:
Nov 27 23:54:16 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=45.142.154.101, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<5TbbnpdEks8tjppl>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.128
country_id: 6252001
description:
Nov 27 23:54:22 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.128, lip=66.85.158.92, TLS: Connection closed, session=<YFVCn5dE+glChJmA>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.44
country_id: 6252001
description:
Nov 27 23:55:45 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 0 secs): user=<>, rip=205.210.31.44, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<jQ81pJdEesLN0h8s>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 27 23:58:26 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<M8ykrZdEjIwXXz9j>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 27 23:59:17 host2 sshd[1128723]: Disconnected from invalid user shelbie 62.60.131.157 port 47129 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.134.73.222
country_id: 3017382
description:
Nov 28 00:02:29 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.134.73.222, lip=66.85.158.91, session=<INFEvJdEpqdbhkne>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.33.12.214
country_id: 6252001
description:
Nov 28 00:02:57 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 2 secs): user=<>, rip=45.33.12.214, lip=66.85.158.91, session=<hiHqvZdE6KctIQzW>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-11-28 00:04:53 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:49346: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.13
country_id: 1880251
description:
Nov 28 00:08:21 host2 sshd[1136063]: Disconnected from invalid user jrodrig 45.78.207.13 port 42578 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.134.73.222
country_id: 3017382
description:
Nov 28 00:08:28 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=91.134.73.222, lip=66.85.158.91, TLS: Connection closed, session=<Yvqo0ZdE4o5bhkne>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 206.189.50.48
country_id: 2921044
description:
Nov 28 00:10:28 host2 dovecot[1005950]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 1 secs): user=<>, rip=206.189.50.48, lip=66.85.158.92, TLS, session=<uHLM2JdEnrvOvTIw>


plugin: enhanced_dos
rule: enhanced_dos
name: Enhanced DoS detection
abuser: 8.222.222.91
country_id: 1880251
description:
Denial of Service (DoS) attack was discovered from 8.222.222.91: 250 connections per 30 seconds to 443 port.


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.13
country_id: 1880251
description:
Nov 28 00:15:28 host2 sshd[1142137]: Disconnected from invalid user exx 45.78.207.13 port 40576 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.37
country_id: 6252001
description:
Nov 28 00:22:04 host2 pure-ftpd[1146714]: (?@205.210.31.37) [INFO] New connection from 205.210.31.37


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Nov 28 00:23:07 host2 sshd[1147464]: Disconnected from invalid user odoo15 103.172.112.192 port 53526 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 158.94.210.79 - renihsberuwala "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user renihsberuwala (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Nov 28 00:23:58 host2 sshd[1147973]: Disconnected from invalid user hdfs 152.32.215.203 port 47588 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.112.192
country_id: 1210997
description:
Nov 28 00:24:24 host2 sshd[1148327]: Disconnected from invalid user nrk 103.172.112.192 port 45644 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.124
country_id: 6252001
description:
Nov 28 00:25:32 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.124, lip=66.85.158.91, TLS handshaking: Connection closed, session=<QWiwDphEY5fDuEx8>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.97
country_id: 6252001
description:
Nov 28 00:25:42 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.97, lip=66.85.158.91, TLS: Connection closed, session=<K3ZPD5hEOYnDuExh>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.122
country_id: 6252001
description:
Nov 28 00:25:50 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.122, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<oO3AD5hE0b/DuEx6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.123
country_id: 6252001
description:
Nov 28 00:25:53 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.123, lip=66.85.158.91, TLS: Connection closed, session=<SbzvD5hEQ4TDuEx7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Nov 28 00:27:04 host2 sshd[1150617]: Disconnected from invalid user ftpuser 103.172.112.192 port 34440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.13
country_id: 1880251
description:
Nov 28 00:27:17 host2 sshd[1150726]: Disconnected from invalid user userm 45.78.207.13 port 36076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Nov 28 00:27:27 host2 sshd[1150946]: Disconnected from invalid user sftp 152.32.215.203 port 46864 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.172.112.192
country_id: 1210997
description:
Nov 28 00:28:32 host2 sshd[1151626]: Disconnected from invalid user frappe 103.172.112.192 port 59638 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.215.203
country_id: 1819730
description:
Nov 28 00:35:26 host2 sshd[1155967]: Disconnected from invalid user david 152.32.215.203 port 34770 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.207.13
country_id: 1880251
description:
Nov 28 00:36:36 host2 sshd[1156656]: Disconnected from invalid user sens 45.78.207.13 port 52420 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.215.203
country_id: 1819730
description:
Nov 28 00:36:55 host2 sshd[1156893]: Disconnected from invalid user init 152.32.215.203 port 52440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 00:41:04 host2 sshd[1160030]: Disconnected from invalid user admin 2.57.121.112 port 62527 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 00:41:33 host2 sshd[1160328]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-28 00:43:08 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:57579: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.141.149
country_id: 2661886
description:
2025-11-28 00:45:36 dovecot_login authenticator failed for 95.209.141.149.bredband.tre.se [95.209.141.149]:52130: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
country_id: 290557
description:
2025-11-28 00:45:46 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:41282: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 00:48:53 host2 sshd[1165751]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.10.60.13
country_id: 3469034
description:
2025-11-28 00:53:44 dovecot_login authenticator failed for clientes-60.13.dbug.com.br [177.10.60.13]:59038: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-11-28 00:53:58 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:42208: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-11-28 00:53:19 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:38784: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2025-11-28 00:53:28 dovecot_login authenticator failed for ([189.108.215.39]) [189.108.215.39]:48090: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.72
country_id: 1880251
description:
Nov 28 01:02:23 host2 sshd[1175888]: Disconnected from invalid user sens 45.78.229.72 port 43784 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.104.210.105
country_id: 6252001
description:
Nov 28 01:04:12 host2 pure-ftpd[1177471]: (?@172.104.210.105) [INFO] New connection from 172.104.210.105


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.59.199.96
country_id: 6252001
description:
Nov 28 01:04:23 host2 sshd[1177571]: Disconnected from invalid user test1 66.59.199.96 port 42618 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.229.72
country_id: 1880251
description:
Nov 28 01:05:31 host2 sshd[1178581]: Disconnected from invalid user gerrit 45.78.229.72 port 39612 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.59.199.96
country_id: 6252001
description:
Nov 28 01:05:33 host2 sshd[1178629]: Disconnected from invalid user ionadmin 66.59.199.96 port 41616 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.59.199.96
country_id: 6252001
description:
Nov 28 01:06:40 host2 sshd[1179337]: Disconnected from invalid user cinema 66.59.199.96 port 40606 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.247.126
country_id: 290557
description:
2025-11-28 01:08:41 dovecot_login authenticator failed for ([94.207.247.126]) [94.207.247.126]:64002: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-28 01:09:04 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:57303: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 28 01:08:15 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Tad0p5hEZrNChJl7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.59.199.96
country_id: 6252001
description:
Nov 28 01:09:47 host2 sshd[1181812]: Disconnected from invalid user kafka 66.59.199.96 port 37562 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 156.239.205.111
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 156.239.205.111 - kamechot "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.78.229.72
country_id: 1880251
description:
Nov 28 01:19:51 host2 sshd[1189005]: Disconnected from invalid user vpn 45.78.229.72 port 52992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Nov 28 01:34:31 host2 sshd[1198243]: Disconnected from invalid user administrator 68.233.116.124 port 62832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.88.160.67
country_id: 6252001
description:
Nov 28 01:34:28 host2 sshd[1198226]: Disconnected from invalid user bitwarden 166.88.160.67 port 57480 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.129.64.219
country_id: 2921044
description:
Nov 28 01:36:30 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 1 secs): user=<>, rip=57.129.64.219, lip=66.85.158.91, session=<AHJ4DJlE8oQ5gUDb>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.117
country_id: 6252001
description:
Nov 28 01:39:13 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.117, lip=66.85.158.92, TLS: Connection closed, session=<FEc7FplETtRChJl1>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 68.233.116.124
country_id: 1269750
description:
Nov 28 01:40:36 host2 sshd[1202353]: Disconnected from invalid user zhangsan 68.233.116.124 port 19056 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Nov 28 01:41:50 host2 sshd[1203192]: Disconnected from invalid user uftp 68.233.116.124 port 48284 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 166.88.160.67
country_id: 6252001
description:
Nov 28 01:42:23 host2 sshd[1203543]: Disconnected from invalid user root2 166.88.160.67 port 33050 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.233.116.124
country_id: 1269750
description:
Nov 28 01:43:06 host2 sshd[1204056]: Disconnected from invalid user kafka 68.233.116.124 port 21024 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 166.88.160.67
country_id: 6252001
description:
Nov 28 01:43:33 host2 sshd[1204345]: Disconnected from invalid user s 166.88.160.67 port 52916 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 01:51:55 host2 sshd[1211582]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.167.142
country_id: 6252001
description:
Nov 28 01:59:23 host2 dovecot[1005950]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.167.142, lip=66.85.158.92, session=<TSdaXplErIBHBqeO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.167.142
country_id: 6252001
description:
Nov 28 01:59:26 host2 dovecot[1005950]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.167.142, lip=66.85.158.92, session=<zPaDXplEGIZHBqeO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-28 02:03:37 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:38139: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-28 02:03:18 dovecot_login authenticator failed for ([182.95.115.70]) [182.95.115.70]:37292: 535 Incorrect authentication data (set_id=support@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.155.194.11
country_id: 953987
description:
2025-11-28 02:14:56 dovecot_plain authenticator failed for 156-155-194-11.ip.internet.co.za (R9YP57Z8UQI) [156.155.194.11]:19703: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.136.82.8
country_id: 6252001
description:
Nov 28 02:16:49 host2 sshd[1234096]: Disconnected from invalid user cinema 150.136.82.8 port 62192 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.17
country_id: 130758
description:
Nov 28 02:16:59 host2 sshd[1234208]: Disconnected from invalid user ubuntu 185.213.164.17 port 44180 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.56.187
country_id: 99237
description:
Nov 28 02:18:14 host2 sshd[1235350]: Disconnected from invalid user user1 62.3.56.187 port 35578 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 28 02:18:24 host2 sshd[1235527]: Disconnected from invalid user sammy 103.137.194.125 port 43550 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 28 02:19:38 host2 sshd[1236529]: Disconnected from invalid user ionadmin 41.111.162.34 port 62984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Nov 28 02:19:50 host2 sshd[1236724]: Disconnected from invalid user test1 128.1.131.163 port 56376 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.136.82.8
country_id: 6252001
description:
Nov 28 02:19:55 host2 sshd[1236774]: Disconnected from invalid user ts3 150.136.82.8 port 50994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 28 02:20:17 host2 sshd[1237243]: Disconnected from invalid user ts3 103.137.194.125 port 56488 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.17
country_id: 130758
description:
Nov 28 02:20:22 host2 sshd[1237324]: Disconnected from invalid user ts3 185.213.164.17 port 40094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.56.187
country_id: 99237
description:
Nov 28 02:20:30 host2 sshd[1237458]: Disconnected from invalid user bitwarden 62.3.56.187 port 48898 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 41.111.162.34
country_id: 2589581
description:
Nov 28 02:20:55 host2 sshd[1237786]: Disconnected from invalid user daniel 41.111.162.34 port 32743 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 150.136.82.8
country_id: 6252001
description:
Nov 28 02:21:03 host2 sshd[1237922]: Disconnected from invalid user daniel 150.136.82.8 port 63598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.17
country_id: 130758
description:
Nov 28 02:21:35 host2 sshd[1238382]: Disconnected from invalid user daniel 185.213.164.17 port 53414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.56.187
country_id: 99237
description:
Nov 28 02:21:49 host2 sshd[1238563]: Disconnected from invalid user victor 62.3.56.187 port 45258 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.113.212
country_id: 1861060
description:
Nov 28 02:21:14 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.113.212, lip=66.85.158.91, TLS: Connection closed, session=</UJ7rJlEYoaLonHU>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Nov 28 02:21:18 host2 sshd[1238127]: Disconnected from invalid user marvin 128.1.131.163 port 58322 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov 28 02:21:29 host2 sshd[1238288]: Disconnected from invalid user elasticsearch 122.166.49.42 port 46276 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.17
country_id: 130758
description:
Nov 28 02:22:44 host2 sshd[1239483]: Disconnected from invalid user castle 185.213.164.17 port 41340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.56.187
country_id: 99237
description:
Nov 28 02:23:03 host2 sshd[1239777]: Disconnected from invalid user user 62.3.56.187 port 42094 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.35.231
country_id: 6252001
description:
Nov 28 02:22:22 host2 sshd[1239172]: Disconnected from invalid user ts2 104.168.35.231 port 54836 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 150.136.82.8
country_id: 6252001
description:
Nov 28 02:23:14 host2 sshd[1239914]: Disconnected from invalid user marvin 150.136.82.8 port 49230 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.213.164.17
country_id: 130758
description:
Nov 28 02:23:50 host2 sshd[1240412]: Disconnected from invalid user max 185.213.164.17 port 48654 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 28 02:24:00 host2 sshd[1240579]: Disconnected from invalid user customer 103.137.194.125 port 51702 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.86
country_id: 6252001
description:
Nov 28 02:23:51 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.86, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<f5/TtZlE1s3G6xhW>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov 28 02:24:09 host2 sshd[1240768]: Disconnected from invalid user azureuser 172.245.92.99 port 56882 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.3.56.187
country_id: 99237
description:
Nov 28 02:24:13 host2 sshd[1240823]: Disconnected from invalid user ctf 62.3.56.187 port 60958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Nov 28 02:24:28 host2 sshd[1241166]: Disconnected from invalid user adam 95.58.255.251 port 40428 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.134
country_id: 1880251
description:
Nov 28 02:26:05 host2 sshd[1242456]: Disconnected from invalid user debian 45.78.205.134 port 48846 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-11-28 02:26:06 dovecot_login authenticator failed for ([127.0.0.1]) [128.185.254.162]:47806: 535 Incorrect authentication data (set_id=kasunp)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.137.194.125
country_id: 1269750
description:
Nov 28 02:25:10 host2 sshd[1241819]: Disconnected from invalid user elasticsearch 103.137.194.125 port 34444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.35.231
country_id: 6252001
description:
Nov 28 02:25:22 host2 sshd[1241990]: Disconnected from invalid user ubuntu 104.168.35.231 port 44266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Nov 28 02:25:28 host2 sshd[1242029]: Disconnected from invalid user ts1 95.58.255.251 port 51242 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov 28 02:25:33 host2 sshd[1242082]: Disconnected from invalid user kiosk 122.166.49.42 port 51698 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-11-28 02:25:52 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net ([127.0.0.1]) [76.151.32.99]:33798: 535 Incorrect authentication data (set_id=kasunp@ksoft.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Nov 28 02:26:24 host2 sshd[1242650]: Disconnected from invalid user daniel 128.1.131.163 port 47438 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 95.58.255.251
country_id: 1522867
description:
Nov 28 02:26:28 host2 sshd[1242672]: Disconnected from invalid user casaos 95.58.255.251 port 52894 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.91.102.187
country_id: 1880251
description:
Nov 28 02:26:49 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 2 secs): user=<>, rip=142.91.102.187, lip=66.85.158.92, TLS: Connection closed, session=<I9R1wJlEb8qOW2a7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.166.49.42
country_id: 1269750
description:
Nov 28 02:26:55 host2 sshd[1242968]: Disconnected from invalid user castle 122.166.49.42 port 53494 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-11-28 02:28:07 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:52556: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 142.91.102.187
country_id: 1880251
description:
Nov 28 02:27:10 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=142.91.102.187, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<1wmtwZlEMpuOW2a7>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 95.58.255.251
country_id: 1522867
description:
Nov 28 02:27:25 host2 sshd[1243410]: Disconnected from invalid user azureuser 95.58.255.251 port 35984 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.1.131.163
country_id: 1819730
description:
Nov 28 02:27:42 host2 sshd[1243614]: Disconnected from invalid user sammy 128.1.131.163 port 56580 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.35.231
country_id: 6252001
description:
Nov 28 02:27:43 host2 sshd[1243628]: Disconnected from invalid user john 104.168.35.231 port 57696 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov 28 02:28:10 host2 sshd[1243922]: Disconnected from invalid user newuser 172.245.92.99 port 51010 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.205.134
country_id: 1880251
description:
Nov 28 02:28:28 host2 sshd[1244076]: Disconnected from invalid user pivpn 45.78.205.134 port 33874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.35.231
country_id: 6252001
description:
Nov 28 02:28:57 host2 sshd[1244382]: Disconnected from invalid user invitado 104.168.35.231 port 51838 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov 28 02:29:14 host2 sshd[1244582]: Disconnected from invalid user casaos 172.245.92.99 port 41346 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-11-28 02:30:08 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au ([127.0.0.1]) [203.174.182.38]:58138: 535 Incorrect authentication data (set_id=chitral100@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.39.177
country_id: 1861060
description:
2025-11-28 02:30:17 dovecot_login authenticator failed for ([127.0.0.1]) [138.199.39.177]:35937: 535 Incorrect authentication data (set_id=chitral100)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.92.99
country_id: 6252001
description:
Nov 28 02:30:17 host2 sshd[1245404]: Disconnected from invalid user vncuser 172.245.92.99 port 37990 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.92.99
country_id: 6252001
description:
Nov 28 02:31:18 host2 sshd[1246044]: Disconnected from invalid user laravel 172.245.92.99 port 44484 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 02:33:34 host2 sshd[1247494]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 167.94.146.58
country_id: 6252001
description:
Nov 28 02:35:19 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=167.94.146.58, lip=66.85.158.92, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<D8rP3plEvJunXpI6>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.211
country_id: 3017382
description:
Nov 28 02:38:57 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=91.231.89.211, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<WffN65lEf9Fb51nT>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.215
country_id: 3017382
description:
Nov 28 02:39:00 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.231.89.215, lip=66.85.158.91, TLS: Connection closed, session=<WOP965lE8+Nb51nX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.231.89.85
country_id: 3017382
description:
Nov 28 02:38:31 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.231.89.85, lip=66.85.158.91, TLS handshaking: Connection closed, session=<TLpE6plEabBb51lV>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 02:40:53 host2 sshd[1253404]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 02:48:21 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@ayuzonelanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<6rJUDZpELMoXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 138.197.179.135
country_id: 2921044
description:
Nov 28 02:53:50 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=138.197.179.135, lip=66.85.158.92, TLS, session=<Vq4LIZpEnleKxbOH>


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 77.53.234.54
country_id: 2661886
description:
Nov 28 02:55:36 host2 sshd[1266247]: error: maximum authentication attempts exceeded for root from 77.53.234.54 port 58932 ssh2 [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 77.53.234.54
country_id: 2661886
description:
Nov 28 02:55:36 host2 sshd[1266247]: Disconnecting authenticating user root 77.53.234.54 port 58932: Too many authentication failures [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 02:56:54 host2 sshd[1267156]: Disconnected from invalid user deondre 62.60.131.157 port 5888 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.169.154
country_id: 2750405
description:
Nov 28 03:00:30 host2 sshd[1269986]: Disconnected from invalid user teamspeak 45.93.169.154 port 43874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.224.135
country_id: 6252001
description:
Nov 28 03:02:24 host2 sshd[1271338]: Disconnected from invalid user lab 50.6.224.135 port 60396 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 28 03:02:53 host2 sshd[1271659]: Disconnected from invalid user teste 152.32.129.140 port 53766 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.47.184
country_id: 953987
description:
2025-11-28 03:04:48 dovecot_login authenticator failed for (factor.makemesome.space) [102.223.47.184]:41246: 535 Incorrect authentication data (set_id=info@idesignvector.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.169.154
country_id: 2750405
description:
Nov 28 03:05:33 host2 sshd[1273899]: Disconnected from invalid user postgres 45.93.169.154 port 37142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 28 03:05:17 host2 sshd[1273738]: Disconnected from invalid user ansible 152.32.129.140 port 38714 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.18.127.84
country_id: 3175395
description:
Nov 28 03:06:34 host2 sshd[1274612]: Disconnected from invalid user int 151.18.127.84 port 30402 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 28 03:06:33 host2 sshd[1274605]: Disconnected from invalid user hadoop 152.32.129.140 port 11060 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.169.154
country_id: 2750405
description:
Nov 28 03:06:38 host2 sshd[1274661]: Disconnected from invalid user teamspeak 45.93.169.154 port 54468 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-28 03:06:43 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:35266: 535 Incorrect authentication data (set_id=parentscoignard111@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-28 03:06:52 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:60687: 535 Incorrect authentication data (set_id=parentscoignard111)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.6.224.135
country_id: 6252001
description:
Nov 28 03:07:24 host2 sshd[1275086]: Disconnected from invalid user postgres 50.6.224.135 port 44958 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.169.154
country_id: 2750405
description:
Nov 28 03:07:39 host2 sshd[1275193]: Disconnected from invalid user jacob 45.93.169.154 port 49308 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-28 03:07:51 dovecot_login authenticator failed for (189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:54130: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.193.112.85
country_id: 6252001
description:
2025-11-28 03:08:33 dovecot_plain authenticator failed for c-98-193-112-85.hsd1.il.comcast.net (unrying) [98.193.112.85]:52120: 535 Incorrect authentication data (set_id=info@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.172.154.255
country_id: 1269750
description:
Nov 28 03:08:20 host2 sshd[1275814]: Disconnected from invalid user steam 103.172.154.255 port 59136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 152.32.129.140
country_id: 1819730
description:
Nov 28 03:08:51 host2 sshd[1276135]: Disconnected from invalid user intel 152.32.129.140 port 10752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.18.127.84
country_id: 3175395
description:
Nov 28 03:08:17 host2 sshd[1275778]: Disconnected from invalid user radio 151.18.127.84 port 30957 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-28 03:08:20 dovecot_login authenticator failed for ([189.56.5.209]) [187.50.194.182]:43848: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.93.169.154
country_id: 2750405
description:
Nov 28 03:08:37 host2 sshd[1275992]: Disconnected from invalid user vpn 45.93.169.154 port 38556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 151.18.127.84
country_id: 3175395
description:
Nov 28 03:11:21 host2 sshd[1278254]: Disconnected from invalid user retag 151.18.127.84 port 30312 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2025-11-28 03:16:34 dovecot_login authenticator failed for (static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:40216: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-11-28 03:17:00 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:40266: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-11-28 03:17:16 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:56054: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.97
country_id: 1819730
description:
Nov 28 03:18:07 host2 sshd[1282304]: Disconnected from invalid user devops 118.193.38.97 port 39298 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 118.193.38.97
country_id: 1819730
description:
Nov 28 03:23:20 host2 sshd[1285284]: Disconnected from invalid user qw 118.193.38.97 port 18330 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.156
country_id: 3703430
description:
Nov 28 03:23:58 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.156, lip=66.85.158.91, session=<6VnOjJpExP8t4/6c>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.97
country_id: 1819730
description:
Nov 28 03:24:40 host2 sshd[1286170]: Disconnected from invalid user dspace 118.193.38.97 port 48542 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.38.97
country_id: 1819730
description:
Nov 28 03:25:56 host2 sshd[1286925]: Disconnected from invalid user admin 118.193.38.97 port 23414 [preauth]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.167.142
country_id: 6252001
description:
Nov 28 03:27:25 host2 dovecot[1005950]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=71.6.167.142, lip=66.85.158.91, session=<RlkmmZpEguhHBqeO>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 71.6.167.142
country_id: 6252001
description:
Nov 28 03:27:25 host2 dovecot[1005950]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=71.6.167.142, lip=66.85.158.91, session=<riAomZpENupHBqeO>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2025-11-28 03:28:17 dovecot_plain authenticator failed for c-98-227-25-115.hsd1.il.comcast.net (tablums) [98.227.25.115]:37970: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2025-11-28 03:31:42 dovecot_plain authenticator failed for c-71-235-225-181.hsd1.ct.comcast.net (cockils) [71.235.225.181]:41350: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.172.98
country_id: 1269750
description:
2025-11-28 03:32:45 dovecot_login authenticator failed for ([27.123.119.146]) [122.187.172.98]:37274: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-11-28 03:33:06 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:35255: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-11-28 03:33:31 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (esaticol) [5.185.233.251]:50850: 535 Incorrect authentication data (set_id=info@jrdc.lk)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.138
country_id: 1880251
description:
Nov 28 03:40:54 host2 sshd[1295942]: Disconnected from invalid user zhangsan 101.47.48.138 port 44970 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.91.170.52
country_id: 241170
description:
Nov 28 03:42:03 host2 sshd[1296628]: Disconnected from invalid user terraria 154.91.170.52 port 51922 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 35.145.253.68
country_id: 6252001
description:
Nov 28 03:41:38 host2 sshd[1296373]: Disconnected from invalid user bounce 35.145.253.68 port 46655 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.175
country_id: 1605651
description:
Nov 28 03:41:56 host2 sshd[1296549]: Disconnected from invalid user usuario1 103.13.215.175 port 46718 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Nov 28 03:43:06 host2 sshd[1297143]: Disconnected from invalid user ts1 154.91.170.52 port 52404 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.91.170.52
country_id: 241170
description:
Nov 28 03:44:09 host2 sshd[1297635]: Disconnected from invalid user monitoring 154.91.170.52 port 52002 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.175
country_id: 1605651
description:
Nov 28 03:43:23 host2 sshd[1297281]: Disconnected from invalid user ftpadmin 103.13.215.175 port 44878 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.86.171.138
country_id: 6290252
description:
2025-11-28 03:43:43 dovecot_plain authenticator failed for 93-86-171-138.dynamic.isp.telekom.rs (648A5DR0V5VM) [93.86.171.138]:65200: 535 Incorrect authentication data (set_id=training@v-deploy.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 35.145.253.68
country_id: 6252001
description:
Nov 28 03:45:22 host2 sshd[1299344]: Disconnected from invalid user ali 35.145.253.68 port 48563 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Nov 28 03:46:06 host2 sshd[1300123]: Disconnected from invalid user rstudio 197.211.55.20 port 53844 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.30
country_id: 1880251
description:
Nov 28 03:46:42 host2 sshd[1299572]: Disconnected from invalid user rstudio 45.78.200.30 port 49874 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.211.55.20
country_id: 2328926
description:
Nov 28 03:47:22 host2 sshd[1301354]: Disconnected from invalid user halo 197.211.55.20 port 36412 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.48.138
country_id: 1880251
description:
Nov 28 03:48:19 host2 sshd[1302263]: Disconnected from invalid user localhost 101.47.48.138 port 34470 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.13.215.175
country_id: 1605651
description:
Nov 28 03:48:36 host2 sshd[1302579]: Disconnected from invalid user ubuntu 103.13.215.175 port 47210 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.13.215.175
country_id: 1605651
description:
Nov 28 03:49:54 host2 sshd[1303540]: Disconnected from invalid user usuario1 103.13.215.175 port 45750 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 03:50:58 host2 sshd[1304371]: Disconnected from invalid user admin 2.57.121.112 port 21440 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.63.48.217
country_id: 1269750
description:
Nov 28 03:51:29 host2 sshd[1304688]: Disconnected from invalid user sales1 123.63.48.217 port 44832 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.200.30
country_id: 1880251
description:
Nov 28 03:53:18 host2 sshd[1306110]: Disconnected from invalid user precio01 45.78.200.30 port 49190 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.49.89
country_id: 6252001
description:
Nov 28 03:57:06 host2 sshd[1310124]: Disconnected from invalid user ftpuser 167.99.49.89 port 44556 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.63.48.217
country_id: 1269750
description:
Nov 28 03:56:17 host2 sshd[1309240]: Disconnected from invalid user mc 123.63.48.217 port 55876 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 123.63.48.217
country_id: 1269750
description:
Nov 28 03:57:35 host2 sshd[1310669]: Disconnected from invalid user supermaint 123.63.48.217 port 57613 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.66
country_id: 6252001
description:
Nov 28 03:58:59 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.66, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sGgHCptEdtjN0h9C>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 123.63.48.217
country_id: 1269750
description:
Nov 28 04:00:06 host2 sshd[1313260]: Disconnected from invalid user zjw 123.63.48.217 port 49445 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 161.35.108.229
country_id: 6252001
description:
Nov 28 04:00:49 host2 pure-ftpd[1313993]: (?@161.35.108.229) [INFO] New connection from 161.35.108.229


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.106
country_id: 1643084
description:
Nov 28 04:01:00 host2 sshd[1314126]: Disconnected from invalid user sysadmin 103.76.120.106 port 33120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.49.89
country_id: 6252001
description:
Nov 28 04:01:03 host2 sshd[1314221]: Disconnected from invalid user monitoring 167.99.49.89 port 45178 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 167.99.49.89
country_id: 6252001
description:
Nov 28 04:02:04 host2 sshd[1315119]: Disconnected from invalid user sftpuser 167.99.49.89 port 55484 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 173.255.221.86
country_id: 6252001
description:
Nov 28 04:03:04 host2 pure-ftpd[1316228]: (?@173.255.221.86) [INFO] New connection from 173.255.221.86


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.201.9.152
country_id: 3469034
description:
Nov 28 04:03:27 host2 sshd[1317118]: Disconnected from invalid user rahul 128.201.9.152 port 49834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.120.106
country_id: 1643084
description:
Nov 28 04:04:54 host2 sshd[1318716]: Disconnected from invalid user server 103.76.120.106 port 33540 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.201.9.152
country_id: 3469034
description:
Nov 28 04:06:40 host2 sshd[1320150]: Disconnected from invalid user mega 128.201.9.152 port 51834 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 04:07:31 host2 sshd[1320694]: Disconnected from invalid user admin 2.57.121.112 port 21899 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.120.106
country_id: 1643084
description:
Nov 28 04:07:24 host2 sshd[1320634]: Disconnected from invalid user onkar 103.76.120.106 port 33820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 128.201.9.152
country_id: 3469034
description:
Nov 28 04:09:44 host2 sshd[1323484]: Disconnected from invalid user root1 128.201.9.152 port 53872 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.236.111
country_id: 1269750
description:
2025-11-28 04:10:48 dovecot_login authenticator failed for (static.bb.ill.59.92.236.111.bsnl.in) [59.92.236.111]:56480: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-11-28 04:11:02 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:45996: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-28 04:14:15 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (pliker) [81.225.30.107]:45011: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Nov 28 04:15:29 host2 pure-ftpd[1330873]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov 28 04:17:01 host2 sshd[1332595]: Disconnected from invalid user sipv 101.36.124.127 port 49762 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Nov 28 04:19:22 host2 sshd[1335290]: Disconnected from invalid user admin 189.50.142.82 port 41587 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 128.201.9.152
country_id: 3469034
description:
Nov 28 04:20:12 host2 sshd[1336317]: Disconnected from invalid user ubuntu 128.201.9.152 port 59894 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 96.236.28.215
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 96.236.28.215 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov 28 04:24:35 host2 sshd[1340899]: Disconnected from invalid user bob 101.36.124.127 port 40484 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 04:25:32 host2 sshd[1341981]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Nov 28 04:27:16 host2 sshd[1344017]: Disconnected from invalid user qiyuesuo 189.50.142.82 port 54081 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2025-11-28 04:28:43 dovecot_login authenticator failed for (187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:57104: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-28 04:28:56 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:47910: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.70
country_id: 1269750
description:
2025-11-28 04:28:58 dovecot_login authenticator failed for ([125.17.70.25]) [125.20.251.70]:50430: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.208.169
country_id: 2661886
description:
2025-11-28 04:28:27 dovecot_login authenticator failed for 94-255-208-169.cust.bredband2.com [94.255.208.169]:60708: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-11-28 04:29:19 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:47578: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Nov 28 04:30:46 host2 sshd[1348201]: Disconnected from invalid user deployer 189.50.142.82 port 44290 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 04:31:30 host2 sshd[1348655]: Disconnected from invalid user ellis 62.60.131.157 port 25125 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.124.127
country_id: 1819730
description:
Nov 28 04:31:38 host2 sshd[1348736]: Disconnected from invalid user fred 101.36.124.127 port 40904 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 04:31:16 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@askinternationalconsortium.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<fQBgfZtExMIXXz9j>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 04:32:58 host2 sshd[1349427]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.124.127
country_id: 1819730
description:
Nov 28 04:32:47 host2 sshd[1349348]: Disconnected from invalid user postgres 101.36.124.127 port 53514 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.111
country_id: 6252001
description:
Nov 28 04:34:47 host2 dovecot[1005950]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.111, lip=66.85.158.92, session=<Rc4WiptEEFas7ORv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.99.148.146
country_id: 6252001
description:
2025-11-28 04:35:58 dovecot_login authenticator failed for (ool-4b639492.static.optonline.net) [75.99.148.146]:50176: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 172.236.228.245
country_id: 6252001
description:
Nov 28 04:35:21 host2 dovecot[1005950]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=172.236.228.245, lip=66.85.158.91, session=<aGcVjJtEJDus7OT1>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-11-28 04:37:02 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:46640: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 28 04:37:27 host2 sshd[1352169]: Disconnected from invalid user rahul 101.36.108.134 port 49570 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.14
country_id: 6252001
description:
Nov 28 04:37:31 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=205.210.31.14, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<kn3hk5tE9cTN0h8O>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Nov 28 04:37:32 host2 sshd[1352201]: Disconnected from invalid user temp 189.50.142.82 port 60441 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Nov 28 04:38:25 host2 sshd[1352766]: Disconnected from invalid user init 40.117.97.0 port 33682 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.199.72.236
country_id: 6252001
description:
Nov 28 04:39:37 host2 pure-ftpd[1353651]: (?@198.199.72.236) [INFO] New connection from 198.199.72.236


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.199.14
country_id: 1269750
description:
2025-11-28 04:39:55 dovecot_login authenticator failed for ([125.20.220.9]) [128.185.199.14]:36208: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-28 04:40:08 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:41123: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 28 04:40:10 host2 sshd[1354191]: Disconnected from invalid user student 101.36.108.134 port 46310 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Nov 28 04:40:20 host2 sshd[1354355]: Disconnected from invalid user minecraft 101.36.122.23 port 40932 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Nov 28 04:40:27 host2 sshd[1354406]: Disconnected from invalid user pivpn 101.36.107.103 port 60208 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.108.92.15
country_id: 1643084
description:
Nov 28 04:40:37 host2 sshd[1354495]: Disconnected from invalid user debian 149.108.92.15 port 55872 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 28 04:41:33 host2 sshd[1355266]: Disconnected from invalid user user2 101.36.108.134 port 53142 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Nov 28 04:41:42 host2 sshd[1355368]: Disconnected from invalid user crafty 101.36.122.23 port 56690 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.108.92.15
country_id: 1643084
description:
Nov 28 04:42:04 host2 sshd[1355676]: Disconnected from invalid user user 149.108.92.15 port 60498 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 28 04:42:35 host2 sshd[1356029]: Disconnected from invalid user administrator 116.193.191.159 port 54262 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.108.134
country_id: 1819730
description:
Nov 28 04:42:51 host2 sshd[1356235]: Disconnected from invalid user debian 101.36.108.134 port 34202 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.94.22
country_id: 6252001
description:
Nov 28 04:43:12 host2 sshd[1356454]: Disconnected from invalid user radarr 104.168.94.22 port 32972 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 139.177.206.107
country_id: 6252001
description:
Nov 28 04:43:25 host2 pure-ftpd[1356579]: (?@139.177.206.107) [INFO] New connection from 139.177.206.107


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 149.108.92.15
country_id: 1643084
description:
Nov 28 04:43:27 host2 sshd[1356581]: Disconnected from invalid user user 149.108.92.15 port 45606 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Nov 28 04:44:12 host2 sshd[1357077]: Disconnected from invalid user user 101.36.122.23 port 55408 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Nov 28 04:44:18 host2 sshd[1357192]: Disconnected from invalid user remote 40.117.97.0 port 52722 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 149.108.92.15
country_id: 1643084
description:
Nov 28 04:44:42 host2 sshd[1357480]: Disconnected from invalid user backend 149.108.92.15 port 51076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 118.193.35.17
country_id: 1819730
description:
Nov 28 04:44:47 host2 sshd[1357539]: Disconnected from invalid user superadmin 118.193.35.17 port 55758 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.147.46.233
country_id: 298795
description:
Nov 28 04:44:29 host2 sshd[1357277]: Disconnected from invalid user radarr 45.147.46.233 port 34418 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 28 04:44:54 host2 sshd[1357712]: Disconnected from invalid user tmp 116.193.191.159 port 48976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.122.23
country_id: 1819730
description:
Nov 28 04:45:22 host2 sshd[1358511]: Disconnected from invalid user debian 101.36.122.23 port 36944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.193.191.159
country_id: 1643084
description:
Nov 28 04:46:01 host2 sshd[1359046]: Disconnected from invalid user nextcloud 116.193.191.159 port 52036 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-28 04:46:05 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:62650: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.123.61
country_id: 2921044
description:
Nov 28 04:45:26 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=64.226.123.61, lip=66.85.158.92, session=<wegtsJtECOpA4ns9>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.117.97.0
country_id: 6252001
description:
Nov 28 04:45:31 host2 sshd[1358604]: Disconnected from invalid user debian 40.117.97.0 port 53650 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Nov 28 04:45:43 host2 sshd[1358718]: Disconnected from invalid user angel 101.36.107.103 port 54938 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.94.22
country_id: 6252001
description:
Nov 28 04:46:15 host2 sshd[1359229]: Disconnected from invalid user backend 104.168.94.22 port 38902 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-11-28 04:46:16 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:47294: 535 Incorrect authentication data (set_id=sales@casa18villa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-28 04:46:35 dovecot_login authenticator failed for ([182.78.122.253]) [125.19.253.154]:40270: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.246
country_id: 1880251
description:
Nov 28 04:46:36 host2 sshd[1359419]: Disconnected from invalid user nextcloud 45.78.204.246 port 33318 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Nov 28 04:48:07 host2 sshd[1360357]: Disconnected from invalid user devuser 101.36.107.103 port 50468 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 104.168.94.22
country_id: 6252001
description:
Nov 28 04:47:21 host2 sshd[1359919]: Disconnected from invalid user share 104.168.94.22 port 37986 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.147.46.233
country_id: 298795
description:
Nov 28 04:48:18 host2 sshd[1360463]: Disconnected from invalid user dixi 45.147.46.233 port 50790 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 104.168.94.22
country_id: 6252001
description:
Nov 28 04:48:27 host2 sshd[1360530]: Disconnected from invalid user abhi 104.168.94.22 port 37076 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 158.94.210.79
country_id: 2750405
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 158.94.210.79 - admin "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.147.46.233
country_id: 298795
description:
Nov 28 04:49:59 host2 sshd[1361369]: Disconnected from invalid user share 45.147.46.233 port 48072 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.36.107.103
country_id: 1819730
description:
Nov 28 04:50:27 host2 sshd[1361878]: Disconnected from invalid user anaconda 101.36.107.103 port 47334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.50.142.82
country_id: 3469034
description:
Nov 28 04:50:46 host2 sshd[1362075]: Disconnected from invalid user ubuntu 189.50.142.82 port 60688 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 04:51:21 host2 sshd[1362667]: Disconnected from invalid user  2.57.121.112 port 62120 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.246
country_id: 1880251
description:
Nov 28 04:51:42 host2 sshd[1362854]: Disconnected from invalid user debian 45.78.204.246 port 46244 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.147.46.233
country_id: 298795
description:
Nov 28 04:53:11 host2 sshd[1363850]: Disconnected from invalid user sens 45.147.46.233 port 52482 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.204.246
country_id: 1880251
description:
Nov 28 04:59:15 host2 sshd[1368860]: Disconnected from invalid user devuser 45.78.204.246 port 47682 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.123
country_id: 6252001
description:
Nov 28 05:02:23 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.123, lip=66.85.158.91, TLS: Connection closed, session=<NNTM7JtEVjFChJl7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.125.10
country_id: 3573591
description:
2025-11-28 05:06:45 dovecot_plain authenticator failed for (P756S1ACH72QLPV) [181.188.125.10]:45605: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.137
country_id: 6252001
description:
Nov 28 05:16:38 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 16 secs): user=<>, rip=66.132.153.137, lip=66.85.158.91, TLS handshaking: Connection closed, session=<oa66H5xEhFdChJmJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 28 05:20:36 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<contact@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<5qHULZxEsJuSOC+J>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.16.91
country_id: 1880251
description:
2025-11-28 05:22:11 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:52561: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-11-28 05:22:57 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:40285: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 148.113.221.195
country_id: 6251999
description:
Nov 28 05:30:01 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=148.113.221.195, lip=66.85.158.92, session=<RN2eT5xEkumUcd3D>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.164.19.215
country_id: 1269750
description:
Nov 28 05:32:27 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr@lezzarotech.com>, method=PLAIN, rip=103.164.19.215, lip=66.85.158.91, TLS, session=<w64YV5xE6ORnpBPX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 65.20.213.23
country_id: 99237
description:
Nov 28 05:32:50 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 20 secs): user=<587hr>, method=PLAIN, rip=65.20.213.23, lip=66.85.158.91, TLS, session=<tK5+WJxEnZFBFNUX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Nov 28 05:36:30 host2 sshd[1391420]: Disconnected from invalid user es 172.208.48.177 port 58906 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Nov 28 05:38:28 host2 sshd[1392621]: Disconnected from invalid user wordpress 117.250.96.66 port 60536 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Nov 28 05:38:11 host2 sshd[1392476]: Disconnected from invalid user terraria 172.208.48.177 port 44014 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.208.48.177
country_id: 6252001
description:
Nov 28 05:39:25 host2 sshd[1393348]: Disconnected from invalid user techuser 172.208.48.177 port 58484 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Nov 28 05:40:40 host2 sshd[1394547]: Disconnected from invalid user vagrant 172.208.48.177 port 54952 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.208.48.177
country_id: 6252001
description:
Nov 28 05:41:54 host2 sshd[1395419]: Disconnected from invalid user wordpress 172.208.48.177 port 48182 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 199.195.254.215
country_id: 6252001
description:
Nov 28 05:42:07 host2 sshd[1395573]: Disconnected from invalid user mark 199.195.254.215 port 44728 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-28 05:43:29 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:35372: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 199.195.254.215
country_id: 6252001
description:
Nov 28 05:43:39 host2 sshd[1396652]: Disconnected from invalid user wordpress 199.195.254.215 port 43390 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-11-28 05:43:52 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:55096: 535 Incorrect authentication data (set_id=washeera)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 05:44:31 host2 sshd[1397220]: Disconnected from invalid user ellis 62.60.131.157 port 39527 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Nov 28 05:44:40 host2 sshd[1397433]: Disconnected from invalid user mapr 117.250.96.66 port 38172 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.12.240.178
country_id: 6252001
description:
Nov 28 05:46:14 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.12.240.178, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<t/SdiZxEgtIUDPCy>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Nov 28 05:52:42 host2 sshd[1402494]: Disconnected from invalid user vagrant 117.250.96.66 port 45528 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 117.250.96.66
country_id: 1269750
description:
Nov 28 05:54:21 host2 sshd[1403682]: Disconnected from invalid user test123 117.250.96.66 port 46998 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 117.250.96.66
country_id: 1269750
description:
Nov 28 05:55:51 host2 sshd[1405014]: Disconnected from invalid user techuser 117.250.96.66 port 48472 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.139.216.56
country_id: 1269750
description:
Nov 28 05:57:30 host2 sshd[1405974]: Disconnected from invalid user terraria 14.139.216.56 port 49946 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.234
country_id: 6252001
description:
Nov 28 05:57:43 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=20.64.105.234, lip=66.85.158.92, TLS handshaking: Connection closed, session=<tQ2lspxEItcUQGnq>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.139.216.56
country_id: 1269750
description:
Nov 28 06:00:46 host2 sshd[1408207]: Disconnected from invalid user ali 14.139.216.56 port 52890 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 14.139.216.56
country_id: 1269750
description:
Nov 28 06:02:20 host2 sshd[1409788]: Disconnected from invalid user tony 14.139.216.56 port 54364 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.139.216.56
country_id: 1269750
description:
Nov 28 06:07:14 host2 sshd[1413470]: Disconnected from invalid user carlos 14.139.216.56 port 58786 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.139.216.56
country_id: 1269750
description:
Nov 28 06:10:26 host2 sshd[1415789]: Disconnected from invalid user kyt 14.139.216.56 port 33498 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.146.61
country_id: 6252001
description:
Nov 28 06:13:10 host2 pure-ftpd[1417592]: (?@167.94.146.61) [INFO] New connection from 167.94.146.61


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.207
country_id: 6252001
description:
Nov 28 06:13:59 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.207, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<KPbc7JxEqsDG6xjP>


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 06:17:45 host2 sshd[1420476]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-11-28 06:18:26 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (etteanymed) [98.204.134.124]:44248: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 06:25:05 host2 sshd[1425084]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov 28 06:27:47 host2 sshd[1426739]: Disconnected from invalid user jacob 162.241.127.152 port 60026 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov 28 06:31:44 host2 sshd[1429082]: Disconnected from invalid user minecraft 162.241.127.152 port 33782 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 06:32:14 host2 sshd[1429320]: Disconnected from invalid user  2.57.121.112 port 62088 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 162.241.127.152
country_id: 6252001
description:
Nov 28 06:32:47 host2 sshd[1429590]: Disconnected from invalid user devops 162.241.127.152 port 32994 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-28 06:32:51 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:52245: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-28 06:33:24 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:53394: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov 28 06:33:49 host2 sshd[1430293]: Disconnected from invalid user sales1 162.241.127.152 port 60436 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.9.82
country_id: 1168579
description:
Nov 28 06:34:42 host2 sshd[1430906]: Disconnected from invalid user guest123 103.164.9.82 port 36394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 162.241.127.152
country_id: 6252001
description:
Nov 28 06:34:51 host2 sshd[1431059]: Disconnected from invalid user gitea 162.241.127.152 port 59646 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.4
country_id: 6252001
description:
Nov 28 06:38:40 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=600) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=195.184.76.4, lip=66.85.158.91, TLS handshaking: read(size=600) failed: Connection reset by peer, session=<W6ImRZ1E77jDuEwE>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-11-28 06:38:21 dovecot_plain authenticator failed for (poyed) [94.201.22.158]:46573: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.231
country_id: 6252001
description:
Nov 28 06:38:22 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=195.184.76.231, lip=66.85.158.91, TLS handshaking: Connection closed, session=<GjkURJ1E04LDuEzn>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.230
country_id: 6252001
description:
Nov 28 06:38:33 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=195.184.76.230, lip=66.85.158.91, TLS: Connection closed, session=<bFa2RJ1Eg63DuEzm>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 195.184.76.0
country_id: 6252001
description:
Nov 28 06:38:44 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=195.184.76.0, lip=66.85.158.91, TLS: Connection closed, session=<HG1VRZ1ExbPDuEwA>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.164.9.82
country_id: 1168579
description:
Nov 28 06:38:45 host2 sshd[1435648]: Disconnected from invalid user es 103.164.9.82 port 58324 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.82.141.145
country_id: 6252001
description:
2025-11-28 06:39:24 dovecot_plain authenticator failed for c-68-82-141-145.hsd1.pa.comcast.net (divereopic) [68.82.141.145]:57040: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.164.9.82
country_id: 1168579
description:
Nov 28 06:40:03 host2 sshd[1437138]: Disconnected from invalid user bodega 103.164.9.82 port 60078 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.226.91.151
country_id: 2921044
description:
Nov 28 06:43:45 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=64.226.91.151, lip=66.85.158.92, TLS, session=<weBTV51ExL1A4luX>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 28 06:46:37 host2 sshd[1445401]: Disconnected from invalid user osboxes 34.66.72.251 port 52554 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.241
country_id: 3469034
description:
Nov 28 06:47:39 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 18 secs): user=<accounts2>, method=PLAIN, rip=186.209.251.241, lip=66.85.158.91, TLS, session=<98MrZJ1E1re60fvx>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.236.15.67
country_id: 3469034
description:
Nov 28 06:47:19 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 19 secs): user=<accounts2@lezzarotech.com>, method=PLAIN, rip=186.236.15.67, lip=66.85.158.91, TLS, session=<xwvzYp1EcK+67A9D>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 28 06:48:49 host2 sshd[1448438]: Disconnected from invalid user builder 34.66.72.251 port 45788 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 28 06:48:20 host2 sshd[1447758]: Disconnected from invalid user redmine 165.227.3.79 port 50978 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.53.165.251
country_id: 3469034
description:
Nov 28 06:48:25 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 23 secs): user=<accounts@lezzarotech.com>, method=PLAIN, rip=177.53.165.251, lip=66.85.158.91, TLS, session=<yfaiZp1EW+SxNaX7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 187.120.105.4
country_id: 3469034
description:
Nov 28 06:48:44 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (auth failed, 3 attempts in 17 secs): user=<accounts>, method=PLAIN, rip=187.120.105.4, lip=66.85.158.91, TLS, session=<hYgVaJ1E8tW7eGkE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 28 06:48:18 host2 sshd[1447678]: Disconnected from invalid user victor 43.252.229.25 port 41434 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 28 06:49:57 host2 sshd[1449690]: Disconnected from invalid user dbadmin 34.66.72.251 port 54028 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.82.240.194
country_id: 1643084
description:
Nov 28 06:49:14 host2 sshd[1448932]: Disconnected from invalid user andres 103.82.240.194 port 55476 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 28 06:49:37 host2 sshd[1449341]: Disconnected from invalid user elemental 43.252.229.25 port 40874 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2025-11-28 06:49:56 dovecot_plain authenticator failed for 5.185.233.251.ipv4.public.orange.pl (nopister) [5.185.233.251]:59596: 535 Incorrect authentication data (set_id=env_eng@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 28 06:50:08 host2 sshd[1450021]: Disconnected from invalid user vtatis 50.84.211.204 port 49424 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 34.66.72.251
country_id: 6252001
description:
Nov 28 06:51:05 host2 sshd[1451256]: Disconnected from invalid user user 34.66.72.251 port 51248 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 28 06:51:55 host2 sshd[1452125]: Disconnected from invalid user qiyuesuo 43.252.229.25 port 38316 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 28 06:52:57 host2 sshd[1453218]: Disconnected from invalid user qiyuesuo 165.227.3.79 port 48031 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 43.252.229.25
country_id: 1819730
description:
Nov 28 06:53:06 host2 sshd[1453426]: Disconnected from invalid user temp 43.252.229.25 port 37024 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 50.84.211.204
country_id: 6252001
description:
Nov 28 06:53:20 host2 sshd[1453731]: Disconnected from invalid user huawei 50.84.211.204 port 45996 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 165.227.3.79
country_id: 6252001
description:
Nov 28 06:54:54 host2 sshd[1455787]: Disconnected from invalid user test01 165.227.3.79 port 45129 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.146
country_id: 1880251
description:
Nov 28 06:54:23 host2 sshd[1454867]: Disconnected from invalid user gns3 101.47.140.146 port 46280 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.114.251
country_id: 6252001
description:
2025-11-28 06:56:31 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (kansubte) [98.192.114.251]:38941: 535 Incorrect authentication data (set_id=awanish@maximsholdings.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 34.122.105.182
country_id: 6252001
description:
Nov 28 06:59:45 host2 pure-ftpd[1461235]: (?@34.122.105.182) [INFO] New connection from 34.122.105.182


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.27.157.252
country_id: 2635167
description:
Nov 28 07:00:46 host2 sshd[1462332]: Disconnected from invalid user ir 92.27.157.252 port 39204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 92.27.157.252
country_id: 2635167
description:
Nov 28 07:03:42 host2 sshd[1465478]: Disconnected from invalid user ubuntu 92.27.157.252 port 35913 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 92.27.157.252
country_id: 2635167
description:
Nov 28 07:04:51 host2 sshd[1466526]: Disconnected from invalid user mike 92.27.157.252 port 51206 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.146
country_id: 1880251
description:
Nov 28 07:05:11 host2 sshd[1466641]: Disconnected from invalid user administrator 101.47.140.146 port 52942 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.211.167
country_id: 2635167
description:
Nov 28 07:05:45 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=35.203.211.167, lip=66.85.158.92, session=<sSn/pZ1EcPcjy9On>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.82
country_id: 6252001
description:
Nov 28 07:06:39 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.82, lip=66.85.158.92, session=<+SoxqZ1EsPSTuYRS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-11-28 07:11:16 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (trastspose) [85.225.19.144]:44038: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.124.166
country_id: 6252001
description:
Nov 28 07:14:18 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=40.76.124.166, lip=66.85.158.91, session=<ibWOxJ1EDoYoTHym>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 101.47.140.82
country_id: 1880251
description:
Nov 28 07:15:03 host2 sshd[1475324]: Disconnected from invalid user jacob 101.47.140.82 port 35994 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 28 07:15:39 host2 sshd[1475874]: Disconnected from invalid user daniel 103.145.145.75 port 50328 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.104.31
country_id: 6252001
description:
Nov 28 07:18:38 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.64.104.31, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<5I4H1J1EFI0UQGgf>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 28 07:21:07 host2 sshd[1479692]: Disconnected from invalid user abhi 103.145.145.75 port 34444 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 28 07:22:19 host2 sshd[1480262]: Disconnected from invalid user vps 103.145.145.75 port 33048 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.145.145.75
country_id: 1819730
description:
Nov 28 07:24:39 host2 sshd[1481579]: Disconnected from invalid user aaa 103.145.145.75 port 58496 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.64.105.81
country_id: 6252001
description:
Nov 28 07:26:58 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.64.105.81, lip=66.85.158.92, session=<3gvb8Z1EqoYUQGlR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.169.83.190
country_id: 6252001
description:
Nov 28 07:29:26 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=20.169.83.190, lip=66.85.158.91, session=<n1+m+p1EoIQUqVO+>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.194.164.218
country_id: 3469034
description:
Nov 28 07:29:30 host2 sshd[1484189]: Disconnected from invalid user userb 168.194.164.218 port 43196 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.163.1.211
country_id: 6252001
description:
Nov 28 07:31:05 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=20.163.1.211, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<cT6bAJ5EgIwUowHT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.241.102
country_id: 1269750
description:
2025-11-28 07:32:40 dovecot_login authenticator failed for ([125.19.175.152]) [182.78.241.102]:51766: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.155.27.128
country_id: 2802361
description:
2025-11-28 07:32:15 dovecot_login authenticator failed for 128.27.155.104.bc.googleusercontent.com [104.155.27.128]:57700: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 168.194.164.218
country_id: 3469034
description:
Nov 28 07:32:30 host2 sshd[1485896]: Disconnected from invalid user aaa 168.194.164.218 port 58672 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 184.105.247.196
country_id: 6252001
description:
Nov 28 07:33:11 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=184.105.247.196, lip=66.85.158.92, TLS handshaking: Connection closed, session=<BlcbCJ5EuPi4affE>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 168.194.164.218
country_id: 3469034
description:
Nov 28 07:35:33 host2 sshd[1487916]: Disconnected from invalid user vps 168.194.164.218 port 45430 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.124
country_id: 1880251
description:
Nov 28 07:43:52 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 7 secs): user=<>, rip=15.235.175.124, lip=66.85.158.92, session=<9Y5GLp5E/+YP6698>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 15.235.175.121
country_id: 1880251
description:
Nov 28 07:44:06 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 14 secs): user=<>, rip=15.235.175.121, lip=66.85.158.92, session=<8GQcL55ERZwP6695>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-11-28 07:44:53 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (aphiper) [24.91.103.202]:35940: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.1.34.242
country_id: 719819
description:
2025-11-28 07:44:48 dovecot_plain authenticator failed for dsl540122f2.fixip.t-online.hu (pallatt) [84.1.34.242]:58610: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.111.158
country_id: 1168579
description:
Nov 28 07:45:25 host2 sshd[1494665]: Disconnected from invalid user testuser 103.76.111.158 port 59794 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.76.111.158
country_id: 1168579
description:
Nov 28 07:50:25 host2 sshd[1498333]: Disconnected from invalid user ubuntu 103.76.111.158 port 45694 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.76.125.17
country_id: 6252001
description:
Nov 28 07:50:15 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.76.125.17, lip=66.85.158.92, session=<eScfRZ5EGq8oTH0R>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 103.76.111.158
country_id: 1168579
description:
Nov 28 07:51:50 host2 sshd[1499100]: Disconnected from invalid user debian 103.76.111.158 port 34420 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.65
country_id: 6252001
description:
Nov 28 07:57:31 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 2 secs): user=<>, rip=198.235.24.65, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<sq0dX55Et9bG6xhB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-28 08:00:07 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (reylepas) [81.225.30.107]:57469: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 47.237.95.10
country_id: 1880251
description:
Nov 28 08:02:37 host2 sshd[1505518]: Disconnected from invalid user joe 47.237.95.10 port 39978 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 08:03:33 host2 sshd[1506587]: Disconnected from invalid user admin 2.57.121.112 port 36573 [preauth]


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 08:09:53 host2 sshd[1510743]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 08:17:13 host2 sshd[1515136]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 8.211.51.190
country_id: 2921044
description:
Nov 28 08:21:15 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 4 secs): user=<>, rip=8.211.51.190, lip=66.85.158.91, session=<TWP3s55EMtAI0zO+>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 144.31.90.241
country_id: 660013
description:
Nov 28 08:22:49 host2 pure-ftpd[1518251]: (?@144.31.90.241) [INFO] New connection from 144.31.90.241


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.90.12.192
country_id: 6252001
description:
Nov 28 08:23:53 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.90.12.192, lip=66.85.158.91, TLS, session=<2cdlvZ5EdsgDWgzA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-28 08:24:03 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:64824: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 40.124.173.115
country_id: 6252001
description:
Nov 28 08:24:34 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=40.124.173.115, lip=66.85.158.91, TLS, session=<YZ3fv55EIMEofK1z>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.140.134.46
country_id: 2413451
description:
2025-11-28 08:31:28 dovecot_plain authenticator failed for (X58MAJ152S6) [102.140.134.46]:52506: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
country_id: 1269750
description:
2025-11-28 08:31:48 dovecot_login authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:56135: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-28 08:32:22 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:59862: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.82.240.10
country_id: 1643084
description:
Nov 28 08:35:06 host2 sshd[1525186]: Disconnected from invalid user kevin 119.82.240.10 port 16661 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 28 08:36:35 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.91, session=<GwLV6p5EwLssyhQX>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 119.82.240.10
country_id: 1643084
description:
Nov 28 08:36:28 host2 sshd[1525984]: Disconnected from invalid user tidb 119.82.240.10 port 49202 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 13.89.121.32
country_id: 6252001
description:
Nov 28 08:37:30 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=13.89.121.32, lip=66.85.158.92, TLS, session=<BLgf7p5EOLgNWXkg>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.82.240.10
country_id: 1643084
description:
Nov 28 08:37:47 host2 sshd[1526837]: Disconnected from invalid user t3rr0r 119.82.240.10 port 12004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 28 08:37:55 host2 sshd[1526887]: Disconnected from invalid user deamon 52.237.80.79 port 57968 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:38:39 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<J1ow8p5EbucDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Nov 28 08:39:21 host2 sshd[1527811]: Disconnected from invalid user user 186.10.86.130 port 39242 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:39:43 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<5foH9p5EipMDiUnd>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.51.100.133
country_id: 1269750
description:
2025-11-28 08:39:46 dovecot_plain authenticator failed for (CHXEI8NX18) [157.51.100.133]:50123: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Nov 28 08:40:26 host2 sshd[1528554]: Disconnected from invalid user tv 186.10.86.130 port 49136 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 28 08:40:46 host2 sshd[1528728]: Disconnected from invalid user soporte 27.112.78.245 port 52750 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:40:26 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<PgqT+J5EMu0DiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 241170
description:
Nov 28 08:41:11 host2 sshd[1528969]: Disconnected from invalid user aj 156.245.239.180 port 52858 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:41:26 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F09C:SSL routines:ssl3_get_record:http request, session=<GyYw/J5EMpsDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Nov 28 08:42:35 host2 sshd[1529959]: Disconnected from invalid user roland 186.10.86.130 port 35992 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 28 08:42:54 host2 sshd[1530215]: Disconnected from invalid user local 52.237.80.79 port 45386 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.11.28
country_id: 1880251
description:
Nov 28 08:42:27 host2 sshd[1529865]: Disconnected from invalid user desliga 159.65.11.28 port 39964 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 156.245.239.180
country_id: 241170
description:
Nov 28 08:42:29 host2 sshd[1529880]: Disconnected from invalid user thomas 156.245.239.180 port 52978 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:43:54 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS, session=<aaT3BJ9ErNkDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 156.245.239.180
country_id: 241170
description:
Nov 28 08:43:55 host2 sshd[1530918]: Disconnected from invalid user sales1 156.245.239.180 port 36520 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 28 08:44:19 host2 sshd[1531209]: Disconnected from invalid user user1 52.237.80.79 port 37086 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:44:54 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<zIGVCJ9EQLMDiUnd>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 52.237.80.79
country_id: 1880251
description:
Nov 28 08:45:41 host2 sshd[1533212]: Disconnected from invalid user kevin 52.237.80.79 port 36926 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:45:46 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.92, TLS handshaking: Connection closed, session=<T8apC59EhNEDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 28 08:45:58 host2 sshd[1533623]: Disconnected from invalid user gitlab 27.112.78.245 port 34880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.39.241.103
country_id: 1269750
description:
Nov 28 08:46:35 host2 sshd[1534718]: Disconnected from invalid user userb 103.39.241.103 port 37944 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.103.189.122
country_id: 3996063
description:
Nov 28 08:46:45 host2 sshd[1534917]: Disconnected from invalid user user 201.103.189.122 port 57404 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:47:23 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS handshaking: Connection closed, session=<dUt2EZ9E4LADiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.10.86.130
country_id: 3895114
description:
Nov 28 08:47:52 host2 sshd[1535971]: Disconnected from invalid user docker 186.10.86.130 port 49026 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.137.73.221
country_id: 6252001
description:
Nov 28 08:48:41 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.137.73.221, lip=66.85.158.91, TLS, session=<grQdFp9EKJYDiUnd>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.11.28
country_id: 1880251
description:
Nov 28 08:48:38 host2 sshd[1536633]: Disconnected from invalid user autrede 159.65.11.28 port 34906 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 27.112.78.245
country_id: 1643084
description:
Nov 28 08:49:22 host2 sshd[1537057]: Disconnected from invalid user docker 27.112.78.245 port 55960 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.39.241.103
country_id: 1269750
description:
Nov 28 08:49:39 host2 sshd[1537239]: Disconnected from invalid user frappe 103.39.241.103 port 37004 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 201.103.189.122
country_id: 3996063
description:
Nov 28 08:50:44 host2 sshd[1538029]: Disconnected from invalid user support 201.103.189.122 port 33268 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.11.28
country_id: 1880251
description:
Nov 28 08:50:49 host2 sshd[1538076]: Disconnected from invalid user valheim 159.65.11.28 port 34144 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-28 08:51:05 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (etintiniet) [196.47.172.253]:43749: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.189.16
country_id: 2658434
description:
Nov 28 08:52:08 host2 pure-ftpd[1538949]: (?@35.216.189.16) [INFO] New connection from 35.216.189.16


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 35.216.189.16
country_id: 2658434
description:
Nov 28 08:52:11 host2 pure-ftpd[1538996]: (?@35.216.189.16) [INFO] New connection from 35.216.189.16


plugin: ossec
rule: 11307
name: Multiple connection attempts from same source
abuser: 35.216.189.16
country_id: 2658434
description:
Nov 28 08:52:13 host2 pure-ftpd[1539013]: (?@35.216.189.16) [INFO] New connection from 35.216.189.16


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 159.65.11.28
country_id: 1880251
description:
Nov 28 08:53:00 host2 sshd[1539491]: Disconnected from invalid user runner 159.65.11.28 port 42838 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 159.65.11.28
country_id: 1880251
description:
Nov 28 08:55:09 host2 sshd[1541672]: Disconnected from invalid user free 159.65.11.28 port 56704 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.213
country_id: 3017382
description:
Nov 28 09:01:03 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=91.196.152.213, lip=66.85.158.91, TLS: Connection closed, session=<C4JSQp9Eg+hbxJjV>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.177
country_id: 3017382
description:
Nov 28 09:00:36 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=91.196.152.177, lip=66.85.158.91, TLS handshaking: Connection closed, session=<0vq5QJ9EM8lbxJix>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 91.196.152.209
country_id: 3017382
description:
Nov 28 09:00:47 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=91.196.152.209, lip=66.85.158.91, TLS: Connection closed, session=<lHlaQZ9Er7pbxJjR>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.73
country_id: 6252001
description:
Nov 28 09:04:33 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.73, lip=66.85.158.92, TLS, session=<OUPTTp9EdufG6xhJ>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 09:05:10 host2 sshd[1548590]: Disconnected from invalid user admin 2.57.121.112 port 5623 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-28 09:14:41 dovecot_plain authenticator failed for (sarinose) [65.20.205.197]:41283: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Nov 28 09:16:23 host2 sshd[1555911]: Disconnected from invalid user oracle 45.78.226.118 port 53836 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.11
country_id: 3017382
description:
Nov 28 09:17:19 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=1026) failed: Connection reset by peer (no auth attempts in 1 secs): user=<>, rip=94.231.206.11, lip=66.85.158.92, session=<a6x8fJ9EzdBe584L>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.5
country_id: 3017382
description:
Nov 28 09:17:31 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 12 secs): user=<>, rip=94.231.206.5, lip=66.85.158.92, session=<dog2fZ9E275e584F>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 94.231.206.10
country_id: 3017382
description:
Nov 28 09:17:40 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=94.231.206.10, lip=66.85.158.92, session=<gnG5fZ9E+4de584K>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Nov 28 09:17:55 host2 sshd[1556503]: Disconnected from invalid user old 182.253.156.184 port 54576 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-28 09:18:54 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:52528: 535 Incorrect authentication data (set_id=washeera@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Nov 28 09:20:08 host2 sshd[1557814]: Disconnected from invalid user aaa 45.78.226.118 port 44752 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 09:21:04 host2 sshd[1558541]: Disconnected from invalid user admin 2.57.121.112 port 6606 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 182.253.156.184
country_id: 1643084
description:
Nov 28 09:21:22 host2 sshd[1558695]: Disconnected from invalid user sopuser 182.253.156.184 port 37886 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 28 09:22:19 host2 sshd[1559281]: Disconnected from invalid user ubadmin 66.96.239.187 port 33802 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.253.156.184
country_id: 1643084
description:
Nov 28 09:22:45 host2 sshd[1559499]: Disconnected from invalid user rstudio 182.253.156.184 port 40046 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-28 09:23:02 dovecot_plain authenticator failed for (defunbolis) [23.30.11.253]:40577: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 28 09:24:55 host2 sshd[1560916]: Disconnected from invalid user administrator 66.96.239.187 port 45506 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Nov 28 09:25:58 host2 sshd[1561573]: Disconnected from invalid user sysadmin 45.78.226.118 port 55272 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 28 09:26:13 host2 sshd[1561697]: Disconnected from invalid user ubadmin 66.96.239.187 port 42402 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-28 09:28:07 dovecot_login authenticator failed for ([127.0.0.1]) [128.185.242.74]:51750: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.184
country_id: 6252001
description:
Nov 28 09:27:42 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 20 secs): user=<>, rip=147.185.133.184, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<DzOnoZ9E/96TuYW4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-11-28 09:27:51 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net ([127.0.0.1]) [98.161.232.9]:37876: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.184
country_id: 6252001
description:
Nov 28 09:28:42 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 16 secs): user=<>, rip=147.185.133.184, lip=66.85.158.91, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<EvMzpZ9EXPaTuYW4>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 28 09:28:52 host2 sshd[1563012]: Disconnected from invalid user debianuser 66.96.239.187 port 43390 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 178.16.55.198
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [webmaild] 178.16.55.198 - hr@lezzarotech.com "GET /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.226.118
country_id: 1880251
description:
Nov 28 09:31:29 host2 sshd[1564790]: Disconnected from invalid user administrator 45.78.226.118 port 45798 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 66.96.239.187
country_id: 1643084
description:
Nov 28 09:32:41 host2 sshd[1565628]: Disconnected from invalid user django 66.96.239.187 port 46694 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-28 09:36:10 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:58290: 535 Incorrect authentication data (set_id=isuru@euroentertainmentlk.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.133.184
country_id: 6252001
description:
Nov 28 09:36:15 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.133.184, lip=66.85.158.91, TLS, session=<fok6wJ9EUOaTuYW4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-11-28 09:36:22 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:49874: 535 Incorrect authentication data (set_id=isuru)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2025-11-28 09:42:19 dovecot_plain authenticator failed for c-174-169-224-27.hsd1.vt.comcast.net (hobrus) [174.169.224.27]:53436: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.79
country_id: 6252001
description:
Nov 28 09:47:47 host2 pure-ftpd[1575978]: (?@147.185.132.79) [INFO] New connection from 147.185.132.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-28 09:52:53 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (clent) [87.103.126.54]:43053: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.27.116.226
country_id: 2635167
description:
2025-11-28 09:56:41 dovecot_login authenticator failed for (host-92-27-116-226.static.as13285.net) [92.27.116.226]:40885: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2025-11-28 09:56:58 dovecot_login authenticator failed for pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:57680: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 104.248.22.187
country_id: 2921044
description:
Nov 28 09:57:20 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 30 secs): user=<>, rip=104.248.22.187, lip=66.85.158.91, TLS handshaking: Connection closed, session=<Yl6aC6BEOgVo+Ba7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 09:57:49 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@anandaobauae.org>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<CdM8DaBEfsgXXz9j>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 18.246.66.36
country_id: 6252001
description:
Nov 28 10:04:02 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 10 secs): user=<>, rip=18.246.66.36, lip=66.85.158.91, TLS: Connection closed, session=<1OCSI6BE1s8S9kIk>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 139.162.116.22
country_id: 1861060
description:
Nov 28 10:05:22 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=139.162.116.22, lip=66.85.158.91, TLS: Connection closed, session=<RCBWKKBE2J6LonQW>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.251.107.36
country_id: 6252001
description:
Nov 28 10:12:04 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=44.251.107.36, lip=66.85.158.92, TLS: Connection closed, session=<AUNHQKBEzsIs+2sk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.176.34.117
country_id: 1269750
description:
2025-11-28 10:11:54 dovecot_plain authenticator failed for (T8FWR3M6R) [123.176.34.117]:65369: 535 Incorrect authentication data (set_id=44-osd-moh@fhb.health.gov.lk)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov 28 10:20:23 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<4vUIXqBELf4t4/6Y>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.81
country_id: 2635167
description:
Nov 28 10:20:54 host2 dovecot[1005950]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.81, lip=66.85.158.91, TLS, session=<uMvgX6BEUdG594lR>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 10:22:11 host2 sshd[1596887]: Disconnected from invalid user admin 2.57.121.112 port 27738 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.184.144.219
country_id: 6252001
description:
Nov 28 10:25:35 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=54.184.144.219, lip=66.85.158.91, TLS: Connection closed, session=<aMyccKBEbLA2uJDb>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 10:28:03 host2 sshd[1599325]: Disconnected from invalid user lana 62.60.131.157 port 7011 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.62
country_id: 6252001
description:
Nov 28 10:30:58 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.62, lip=66.85.158.92, TLS handshaking: Connection closed, session=<rlPkg6BEKr5APsU+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 64.62.197.62
country_id: 6252001
description:
Nov 28 10:31:16 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 3 secs): user=<>, rip=64.62.197.62, lip=66.85.158.92, TLS handshaking: Connection closed, session=<Tt/zhKBE/utAPsU+>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 3.17.207.148
country_id: 6252001
description:
Nov 28 10:36:13 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=3.17.207.148, lip=66.85.158.92, session=<WwCtlqBEhtYDEc+U>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
country_id: 6252001
description:
2025-11-28 10:44:59 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net (stify) [74.90.213.28]:50468: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 10:49:01 host2 sshd[1609072]: Disconnected from invalid user  2.57.121.112 port 61365 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-11-28 10:50:20 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:42066: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.144.37.102
country_id: 1269750
description:
2025-11-28 10:50:47 dovecot_login authenticator failed for ([103.144.37.102]) [103.144.37.102]:56512: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.102
country_id: 1269750
description:
2025-11-28 10:51:16 dovecot_login authenticator failed for ([27.123.119.99]) [182.95.224.102]:57352: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2025-11-28 10:51:45 dovecot_login authenticator failed for ([149.54.15.6]) [149.54.15.6]:38423: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.58
country_id: 6252001
description:
Nov 28 10:52:40 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=198.235.24.58, lip=66.85.158.91, TLS, session=<BsWF0aBE/vDG6xg6>


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 144.31.90.241
country_id: 660013
description:
Nov 28 10:56:42 host2 pure-ftpd[1614450]: (?@144.31.90.241) [INFO] New connection from 144.31.90.241


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-11-28 11:00:45 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:51528: 535 Incorrect authentication data (set_id=careers@v-deploy.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-28 11:01:05 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:37146: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 66.132.153.126
country_id: 6252001
description:
Nov 28 11:02:53 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=66.132.153.126, lip=66.85.158.92, TLS: Connection closed, session=<3EkM9qBETKpChJl+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.140.35
country_id: 3469034
description:
2025-11-28 11:04:58 dovecot_login authenticator failed for (45.168.140-35.smartlinkfibra.com.br) [45.168.140.35]:49267: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 146.56.47.137
country_id: 1835841
description:
Nov 28 11:04:59 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@melanifinefood.com>, method=PLAIN, rip=146.56.47.137, lip=66.85.158.91, session=<0vVq/aBExqSSOC+J>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 44.202.20.23
country_id: 6252001
description:
Nov 28 11:05:16 host2 dovecot[1005950]: pop3-login: Disconnected: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=44.202.20.23, lip=66.85.158.92, session=<4naW/qBE6ossyhQX>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 54.176.143.111
country_id: 6252001
description:
Nov 28 11:08:49 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 11 secs): user=<>, rip=54.176.143.111, lip=66.85.158.92, TLS: Connection closed, session=<pPc6C6FEvOo2sI9v>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.94
country_id: 6252001
description:
Nov 28 11:10:51 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=147.185.132.94, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<lKiCEqFEs8CTuYRe>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 147.185.132.21
country_id: 6252001
description:
Nov 28 11:18:54 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=147.185.132.21, lip=66.85.158.91, session=<+xJVL6FEfPyTuYQV>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Nov 28 11:19:56 host2 sshd[1628987]: Disconnected from invalid user developer 172.245.208.136 port 57236 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.52
country_id: 2635167
description:
Nov 28 11:20:44 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=779) failed: Connection reset by peer (no auth attempts in 43 secs): user=<>, rip=35.203.210.52, lip=66.85.158.92, TLS handshaking: read(size=779) failed: Connection reset by peer, session=<wLDeNaFE9sIjy9I0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 28 11:20:50 host2 sshd[1629643]: Disconnected from invalid user guest123 154.83.15.123 port 36534 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.52
country_id: 2635167
description:
Nov 28 11:21:19 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=429) failed: Connection reset by peer (no auth attempts in 8 secs): user=<>, rip=35.203.210.52, lip=66.85.158.92, TLS: read(size=429) failed: Connection reset by peer, session=<aX7vN6FEbuYjy9I0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Nov 28 11:22:52 host2 sshd[1630968]: Disconnected from invalid user proxyuser 172.245.208.136 port 60716 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 28 11:23:28 host2 sshd[1631432]: Disconnected from invalid user debianuser 154.83.15.123 port 51300 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.189
country_id: 130758
description:
Nov 28 11:23:48 host2 sshd[1631607]: Disconnected from invalid user bitrix 85.208.253.189 port 59850 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 28 11:24:47 host2 sshd[1632225]: Disconnected from invalid user usuario2 154.83.15.123 port 52602 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 28 11:26:02 host2 sshd[1632986]: Disconnected from invalid user newuser 154.83.15.123 port 53900 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 35.203.210.52
country_id: 2635167
description:
Nov 28 11:25:23 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=35.203.210.52, lip=66.85.158.92, TLS, session=<mFmCRqFE+vMjy9I0>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 172.245.208.136
country_id: 6252001
description:
Nov 28 11:26:32 host2 sshd[1633214]: Disconnected from invalid user rahul 172.245.208.136 port 39820 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.83.15.123
country_id: 1819730
description:
Nov 28 11:27:16 host2 sshd[1633614]: Disconnected from invalid user kingbase 154.83.15.123 port 55198 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 172.245.208.136
country_id: 6252001
description:
Nov 28 11:27:47 host2 sshd[1633991]: Disconnected from invalid user alma 172.245.208.136 port 41752 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.208.253.189
country_id: 130758
description:
Nov 28 11:30:31 host2 sshd[1635746]: Disconnected from invalid user steam 85.208.253.189 port 56344 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Nov 28 11:31:17 host2 sshd[1636173]: Disconnected from invalid user steam 188.166.104.136 port 56100 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2025-11-28 11:32:08 dovecot_login authenticator failed for ([200.216.172.182]) [200.216.172.182]:38071: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-28 11:33:00 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:48114: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 11:32:18 host2 sshd[1636724]: Disconnected from invalid user admin 2.57.121.112 port 61232 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.164.241.170
country_id: 3996063
description:
Nov 28 11:32:24 host2 sshd[1636752]: Disconnected from invalid user ali 189.164.241.170 port 49870 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 28 11:32:38 host2 sshd[1636842]: Disconnected from invalid user sonar 198.46.249.175 port 34916 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 85.208.253.189
country_id: 130758
description:
Nov 28 11:33:14 host2 sshd[1637129]: Disconnected from invalid user testuser 85.208.253.189 port 56566 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.145.6
country_id: 3865483
description:
2025-11-28 11:33:32 dovecot_login authenticator failed for (6-red145.ceviamonte.com.ar) [143.202.145.6]:56667: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Nov 28 11:34:56 host2 sshd[1638087]: Disconnected from invalid user ntps 45.78.201.248 port 33096 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 184.168.21.211
country_id: 6252001
description:
Nov 28 11:35:40 host2 sshd[1638768]: Disconnected from invalid user bitnami 184.168.21.211 port 40032 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.164.241.170
country_id: 3996063
description:
Nov 28 11:35:39 host2 sshd[1638753]: Disconnected from invalid user amir 189.164.241.170 port 34146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.116.39
country_id: 1819730
description:
Nov 28 11:37:05 host2 sshd[1639607]: Disconnected from invalid user newuser 154.219.116.39 port 37784 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Nov 28 11:37:09 host2 sshd[1639649]: Disconnected from invalid user leo 74.87.117.147 port 64735 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.170.105
country_id: 3996063
description:
Nov 28 11:36:15 host2 sshd[1639117]: Disconnected from invalid user albert 132.248.170.105 port 50046 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 28 11:36:23 host2 sshd[1639176]: Disconnected from invalid user es 194.107.115.199 port 64399 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 184.168.21.211
country_id: 6252001
description:
Nov 28 11:36:54 host2 sshd[1639508]: Disconnected from invalid user airflow 184.168.21.211 port 58394 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.170.105
country_id: 3996063
description:
Nov 28 11:37:26 host2 sshd[1639804]: Disconnected from invalid user client 132.248.170.105 port 35427 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 11:37:37 host2 sshd[1639922]: Disconnected from invalid user lana 62.60.131.157 port 46368 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 205.210.31.211
country_id: 6252001
description:
Nov 28 11:38:04 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (no auth attempts in 1 secs): user=<>, rip=205.210.31.211, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol, session=<ZTvhc6FE8sHN0h/T>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.59.185
country_id: 3996063
description:
Nov 28 11:37:14 host2 sshd[1639708]: Disconnected from invalid user ftpuser 187.212.59.185 port 49764 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Nov 28 11:37:17 host2 sshd[1639736]: Disconnected from invalid user admin 189.217.130.86 port 43880 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 28 11:37:38 host2 sshd[1639939]: Disconnected from invalid user es 194.107.115.199 port 13340 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Nov 28 11:38:45 host2 sshd[1640768]: Disconnected from invalid user ntps 198.98.55.71 port 48204 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.170.105
country_id: 3996063
description:
Nov 28 11:38:31 host2 sshd[1640469]: Disconnected from invalid user ftpuser 132.248.170.105 port 49037 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Nov 28 11:39:32 host2 sshd[1641315]: Disconnected from invalid user administrator 189.217.130.86 port 59543 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 154.219.116.39
country_id: 1819730
description:
Nov 28 11:39:37 host2 sshd[1641384]: Disconnected from invalid user test 154.219.116.39 port 45414 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Nov 28 11:39:34 host2 sshd[1641358]: Disconnected from invalid user administrator 74.87.117.147 port 15104 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 132.248.170.105
country_id: 3996063
description:
Nov 28 11:40:46 host2 sshd[1642146]: Disconnected from invalid user admin 132.248.170.105 port 48029 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 198.46.249.175
country_id: 6252001
description:
Nov 28 11:40:24 host2 sshd[1641922]: Disconnected from invalid user ftptest 198.46.249.175 port 36572 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 189.217.130.86
country_id: 3996063
description:
Nov 28 11:40:42 host2 sshd[1642095]: Disconnected from invalid user testuser 189.217.130.86 port 38859 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.107.115.199
country_id: 1512440
description:
Nov 28 11:41:19 host2 sshd[1642491]: Disconnected from invalid user dev 194.107.115.199 port 53701 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Nov 28 11:41:25 host2 sshd[1642569]: Disconnected from invalid user app 198.98.55.71 port 38808 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-28 11:42:15 dovecot_login authenticator failed for ([152.52.234.35]) [182.95.176.130]:37608: 535 Incorrect authentication data (set_id=hr@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.166.104.136
country_id: 2750405
description:
Nov 28 11:42:30 host2 sshd[1643426]: Disconnected from invalid user developer 188.166.104.136 port 38598 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.212.59.185
country_id: 3996063
description:
Nov 28 11:44:10 host2 sshd[1644457]: Disconnected from invalid user admin 187.212.59.185 port 35976 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.87.117.147
country_id: 6252001
description:
Nov 28 11:44:39 host2 sshd[1644722]: Disconnected from invalid user admin 74.87.117.147 port 13336 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 187.212.59.185
country_id: 3996063
description:
Nov 28 11:46:23 host2 sshd[1646282]: Disconnected from invalid user testuser 187.212.59.185 port 53146 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Nov 28 11:46:34 host2 sshd[1646467]: Disconnected from invalid user tigergraph 198.98.55.71 port 51666 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 198.98.55.71
country_id: 6252001
description:
Nov 28 11:49:11 host2 sshd[1647853]: Disconnected from invalid user sonar 198.98.55.71 port 49904 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Nov 28 11:51:52 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@sysnytech.com>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<16EUpaFEZNt283VD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.60.131.157
country_id: 130758
description:
Nov 28 11:54:50 host2 sshd[1651879]: Disconnected from invalid user chelsie 62.60.131.157 port 23266 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 11:55:12 host2 sshd[1652209]: Disconnected from invalid user admin 2.57.121.112 port 64452 [preauth]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.209.235.25
country_id: 2921044
description:
Nov 28 11:58:00 host2 pure-ftpd[1653783]: (?@134.209.235.25) [INFO] New connection from 134.209.235.25


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 11:58:11 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<2c6vu6FEcM8XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 11:58:27 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<finance@agronatureholdings.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<GEuovKFEpp4XXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.243.117.67
country_id: 1861060
description:
Nov 28 11:58:35 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<info@systemtec.lk>, method=PLAIN, rip=118.243.117.67, lip=66.85.158.91, session=<RxsfvaFE/KV283VD>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Nov 28 11:59:29 host2 sshd[1654544]: Disconnected from invalid user ftpuser 45.78.201.248 port 49534 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.131.84.55
country_id: 130758
description:
2025-11-28 12:01:04 dovecot_login authenticator failed for (ADMIN) [178.131.84.55]:61726: 535 Incorrect authentication data (set_id=info@ayuzonelanka.com)


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 164.92.79.20
country_id: 6252001
description:
Nov 28 12:02:12 host2 sshd[1656272]: Disconnected from invalid user sftpuser 164.92.79.20 port 35836 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.194.129
country_id: 6252001
description:
Nov 28 12:05:01 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.194.129, lip=66.85.158.92, session=<8O881KFEPosUQcKB>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 20.65.193.176
country_id: 6252001
description:
Nov 28 12:04:27 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 0 secs): user=<>, rip=20.65.193.176, lip=66.85.158.91, session=<rjgx0qFE/s0UQcGw>


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.79.20
country_id: 6252001
description:
Nov 28 12:06:29 host2 sshd[1658978]: Disconnected from invalid user aj 164.92.79.20 port 55260 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 164.92.79.20
country_id: 6252001
description:
Nov 28 12:07:34 host2 sshd[1659532]: Disconnected from invalid user info 164.92.79.20 port 39334 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.93.41
country_id: 2635167
description:
Nov 28 12:09:24 host2 sshd[1660579]: Disconnected from invalid user will 46.101.93.41 port 45556 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 46.101.93.41
country_id: 2635167
description:
Nov 28 12:10:26 host2 sshd[1661447]: Disconnected from invalid user hello 46.101.93.41 port 39838 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 85.24.211.19
country_id: 2661886
description:
Nov 28 12:15:37 host2 sshd[1664824]: Disconnecting invalid user admin 85.24.211.19 port 38156: Too many authentication failures [preauth]


plugin: ossec
rule: 2502
name: User missed the password more than one time
abuser: 85.24.211.19
country_id: 2661886
description:
Nov 28 12:15:26 host2 sshd[1664736]: Disconnecting authenticating user root 85.24.211.19 port 35862: Too many authentication failures [preauth]


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 85.24.211.19
country_id: 2661886
description:
Nov 28 12:15:26 host2 sshd[1664736]: error: maximum authentication attempts exceeded for root from 85.24.211.19 port 35862 ssh2 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.78.201.248
country_id: 1880251
description:
Nov 28 12:16:07 host2 sshd[1665082]: Disconnected from invalid user root1 45.78.201.248 port 34276 [preauth]


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 57.129.64.10
country_id: 2921044
description:
Nov 28 12:17:36 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 15 secs): user=<>, rip=57.129.64.10, lip=66.85.158.91, TLS: Connection closed, session=<TmNBAaJEZtg5gUAK>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 83.110.87.17
country_id: 290557
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 83.110.87.17 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.90.242.67
country_id: 6251999
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 142.90.242.67 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.166.62.220
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 78.166.62.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.134.105.215
country_id: 1733045
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 115.134.105.215 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.15.68.35
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 104.15.68.35 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.23.230.146
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 72.23.230.146 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.49.251.250
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 49.49.251.250 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Nov 28 12:18:37 host2 sshd[1666720]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-28 12:19:47 dovecot_login authenticator failed for ([127.0.0.1]) [128.185.194.22]:37064: 535 Incorrect authentication data (set_id=contact@bostonlanka.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-11-28 12:20:05 dovecot_login authenticator failed for ([127.0.0.1]) [64.49.97.15]:58934: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 194.165.16.167
country_id: 2993457
description:
Nov 28 12:26:01 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number (no auth attempts in 0 secs): user=<>, rip=194.165.16.167, lip=66.85.158.91, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<9dNZH6JEUP7CpRCn>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.236.254.196
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.236.254.196 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 2.57.121.112
country_id: 798549
description:
Nov 28 12:28:44 host2 sshd[1673116]: Disconnected from invalid user maria 2.57.121.112 port 61987 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 31.42.229.225
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 31.42.229.225 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.183.182.87
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 45.183.182.87 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.153.45
country_id: 3996063
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 187.190.153.45 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 173.69.12.77
country_id: 6252001
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 173.69.12.77 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.161.107.143
country_id: 298795
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 78.161.107.143 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 213.159.198.12
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 213.159.198.12 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.122.177.140
country_id: 3865483
description:
Nov 28 12:30:57 host2 sshd[1674420]: Disconnected from invalid user halo 186.122.177.140 port 20486 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.93.107
country_id: 2661886
description:
Nov 28 12:36:10 host2 sshd[1677265]: Disconnected from invalid user javad 45.8.93.107 port 42076 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.93.107
country_id: 2661886
description:
Nov 28 12:38:25 host2 sshd[1678565]: Disconnected from invalid user ts2 45.8.93.107 port 48532 [preauth]


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 45.8.93.107
country_id: 2661886
description:
Nov 28 12:40:38 host2 sshd[1680075]: Disconnected from invalid user g 45.8.93.107 port 51028 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.129.57.71
country_id: 6252001
description:
2025-11-28 12:41:07 dovecot_plain authenticator failed for c-73-129-57-71.hsd1.md.comcast.net (acoas) [73.129.57.71]:43414: 535 Incorrect authentication data (set_id=marketing@lezzarotech.com)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.93.107
country_id: 2661886
description:
Nov 28 12:41:39 host2 sshd[1680590]: Disconnected from invalid user vpn 45.8.93.107 port 38900 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.8.93.107
country_id: 2661886
description:
Nov 28 12:42:39 host2 sshd[1681082]: Disconnected from invalid user vlad 45.8.93.107 port 57152 [preauth]


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 186.122.177.140
country_id: 3865483
description:
Nov 28 12:44:34 host2 sshd[1681980]: Disconnected from invalid user manager 186.122.177.140 port 14262 [preauth]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 28 12:45:18 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<hr@bostonlanka.com>, method=PLAIN, rip=23.95.63.99, lip=66.85.158.91, session=<P00yZKJELOgXXz9j>


plugin: ossec
rule: 11324
name: Stealth SSH user enumeration attack detected
abuser: 186.122.177.140
country_id: 3865483
description:
Nov 28 12:47:56 host2 sshd[1684545]: Disconnected from invalid user exx 186.122.177.140 port 61785 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.6.181.219
country_id: 1605651
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 171.6.181.219 - epi "GET /login/?login_only=1&user=epi&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epi (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.178.2.83
country_id: 1643084
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 103.178.2.83 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.133.4.238
country_id: 2802361
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 109.133.4.238 - epid "GET /login/?login_only=1&user=epid&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epid (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.229.1.243
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 45.229.1.243 - epidgovlk "GET /login/?login_only=1&user=epidgovlk&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user epidgovlk (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 176.115.145.47
country_id: 2017370
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 176.115.145.47 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 179.0.46.28
country_id: 3469034
description:
[2025-11-13 10:40:03 +0530] info [whostmgrd] 179.0.46.28 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.185.47.247
country_id: 1562822
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 113.185.47.247 - ep "GET /login/?login_only=1&user=ep&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ep (has_cpuser_file failed)


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 45.227.254.152
country_id: 3703430
description:
Nov 28 12:48:23 host2 dovecot[1005950]: pop3-login: Disconnected: Connection closed: read(size=979) failed: Connection reset by peer (no auth attempts in 0 secs): user=<>, rip=45.227.254.152, lip=66.85.158.92, session=<Rt5Vb6JElAkt4/6Y>


plugin: ossec
rule: 9706
name: Dovecot Session Disconnected.
abuser: 198.235.24.41
country_id: 6252001
description:
Nov 28 12:51:23 host2 dovecot[1005950]: imap-login: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=198.235.24.41, lip=66.85.158.91, TLS, session=<n6sNeqJEuPPG6xgp>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.85.174.239
country_id: 6290252
description:
[2025-11-13 10:40:03 +0530] info [cpaneld] 95.85.174.239 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


